Domain control
Own the chain from registrant to application
Record each authority, recovery path and dependency before changing delegation. A domain incident can also affect email, identity and third-party verification.
Registration
Keep registrant authority in an organization-controlled account.
- Record
- Registrar, registrant, expiry and renewal
- Risk
- Former contractor owns the account
- Evidence
- Current organization admin and invoice
Administrative access
Protect high-impact changes and recovery.
- Record
- Admins, MFA, recovery and registry lock options
- Risk
- Shared password and stale recovery email
- Evidence
- Least-privilege review and recovery drill
DNS authority
Know who operates nameservers and which records are authoritative.
- Record
- Provider, zones, TTLs and change owner
- Risk
- Old builder retains authoritative zone
- Evidence
- Exported zone and tested change procedure
Web and certificate
Connect intended hosts with valid transport and redirects.
- Record
- A/AAAA/CNAME, apex, www and certificate renewal
- Risk
- One host serves stale or insecure content
- Evidence
- External resolution and HTTPS checks
Dependent records
Preserve email, ownership and service verification.
- Record
- MX, SPF, DKIM, DMARC and provider tokens
- Risk
- Cleanup deletes a live verification record
- Evidence
- Named purpose and owner for each record
Operating principle
Change DNS as a controlled migration
DNS changes are cached across resolvers and affect multiple services. A hurried copy-paste migration can make the website appear healthy while email, verification callbacks or a less common hostname fails.
Inventory the current zone, identify each record owner, lower TTLs only when useful, stage the new service and verify externally before removing the old path.
- Enable strong registrar authentication
- Document every record purpose
- Preserve rollback during propagation
- Monitor expiry and certificate renewal
Applied example
Failure example: website moves, password reset disappears
A team replaces the DNS zone while connecting a new hosting provider. The website works, but the copied zone omits email authentication and MX records used by account recovery.
- The web acceptance test was too narrow
- DNS served several independent products
- No record ownership inventory existed
- Rollback data was available only in the old dashboard
Plain answers
Questions to resolve before shipping
Should the apex and www host both work?+
Choose a canonical host, redirect the alternative consistently and verify certificates and application behavior for every supported hostname.
Is automatic renewal enough?+
It reduces routine work, but monitor payment, expiry, account access and failed renewal so the organization can intervene.
Can a public scan prove domain ownership?+
No. Public DNS shows delegation and records, not the legal registrant or private administrative authority.