Domain name hijacking, DNS poisoning, and registrar lockout¶

Losing control of your organization's primary domain name or Authoritative DNS zone is one of the most devastating digital emergencies a business, hospital, municipal agency, or online publication can suffer. Because your domain name is the root of trust for every system on the internet, an attacker who hijacks your domain registrar account or poisons your DNS records does not merely deface your website. Within minutes of changing your NS (Nameserver), A/AAAA (Web IP), or MX (Mail Exchange) records, the attacker can silently intercept every incoming corporate and customer email, pass automated Let's Encrypt Domain Validation (DV) checks to mint valid TLS/SSL encryption certificates in your name, capture employee Single Sign-On (SSO) passwords, and trigger password-reset emails for your cloud infrastructure, banking portals, and financial accounts. Even an non-malicious failure, such as an expired domain falling into AutoRenewGracePeriod to RedemptionPeriod (clientHold), brings web traffic, API mobile backends, and company email to an instant halt across the globe.

If a domain hijacking or DNS outage compromises hospital patient routing, emergency dispatch communications, public utility telemetry, or an active life-safety system, call your local emergency number (911 na États-Unis mpi na Canada, . 112 na Union européenne ya mvimba, . 999 na Royaume-Uni) to tala mukanda na beto ya ke tubilaka mambu ya bansi mingi . nimero ya urgence and notify your national cyber incident response team (such as CISA in the United States at 1-844-SAY-CISA or NCSC in the United Kingdom) immediately. For all commercial, nonprofit, and personal domain crises, execute the triage steps below in exact order.

Sala yo sesepi¶

1. Determine in 30 seconds whether your domain expired, your DNS records were altered, or the domain was transferred to a foreign registrar: Run a live RDAP to WHOIS query and an authoritative DNS query from a terminal (rdap yourdomain.com to whois yourdomain.com, mpi dig +trace yourdomain.com). Check the Registrar Name, the EPP Status Codes (such as clientHold for billing/verification vs. ok with unfamiliar nameservers), and the Authoritative Nameservers (NS).
2. Freeze all outbound password resets and lock down your Identity Provider (Okta, Microsoft Entra ID, Google Workspace) immediately: If an attacker controls your domain's MX records or NS baserveur, bo ke bakaka konso e-mail yina bo ke tindaka na . *@yourdomain.com. Immediately instruct your IT administrators to disable "Forgot Password via Email" self-service resets across all corporate tools, revoke active sessions for users whose email addresses might be used to reset external vendor accounts, and switch administrative logins to hardware FIDO2 security keys or internal .onmicrosoft.com fallback domains.
3. Preserve full forensic snapshots of RDAP/WHOIS, DNS zones, and Certificate Transparency (CT) logs before anything changes: Save the output of dig ANY yourdomain.com @8.8.8.8, whois yourdomain.com, and check crt.sh/?q=%25.yourdomain.com immediately. Searching crt.sh reveals every unauthorized SSL/TLS certificate the attacker just minted for your subdomains (mail., vpn., login., api.) so you know exactly which internal services they are actively impersonating via Adversary-in-the-Middle (AitM) proxies.
4. Contact the Losing Registrar's dedicated Emergency Abuse / Security Operations Team (not Tier-1 chat support) to trigger an ICANN Unauthorized Transfer Dispute (IRTP) or Registry Lock reversal: If your domain was pushed to another account at the same registrar or transferred via a stolen Auth-Info (EPP) code to a foreign registrar, contact your original registrar's Domain Abuse / High-Risk Security Escalation Desk and request an immediate Registrar Undo / Emergency Transfer Dispute under the ICANN Transfer Policy (Section I.A mpi Transfer Dispute Resolution Policy), citing unauthorized credential compromise.
5. Escalate directly to the Top-Level Domain (TLD) Registry Operator if the registrar is unresponsive: Remember the hierarchy: Registrars (like GoDaddy, Namecheap, Cloudflare, MarkMonitor, Network Solutions, Gandi, Porkbun) are simply retail resellers; the Registry Operator (such as Verisign for .com/.net, Public Interest Registry (PIR) for .org, Nominet for .uk, CIRA for .ca, DENIC for .de, or auDA for .au) runs the master root zone database. Country-code (ccTLD) registries and several gTLD registries can place an emergency serverHold to serverUpdateProhibited lock directly at the root level during verified cybercrime incidents.
6. Warn customers, vendors, and banking partners through out-of-band channels that @yourdomain.com email is compromised: If the attacker hijacked your MX records, they will immediately reply to open accounting threads with fake wire transfer instructions. Notify clients via telephone, SMS, LinkedIn, status page on a separate backup domain, or official social media accounts not to trust any email or login portal on the affected domain until restoration is confirmed.

