European Cybersecurity Month: who holds the keys to your domain?

October is European Cybersecurity Month, the EU’s yearly awareness campaign, coordinated by ENISA, the EU Agency for Cybersecurity. Much of the month is about people: the message that looks right but isn’t, the link that is better left unclicked. We have written before about the people who read your mail and the messages aimed at them.

This article asks the month’s question about a smaller group, one that rarely comes up in awareness training: the people who can change your domain.

Why the keys matter

Everything that makes your domain work — the records that point visitors to your website, deliver your mail and tell receiving servers which mail is really yours — is managed from a few accounts:

• The registrar, where the domain is registered and renewed.
• The DNS host, where the domain’s records are published. Often the same company as the registrar; sometimes your web host or another service.
• Your email platform’s admin console, which decides which mailboxes exist and how outgoing mail is signed.

Whoever can sign in to these can change where your website points, which server receives your mail, and whether your DMARC policy still exists. At the registrar they can also let the domain lapse, or start moving it to another registrar. None of this takes technical skill: a working login is enough, and working logins are what phishing is after.

That is not a reason for alarm. It is a reason to know who holds those logins, the way you know who has a key to the office.

Five questions for an hour in October

1. Where is the domain registered, and where is its DNS hosted? Write both down. They are often different companies, so renewals and record changes happen in different places. If you are not sure, a WHOIS or RDAP lookup names the registrar, and the domain’s nameserver (NS) records usually reveal who hosts its DNS.
2. Who can sign in? For each account, list the people with access. A former employee, a previous agency, the freelancer who built the website years ago: remove access that is no longer needed. Where the provider allows a separate login per person, use that instead of one shared password, so one person’s access can be removed without changing everyone else’s.
3. Is two-step sign-in on? Turn on multi-factor authentication for the registrar, the DNS host and your email platform’s admin accounts. Where the provider offers passkeys or security keys, prefer them: unlike a one-time code, they can’t be typed into a fake sign-in page.
4. Is the registration looked after? Check that the domain renews automatically, that the payment card on file hasn’t expired, and that the transfer lock is on: a registrar setting that stops the domain moving to another registrar until someone with access to the account turns it off. Then check where the registrar’s emails go. Renewal reminders and account-recovery messages are sent to the account’s contact address; make it a mailbox someone reads, preferably a shared one rather than one person’s. If that address is on the same domain, a problem with the domain can also stop the mail meant to warn you about it, so a second address elsewhere is a sensible precaution where the registrar allows one.
5. Would anyone notice a change? If your mail servers were changed, your DMARC record removed or the transfer lock switched off, how would you find out? Not every registrar or DNS host tells you when something changes. Decide who should know, and how the news will reach them.

If you look after domains for clients, the same questions apply to each client, with one more: in whose name is the domain registered? The client should normally be the registrant, the domain’s legal holder, even when you manage it day to day. Then a change of agency is a matter of changing who has access, not of transferring the domain.

Where Merula fits, and what it can’t see

Merula looks at the public side of your domain. It checks the records those accounts control — nameservers, mail servers, SPF, DKIM and DMARC among them — along with the website’s certificate and the domain’s registration expiry. It keeps a timeline of what changed and when, with the previous and the new value, so a change nobody announced is still on record. Free emails you about critical findings; paid plans also send a daily or weekly summary that includes changes to records such as your nameservers, mail servers and DMARC policy.

Where the registry publishes it, Merula also reads the transfer lock. Most Nordic country domains, .se included, don’t publish lock status in a form that can be read from outside; for those, check the setting in your registrar’s control panel.

Merula can’t see who has a login to your registrar, whether two-step sign-in is on, or where your renewal reminders go. Those questions are yours to answer, and this month is a good time to answer them.

About the campaign: ENISA, European Cybersecurity Month ↗.