The Commandments of Domain Name Ownership

The simple truth is that there are countless scammers, cybersquatters and other criminal types out there just waiting for anyone with a domain name to make a mistake that will allow them to steal it from under their collective noses. I don't want to get too wordy here at the risk of information overload and shear boredom, so I'll try to be as laconic as possible.

Throughout the many years I have been involved with the hosting business and others I have witnessed some truly horrifying events involving domain names. Recently a customer of ours was duped out of $180 by a scam originating from a site with the fiendishly clever name of Domain Registry of Canada. While this scam poses no real threat to losing one's domain name, it is nonetheless an underhanded trick taking advantage of busy people or those that are just not aware of such criminal activities. Please view this page for more information. Pay particular attention to the provided link to the PDF file showing the cleverly formatted renewal notice - a wolf in sheep's clothing. More information on Domain Name Slamming can be viewed at the Small Business of BC Blog.

While it's true that domain names on their own are not anywhere near the dollar value they enjoyed in the late 1990's or early 2000's, their value is not all credited to their name value alone. The branding and personal or corporate identity your domain name provides are an invaluable asset to you and must be protected!

Of course there are numerous methods that crooks employ to try and compromise people's or companies domain names, but as I alluded to above I wanted to keep this article as short as possible. Suffice it to say, that if you follow the directives below, you can rest assured that your domain name will remain exactly that - yours.

The Commandments of Protecting Your Domain Name(s)

• Always (I said always) Register Your Domain Name Yourself

  You may completely trust your web developer, designer or anyone else that you've assigned to register your domain name but there is nothing certain about what tomorrow might bring. The annals of my IT career are laden with memories of hosting customers who experienced intolerable and sometimes expensive tribulations when there was a falling out with the person listed as the domain name owner. While most web developers or designers and maybe even your best friend are certainly as honest as Abe himself, there are some who are capable of doing some very underhanded things.

  Don't fall victim to misplacing your trust. Would you put your home or your car in someone else's name? - probably not. Most domain registrars will allow you to create limited access entry to your domain name's control panel interface. This is handy for changing DNS (Name Servers) or making other related changes but does not allow any changes to domain ownnership information.

  Under any circumstances never let anyone other than you be listed as the domain name owner or administrative contact. You must maintain absolute control of your domain name - it's that simple.

• Corporate Domain Names Should Always be Registered in the name of the Company

  The owner of the company or a trusted senior executive officer should be the only person listed as administrative contact and the only individual allowed to make ownership changes.

  Futhermore any employee, whether senior executive or not, should sign a legal agreement that clearly species the terms and conditions under which he/she is allowed certain privileges within the domain's administrative panel. Such an individual should have no rights to sell, trade, lease or do anything that may compromise the functioning of the website, its ownership or any other similar critical changes.

• Make sure your Registrar only makes changes upon your approval

  Be absolutely certain that any changes to your domain name's information is emailed to you within 1-3 hours so that you are aware of it and can immediately cancel any changes that you did not initiate or approve.

Use a Hard to Guess Password and always Encrypt your Data

I will not say too much about selecting difficult to guess or scan passwords - it's painfully obvious isn't it? The fact is that most domain name and website compromises have their origin in hackers either guessing, scanning or obtaining your password and other private and critical information by breaking into your personal computer or company network. So under this section there are 3 critical things you need to do:

• Choose a hard to guess password
• Use best-of-breed virus and malware scanners on your personal computer and your company network. Put a quality firewall and router in front of all your computers. In our in-house systems we use a product named Kaspersky Lab which has really served us well.
• Now, just in case the bad guys get past the lines of defence mentioned above you should encrypt all the critical data stored on your computer(s). If they see encrypted data, they will move on and seek another system to compromise - hackers don't like difficult situations. There is an encryption software product available from FlexCrypt. This site also offers some good content (in simple terms)through a video and demos on the main page.

• Never Register a Domain using a Free Email Address

  Free email addresses such as Hotmail will suspend and remove email addresses that are not used on a regular basis. If you register your domain using a free email service and then abandon it, you could be putting yourself in a vulnerale position. It would be easy for a domain name hijacker to register your email address once it has been deleted by the free email service and then use it to compromise your domain. Use your ISP's email address to register your domain and once you have your domain services, such as email set up, then change it to an email that resolves to your own domain.