Decision tree: diagnosing and containing a domain or DNS outage¶

Follow this rapid diagnostic flowchart to pinpoint the exact layer of the Domain Name System that has failed or been hijacked:

flowchart TD
    A["Website Down, TLS Certificate Warning, or Corporate Email Halted"] --> B["Run RDAP/WHOIS & dig +trace from External Network"]
    B --> C{"What do RDAP Status & Registrar Fields Show?"}
    C -->|"Status: clientHold, autoRenewPeriod, or redemptionPeriod"| D["Accidental Expiration or ICANN Whois Verification Suspension"]
    D --> E["Log into Registrar Immediately: Pay Renewal / Redemption Fee or Click RAA Verification Link; Request Emergency TTL Flush"]
    C -->|"Registrar Name or Registrant Account Changed Without Authorization"| F["Kukanga konti ya Registraire ya Mvimba to Kupesa EPP ya Kukonda Nswa"]
    F --> G["Kanga muntu yina ke pesaka bansangu (Entra/Google), Tike ya kusadila mambu ya mbi sambu na muntu yina ke sonikisaka bazina na bo na kintulumukina + Kukonda kuwakana ya kupesa mbongo na ICANN, Tala crt.sh sambu na mikanda ya luvunu"]
    C -->|"Muntu ya ke sonikisaka bazina mpi NS me sobaka ve, kansi A / CNAME / MX ke monisaka ba IP yina me zabana ve"| H["Managed DNS Provider Compromise (Cloudflare / Route53 / NS1 API Key or Account Breach)"]
    H --> I["Katula Ba-Token ya API ya DNS ya Bo Me Bebisa, Vutula Fichier ya Zone ya Me Zabana-Mbote, Katula Ba-Certificat TLS ya Luvunu, Balula Ba-Crédentiels ya Bo Me Monisa"]
    C -->|"Registrar, NS, and Zone Records Look Normal, but Site Fails with SERVFAIL"| J["Broken DNSSEC Chain of Trust (DS Record Mismatch or Expired RRSIG)"]
    J --> K["Run DNSViz.net Check: Remove Stale DS Record at Registrar or Re-Sign Zone at DNS Host"]

Phase 1: Technical forensics to identify the exact attack vector¶

When a domain suddenly stops resolving or starts serving a phishing page or cryptocurrency scam, every minute spent guessing wastes precious recovery time. There are four completely distinct scenarios that look identical to an end user in a web browser, and each requires a completely different fix.

How to Read RDAP, WHOIS, mpi dig Outputs Like an Incident Responder¶

Open a command terminal on Linux, macOS, or Windows (using WSL or nslookup) and run the following three diagnostic checks using a neutral public recursive resolver (8.8.8.8 to 1.1.1.1):

1. Check the Registry-Level Delegation (dig +trace mpi RDAP):

   dig +trace yourdomain.com NS @1.1.1.1
   

   • Look at the step right after the TLD root servers (for example, a.gtld-servers.net. for .com). Which NS (Nameserver) hostnames are returned by the TLD Registry itself?
   • If the TLD Registry returns your normal nameservers (ns1.yourdnsprovider.com) with status NOERROR, the hijack is happening inside your DNS hosting provider (or it is a DNSSEC breakage).
   • If the TLD Registry returns completely unfamiliar nameservers (or if whois yourdomain.com shows a new Registrar: name and an Updated Date: within the last few hours or days), the hijack happened at the Domain Registrar level.
2. Kukatula bakode ya kisika ya ICANN EPP: Tala na Domain Status: milongo na nge WHOIS to RDAP kubasika. Ba code yayi ya Protocole ya kupesa bima mingi (EPP) ke zabisa nge sambu na inki domaine mosi ke sala ve to me kangama:

