The 60-Second Audit
Run through this list quarterly; every unchecked box is a potential $50k mistake.
Account Access
- Unique 20-char password per registrar ✓
- TOTP or hardware key 2FA enabled ✓
- IP whitelist for API and admin logins ✓
- No shared logins; each admin own account ✓
Domain-Level Security
- Registrar lock (clientTransferProhibited) ✓
- Registry lock for names >$10k ✓
- DNSSEC enabled and signatures valid ✓
- Domain auto-renew + 10-year max prepay ✓
Monitoring & Alerts
- WHOIS change alerts to security@ ✓
- DNS drift monitoring (A/MX) ✓
- SSL expiry 30-day warning ✓
- Blacklist & malware scan weekly ✓
Email & DNS Hygiene
- SPF, DKIM, DMARC at p=reject ✓
- Separate email domain for registrar contact ✓
- TXT record for CAA limiting CAs ✓
Legal & Business
- Domains held in separate asset-holding LLC ✓
- Registry-lock removal requires two-signature ✓
- Domain insurance rider active ✓
- Up-to-date trademark registrations ✓
Incident Response Ready
- Written runbook for hijack recovery ✓
- 24/7 phone numbers for registrar and registry ✓
- Backup credentials stored offline ✓
- Legal counsel familiar with UDRP ✓
Continuous Improvement
Schedule calendar reminder every 90 days. Tick boxes, export PDF, store in encrypted vault. Security is not a state, it’s a process—automate what you can, audit what you can’t.