• Place a Register Lock on your Domain

  Most registrars will allow you to lock your domain so that it can't be transferred, changed or deleted by a third party. If your registrar does not include this service get one that does. Be sure that you have total lock/unlock control features

• Never forget to Renew Your Domain

  On occasion our support department gets emails or phone calls from panicked website owners - My site is down!! What's going on!! Well, it's not often that our servers have issues, but they can and do and on some occasions websites can become inaccessible. Happens to Google© and happens to us.

  When we get such support calls we are normally in a position to already know there are some temporary issues and we can quickly let the customer know that we'll be back online real soon. What we can't fix is a site that is down because the domain's owner allowed it to expire. When this happens the registrar will shut the site down and without a registered domain the subject site is inaccessible until the issue of domain renewal is fully resolved.

  There are several steps you can take to prevent this happening to you:

  • Register your domain for 5 years or longer. Most domains cost only between $10-15 annually to register and often discounts are available for longer registration terms. It might, for example, cost only about $45-60 to register a domain for 5 years. The longer term will take off some of the renewal pressures.
  • Be sure to whitelist your domain registrar's service email address so you will not miss renewal reminders from them. You can do this through your email software (Outlook, Thunderbird, etc) and as an added measure have it done at the server level as well. If you are not sure of how to whitelist an email address at the server level, simply call your hosting provider and they'll usually do this without charge.
  • Keep renewal dates of all your domains posted on your computers calendar and use reminder alerts

  If your domain does happen to expire regardless of the above precautions, all is not lost. Most Domain Name Registrars offer a grace period of 30-35 days during which you can recover your domain name without penalty. Although ICANN recommends and suggests registrars allow for a 30 day grace period, I do not believe that this is caste in stone either.

  To be sure, check the posted Terms and Conditions (TOS) to see what the registrars policy is with regards to expired domain name redemption periods. If it isn't posted or is less than 30 days, look elsewhere. Also check into your current domain name (if you have a domain name already) registrar's policy with regards to redemption periods; again, if one is not present or if it's less than 30 days, look for another registrar.

  Another few words of advice about this subject is to never do business with a registrar that does not post a clearly visible link to their Terms of Service. This link should be available to you via the website's main content sections or on the order page and available to you prior to submitting payment details. Anything less than the latter is unacceptable and you should take your business elsewhere.

• Never respond to Phishing Emails or Click on any Links within them

  Have you ever received an email asking you to provide your bank account information, your PayPal information or your domain name information or to click on a link to update your personal data. These are aptly named "phishing emails" (yes, a play on fishing, as in hook, line and sinker)and usually look very official and can trick the unwary into getting scammed. For more on phishing scams visit The Phish Tank itself.

  As a general rule never click on any links within suspicious emails you receive or open attachments. The only thing you'll find on the other end is enormous problems you're best to avoid. I highly recommend that you visit The Phish Tank's FAQ where you will find a volume of information about phishing.

• Never accept Free Domain Name offers from Internet Service Providers

  Many Internet Service Providers - hosting providers, online services providers and the like - often offer a free top level domain name as a marketing ploy to entice site visitors to sign up for their services. These could be legitimate offers but when you see "free" be sure to read the fine print before you lay your credit card on the table.

  For example, if you sign up for a hosting account and the site simply asks you to insert your choosen domain name in a field within the online form, watch out because you may be handing over control of your domain name. The hosting provider can simply register the domain in their own name, pay for it and then allow you to use it. The catch? - since they basically gave it to you for free they'll post a proviso in their Terms of Service that clearly states they own the domain. They may also list circumstances of how you can get it back and/or why you can't.

  Some may do the right thing by letting you register the domain and then crediting your account in some manner or another. A smarter way to add value to a service, but frankly to save $10-15, I would rather just leave it alone and not complicate my domain registration in any way at all. There are better ways to enhance services and more prolific services to enhance.

I sincerely hope that this article has helped you and I hope that you will take action to not only protect your domain names, but to protect your identity, your bank account and the information stored on your computer.

I am not one to live in a glass house and throw rocks. I've been on the Internet since Compuserve was one of only a few providers and access time cost $4 US an hour. I've also been hit square between the eyes with many of the issues I write about above. This is serious stuff, and while my friends and family know me as the old light-hearted joker, this article is not a joke in any way whatsoever.

Please don't wait until security issues cause you immense and often irreparable pain. Identities are stolen every day by dishonest Internet hackers; computers are compromised every day by the same criminals; phishing scams catch thousands upon thousands of unaware Internet users every month.

Far too many Internet users wait until it's too late; they only deal with security after they have been compromised. Please don't let it be you. Protect yourself as best you can - security is not a perfect science but if you make it difficult on the scammers and bad guys out there, chances are they'll leave you alone and move on to an easier target.