Phase 2: Recovering from a malicious domain hijack or unauthorized registrar transfer¶

Attackers hijack high-value corporate, Web3/DeFi, financial, and media domains using three primary techniques: 1. Registrar Account Takeover (Credential Stuffing, Infostealer Malware, or SIM Swap): The attacker logs into your GoDaddy, Namecheap, Google Domains/Squarespace, or Network Solutions dashboard, turns off clientTransferProhibited, changes the NS records to point to an attacker-controlled Cloudflare account, or generates an Auth-Info (EPP) code to transfer the domain out. 2. Social Engineering of Registrar Support: The attacker submits forged incorporation documents, fake government IDs, or spoofed letterhead to a registrar's account recovery desk claiming the original IT admin died or left the company. 3. Subdomain Takeover (Dangling CNAME / Dangling NS): Your main domain is untouched, but an old subdomain (promo.yourdomain.com to status.yourdomain.com) still has a CNAME record pointing to a decommissioned AWS S3 bucket, Azure App Service, GitHub Pages repo, Heroku app, or Zendesk instance that you deleted months ago. The attacker registers that abandoned cloud resource name on AWS/Azure/GitHub and immediately serves malicious content from your official subdomain.

Step 1: Evict the Attacker from Your Cloud Identity Provider and Email System¶

Before you even finish filling out the registrar recovery form, assume the attacker is actively reading every email sent to your domain and trying to pivot into your internal cloud infrastructure:

1. Switch Microsoft 365 / Google Workspace to Fallback Domains and Hardware MFA:
   • In Microsoft Entra ID (formerly Azure AD), every tenant has a permanent, un-hijackable fallback domain (yourcompany.onmicrosoft.com). Administrators can log in via admin@yourcompany.onmicrosoft.com even if yourdomain.com DNS is completely hijacked.
   • Disable all SMS, voice call, and alternate-email password reset methods in Entra ID / Okta / Google Workspace (Authentication Methods Policy). Require FIDO2/WebAuthn hardware security keys or number-matching Authenticator push notifications.
2. Audit Outbound and Inbound Email Logs for the Exact Compromise Window:
   • If your MX records were changed at 02:14 UTC, zero legitimate external emails have reached your real mail servers since 02:14 UTC; every single external email sent to your staff during that window was captured in full plaintext by the attacker's rogue mail server (Postfix/Exim listener).
   • Immediately pull a list of every third-party SaaS platform, bank, AWS/GCP root account, GitHub organization, and vendor portal tied to @yourdomain.com email addresses, and check whether the attacker triggered password resets on those external platforms during the hijack window.

Step 2: Execute the Registrar and Registry Emergency Recovery Protocol¶

Do not open a generic "My website isn't working" support chat. You must use the exact regulatory and legal terminology that triggers escalation to the Registrar Tier-3 Security / General Counsel / ICANN Compliance Team:

1. Case A: The Domain Is Still at Your Original Registrar (Account Takeover or Internal "Account Push"):
   • Many attackers do not wait 5 days for an inter-registrar EPP transfer; instead, they use the registrar's instant "Push Domain to Another Account" feature to move your domain into a burner account at the same registrar in 3 seconds.
   • Call and email the registrar's Fraud / Account Hijacking / Abuse Department immediately. State clearly: "URGENT SECURITY INCIDENT: Unauthorized Account Access and Internal Domain Push / DNS Modification of [yourdomain.com]. Requesting immediate freezing of the domain under serverHold/clientUpdateProhibited and rollback of unauthorized DNS/Account changes."
   • Assemble Your Proof of Historical Ownership Packet Right Away: Registrar security teams require incontrovertible proof that you are the legitimate prior registrant before they will pull a domain back from another account. Gather these 5 documents into a single PDF immediately:
     1. Historical Registrar Invoices and Payment Proofs: PDF receipts and credit card / bank wire statements showing your organization paying for the registration and renewal of yourdomain.com over the past 1 to 10 years (including the last 4 digits of the payment card or wire reference).
     2. Government-Issued Corporate Registration & Officer ID: Official Certificate of Incorporation / Articles of Organization matching the historical WHOIS Registrant Organization, plus a government photo ID of the corporate officer signing the affidavit.
     3. Historical DNS Zone File & Server Ownership Proof: Copies of your prior DNS zone file, historical WHOIS snapshots, or proof that your organization owns the autonomous system (ASN) or IP blocks (A records) that the domain pointed to for years prior to today's change.
     4. Original Account Creation Email / Ticket History: Headers of emails received from the registrar at the time the domain was originally registered or renewed.
     5. Official Law Enforcement Report Number: A filed FBI IC3 (ic3.gov) complaint number (United States), Action Fraud reference number (United Kingdom), or national police cybercrime report number. Registrars act dramatically faster when handed a formal law enforcement case number confirming a criminal computer intrusion under 18 U.S.C. § 1030 (CFAA) or the UK Computer Misuse Act 1990.
2. Case B: The Domain Was Transferred Out to a Different Registrar (Inter-Registrar Hijack):
   • Under the ICANN Transfer Policy (formerly IRTP), an inter-registrar transfer requires an Auth-Info (EPP) code and must be blocked for 60 days after certain registrant changes unless waived. If an attacker hacked your account at Registrar A (the "Losing Registrar") and transferred the domain to Registrar B (the "Gaining Registrar"):
   • Contact BOTH the Losing Registrar and the Gaining Registrar immediately, but prioritize the Losing Registrar's Transfer Dispute / Security Team. Under ICANN's Transfer Dispute Resolution Policy (TDRP), the Losing Registrar is the entity that has your historical billing records and login logs proving the transfer was unauthorized. The Losing Registrar can formally contact the Gaining Registrar's compliance officer to execute a cooperative Registrar Transfer Undo, or file a formal TDRP proceeding.
   • Simultaneously send your ownership proof packet and police report to the Gaining Registrar's Abuse Desk demanding that they place an immediate clientTransferProhibited mpi clientUpdateProhibited lock on the domain so the attacker cannot hop the domain through a chain of three more offshore registrars ("registrar hopping").
3. File an Emergency Escalation with ICANN (for gTLDs like .com, .net, .org, .io if gTLD) or the ccTLD Registry:
   • If a registrar refuses to investigate an unauthorized transfer or fails to respond during an active hijack, submit an urgent Unauthorized Transfer / Domain Hijacking Complaint via the ICANN Contractual Compliance Portal (icann.org/compliance/complaint).
   • If your domain uses a Country-Code Top-Level Domain (ccTLD), such as .uk, .ca, .au, .de, .fr, .nl, .ch, to .jp, you have an even faster option: ccTLD registries are governed by national oversight authorities rather than ICANN and almost always maintain direct Registry Emergency Security Teams (for example, Nominet in the UK at 0330 236 9470, CIRA in Canada, DENIC in Germany, AFNIC in France) that can freeze a hijacked domain directly at the national registry level within hours upon verifying corporate identity.

Phase 3: Rescuing an expired domain (clientHold, RedemptionPeriod, mpi PendingDelete)¶

Not every sudden global outage is a cyberattack. Every single day, major companies, SaaS startups, and government contractors go completely dark because the credit card on file at their domain registrar expired, and the renewal reminder emails were sent to former-founder@company.com who left the firm three years ago.

Understanding the ICANN Expired Domain Lifecycle Timeline¶

For generic Top-Level Domains (.com, .net, .org, .biz, .info), the ICANN Expired Registration Recovery Policy (ERRP) enforces a strict multi-stage lifecycle after the expiration date passes:

1. Stage 1: Auto-Renew Grace Period (Days 1 to ~30/45 after Expiration):
   • Immediately after expiration (often within 24 to 72 hours), the registrar changes the domain's NS records to a Parked / Expired Renewal Splash Page or places the domain on clientHold.
   • Impact: Your website and corporate email stop working immediately (DNS_PROBE_FINISHED_NXDOMAIN or parking ads).
   • Recovery: Log into the registrar account and pay the standard 1-year renewal fee ($10 to $30 USD). The registrar immediately restores your original NS records.
2. Stage 2: Redemption Grace Period (redemptionPeriod, 30 Days Duration):
   • If no one renews the domain during Stage 1 (usually after day 30 to 42 depending on the registrar's Terms of Service), the registrar deletes the domain at the Registry, and the Registry places it into the mandatory 30-day redemptionPeriod (unless the registrar auctioned the expired domain via an internal expired-domain auction platform like GoDaddy Auctions or NameJet, check your registrar's exact day-30 auction cutoff immediately).
   • Recovery: You can still rescue the domain with 100 percent certainty during redemptionPeriod, only through the original Losing Registrar. You must contact their billing/support desk and pay the Registry Redemption Restore Fee (typically $80 to $250 USD) plus a 1-year renewal.
3. Stage 3: Pending Delete (pendingDelete, Final 5 Calendar Days):
   • Once the 30-day redemptionPeriod expires, the domain enters pendingDelete for exactly 5 days (120 hours).
   • Impact: During pendingDelete, the Registry rejects all standard EPP restore commands from the registrar. At the end of day 5 (for .com/.net Verisign drops, between 18:00 and 19:15 UTC), the domain is released to the public and snatched within 10 milliseconds by automated drop-catching networks.
   • Emergency Action if Caught in pendingDelete or Registrar Expired Auction:
     • If the domain was sold via the registrar's day-30 expired auction before entering Registry redemptionPeriod, check if your registrar offers a short post-auction redemption window or contact the winning bidder/broker immediately.
     • If the domain is truly in the 5-day Registry pendingDelete phase, simultaneously place high-tier backorders across all three major drop-catching networks (DropCatch.com, SnapNames.com, mpi NameJet.com) na mpila nde kana domaine me kulumuka na piscine ya bantu yonso na Kilumbu ya 5, backorder na nge ke kanga yo to ke kotisa nge na enchère ya ba bidder ya kukangama sambu na kusumba diaka domaine na nge.

Sambu na nki Site na Mono Ke Salaka Kaka ve na Bangunga Mingi Na nima ya Kuyidika Domaine Yina Me Manaka? (Kuyidika Cache ya DNS ya mbi)¶

Ntangu domaine na nge ke mana, registraire ke yingisa domaine na nge . NS badiske yina kele ti baserveur ya bazina ya parking ya ntangu fyoti yina kevandaka mbala mingi ti TTL (Ntangu ya Kuzinga) ya bangunga 24 tii na 48 (86400 to 172800 sekonde). Ata na nima ya kufuta mbongo ya kuvutula mbongo mpi muntu yina ke sonikisaka bazina na nge kuvutula mbongo na nge ya kieleka . NS nsangu na zone ya kisina na nsungi ya minuta 5, ba résoluteurs DNS récursifs ya bantu yonso na ntoto ya mvimba (Google 8.8.8.8, Kupela ya matuti 1.1.1.1, Quad9 9.9.9.9, mpi ba resolver ya ISP) lenda landa kusadila lutiti ya parking yina me manaka tii kuna TTL yina ya bangunga 48 ta suka.

How to Force an Instant Global DNS Cache Flush in 60 Seconds: Do not wait 48 hours for recursive caches to expire naturally. Manually flush your domain from the three largest global public DNS providers right now using their free web cache-purge portals: 1. Flush Google Public DNS (8.8.8.8 / 8.8.4.4): Visit developers.google.com/speed/public-dns/cache, type yourdomain.com, select record type NS (and then repeat for A, AAAA, MX, and DS), and click Flush Cache. This clears your domain across every Google DNS data center worldwide in less than 10 seconds. 2. Flush Cloudflare Public DNS (1.1.1.1 / 1.0.0.1): Visit one.one.one.one/purge-cache/, enter yourdomain.com, select NS, A, AAAA, and MX, and click Purge Cache. 3. Flush OpenDNS / Cisco Umbrella (208.67.222.222): Visit cachecheck.opendns.com, enter yourdomain.com, check the results across global nodes, and click Refresh the Cache at the bottom of the table.

Phase 4: Fixing broken DNSSEC (SERVFAIL) after a migration or hijack¶

Domain Name System Security Extensions (DNSSEC) cryptographically signs your DNS records (RRSIG records signed by a Zone Signing Key ZSK and Key Signing Key KSK) and publishes a matching Delegation Signer (DS) hash in the parent TLD zone at your registrar.

While DNSSEC prevents cache poisoning, a broken DNSSEC configuration causes an instant, total global outage (SERVFAIL) on every validating resolver (including 8.8.8.8, 1.1.1.1, Comcast, and major mobile carriers). This most commonly happens during an emergency migration: an administrator moves yourdomain.com's nameservers from Cloudflare to AWS Route 53 (or vice versa) without first deleting the old provider's DS record at the domain registrar.

Diagnosing and Repairing a DNSSEC SERVFAIL Lockout in 5 Minutes¶

1. Confirm DNSSEC Is the Culprit: Run two dig commands back-to-back: one normal query, and one query with the +cd (Checking Disabled) flag, which tells the recursive resolver to ignore DNSSEC cryptographic validation:

   dig yourdomain.com @8.8.8.8
   dig yourdomain.com @8.8.8.8 +cd
   

   • If the first command fails with status: SERVFAIL and zero answers, while the second command (+cd) immediately succeeds with status: NOERROR and returns your A record IP address, 100 percent of your outage is a broken DNSSEC chain of trust.
2. Inspect the Exact Breakage with DNSViz.net to Verisign DNSSEC Debugger:
   • Open dnsviz.net to dnssec-debugger.verisignlabs.com and enter yourdomain.com.
   • It will draw a visual diagram showing whether the DS record published at your registrar fails to match the DNSKEY served by your current DNS host, or whether your zone signatures (RRSIG) have expired.
3. Emergency Remediation:
   • If you just changed DNS providers: Log into your Domain Registrar, navigate to the DNSSEC / DS Records section, and delete the old stale DS record (or replace it with the new DS record generated by your new DNS host).
   • Flush the DS record cache: Immediately visit Google Public DNS Cache Flush (developers.google.com/speed/public-dns/cache) and Cloudflare Purge Cache (one.one.one.one/purge-cache/) and purge the DS and DNSKEY record types for yourdomain.com so validating resolvers stop checking the deleted DS hash immediately.

Phase 5: Post-recovery clean-up, TLS certificate revocation, and hardening¶

Getting your domain registrar account and DNS records back under your control is only half the battle. During the hours or days that the attacker controlled your domain's DNS, they had complete authority to prove "Domain Control Validation" (DCV) to every Certificate Authority (CA) on the planet.

1. Audit Certificate Transparency Logs (crt.sh) and Revoke Rogue TLS Certificates¶

When an attacker points your A to NS records to their server, they immediately run certbot (Let's Encrypt, ZeroSSL, Google Trust Services, or Sectigo) to generate valid, browser-trusted TLS certificates for yourdomain.com, *.yourdomain.com, vpn.yourdomain.com, mpi mail.yourdomain.com. Even after you restore your DNS records, the attacker still holds the valid Private Key (.key) and signed Public Certificate (.crt) for your domain, which they can use to stage captive-portal Wi-Fi attacks, BGP hijacks, or internal network spoofing for the next 90 days.

1. Query Certificate Transparency Logs:
   • Go to crt.sh/?q=%25.yourdomain.com to Sosa Mukanda ya Censys (search.censys.io/certificates).
   • Kuyidika na Logged At / Not Before date mpe tala konso mukanda mosi mosi yina me basika na ntangu ya fenetre ya hijack (mpe na bangunga 24 na nima ya kuvutula, sambu na nswa ya DCV ya bo me bumbaka).
2. Kukatula Nswalu Mukanda:
   • Zaba muntu yina ke pesa Mfumu ya Ke Pesaka Mikanda (Issuer Name) na konso mukanda ya kukonda nswa.
   • Konso CA yina bantu yonso ke tudilaka ntima ke lombamaka na nsi ya Bansiku ya luyantiku ya CA/Forum ya Navigateur (Kitini 4.9.1.1) na kukatula mukanda ya luvunu to ya kukonda nswa na nsungi ya bangunga 24 na nima ya kundimisa nde muntu yina me lomba nswa vandaka ve ti nswa ya mfumu ya kieleka ya domaine.
   • Kana nge me baka dezia kiyeka ya DNS na zulu ya domaine, nge lenda katula nge mosi mikanda ya Let’s Encrypt to ya ACME yina bo me pesa ve nswa na basegonde 60 kukonda nkutu mfunu ya nsapi ya kinsweki ya muntu yina me sala nge mbi: tula kaka . certbot na serveur ya nge ke twadisaka, lutisa DNS-01 to HTTP-01 ya mpa sambu na zina ya domaine ya mutindu mosi na kusadilaka nsabi ya konti ya ACME ya mpa kibeni, mpi sala:

     certbot revoke --cert-path downloaded_rogue_cert_from_crt_sh.pem --reason keycompromise
     

   • Na mutindu yankaka, tinda Banimero ya Serie ya Mukanda mbala mosi na porte ya CA ya kukatula nswa na mbala mosi (mu mbandu, lutiti ya malongi ya kukatula nswa ya Let’s Encrypt, ya DigiCert . /revoke portal, to formulaire ya kuzabisa mambu ya mbi ya SSL ya Sectigo).

2. Kanga Domaine Na Nge Kimakulu Sambu Bo Kubaka Yo Diaka Ve¶

Kana bisalu me vutuka, sadila bima tanu yai ya ke sadisaka na kukumisa domaine ya kompani ngolo:

1. Kangula Kukangama ya Registre (serverUpdateProhibited, serverDeleteProhibited, serverTransferProhibited):
   • Sambu na ba domaine ya kusala kisalu yina kele mfunu mingi, tula na zulu ya registraire yina ke pesaka Kukangama ya Registre ya kieleka (yina ke sadisamaka na Verisign na 10.00.2019). .com/.net, PIR na .org, mpi bo ke pesaka yo na nzila ya bantu yina ke sonikisaka bazina na bakompani bonso MarkMonitor,Bisalu ya Marke ya Dijital ya CSC, Kompani ya Cloudflare, ba-niveau ya Kukanga Ba-Registre ya Porkbun/Gandi/Namecheap). Kana Registry Lock kele na kisalu, ata muntu mosi ya ke sosaka kufwa bantu me yiba mukanda na nge ya kukota mpi MFA, Registre TLD ke buyaka mambu yonso . NS to kupesa bansoba katula kaka kana muntu ya ke talaka mambu ya lutaninu ya bantu me manisa lukutakanu ya cryptographie/telefone yina kele na nganda ya bande.
2. Basisa CAA (Nswa ya Mfumu ya Ke Pesaka Mikanda) Bansangu ya DNS:
   • Yika CAA dosie (RFC 8659) na zone na nge ya DNS yina ke monisa kibeni Bamfumu ya Ke Pesaka Mikanda yina bo me pesa nswa ya kubasisa mikanda ya TLS sambu na domaine na nge (mu mbandu, 0 issue "letsencrypt.org" to 0 issue "digicert.com", yika 0 iodef "mailto:security@yourdomain.com"). Na ntangu muntu yina ke sosaka kunwanisa nge yina ke twadisaka zone na nge ya mvimba ya DNS lenda katula . CAA disque, a CAA récord ke kangaka ba hijackers ya BGP to ba targets ya CNAME ya subdomaine yina bo me bebisaka na kusadila ba CA yina bo me pesa ve nswa.
3. Kabula Registreur ya Domaine na Nge ti Provideur ya DNS ya Konso Kilumbu:
   • Lunda zina na nge ya domaine na kati ya konti ya registraire ya coffre ya lutaninu ya ngolo yina kaka bamfumu 2 ya kompani lenda kota na kusadilaka Bafungula ya lutaninu ya bima ya FIDO2 (YubiKey), mpi pesa bantu ya nkaka kisalu ya kutwadisa bansangu ya DNS konso kilumbu (A, CNAME, TXT) na kisalu ya DNS ya kukabwana yina bo ke twadisaka ti Contrôle d’accès basé sur le rôle (RBAC) ya granulaire mpi ba jetons API scopés.
4. Kutala mpi kukatula kitini ya fioti yina ke kangamaka CNAME mpi NS Badosie:
   • Sala scanner ya automatique ya konso ngonda ya fichier ya zone DNS na nge ya mvimba (subzy, nuclei -t takeovers/, to OWASP Amass) sambu na kuzaba konso . CNAME, ALIAS, to kisika ya fioti NS récord yina ke monisa ressource ya matuti ya nganda yina bo me sonikisaka ve zina to domaine yina me manaka, mpi katula récord ya DNS na ntwala ya kukatula na kisalu serveur ya matuti.
5. Tula RDAP, DNS, mpi CT ya ke tala mambu ya me tala mikanda ya nganda:
   • Kuyidika monitere ya nganda (bonso CertSpotter, Cloudflare Kutala mutindu mikanda ya ke ndimisa mambu ke monanaka pwelele, to kutala script ya cron ya pete-pete konso ngunga . dig NS mpi whois) yina ke kebisaka nzila mosi ya Slack/PagerDuty yina bo me pesaka mpi adresi mosi ya SMS/email yina kele na nganda ya domaine na munuta ya siki-siki yina mukanda ya mpa ya TLS me kota na Transparence des certificats to na mukanda ya . NS/MX/DS record changes.

Bangyufula yina bantu keyulaka mbala na mbala¶

Bo me tala bisika yina bo me katuka¶

• Cybersecurity and Infrastructure Security Agency (CISA, United States): Emergency Directive 19-01: Mitigate DNS Infrastructure Tampering (CISA mandates on Registry Lock, MFA for DNS/Registrars, Certificate Transparency log auditing, and DNSSEC validation) (cisa.gov/news-events/directives/emergency-directive-19-01).
• Internet Corporation for Assigned Names and Numbers (ICANN, International): Transfer Policy (Inter-Registrar Transfer Policy / IRTP), Transfer Dispute Resolution Policy (TDRP), Expired Registration Recovery Policy (ERRP), and EPP Status Codes Reference (icann.org/resources/pages/epp-status-codes-2014-06-16-en).
• National Institute of Standards and Technology (NIST, United States): Special Publication 800-81-2, Secure Domain Name System (DNS) Deployment Guide (csrc.nist.gov).
• National Cyber Security Centre (NCSC, United Kingdom): Protecting Bulk Personal Data and Domain Security: Registry Lock, CAA Records, and Subdomain Takeover Prevention (ncsc.gov.uk).
• CA/Browser Forum (International): Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates (Section 4.9.1.1: 24-Hour Mandatory Revocation for Domain Compromise) (cabforum.org).
• Internet Engineering Task Force (IETF, International): RFC 4033/4034/4035 (DNSSEC), RFC 8659 (DNS Certification Authority Authorization / CAA Resource Record), and RFC 9083 (Registration Data Access Protocol / RDAP) (datatracker.ietf.org).

Bantwadisi ya ke wakana¶

• Web hosting crisis, migration, and backup restoration
• Phishing mpi bakonti yina bo me bebisa
• MFA phishing mpi bambeni-na-kati-kati
• Mvutu ya kufwa bansiku ya bansangu mpi kubasika ya mot de passe
• Kufwa ya ransomware ya mumbongo mpi ya serveur
• Kusoba SIM