Why 2FA Is Mandatory
Passwords alone fail: 81% of breaches involve stolen or brute-forced credentials. A single domain account can control millions in digital assets—2FA is the cheapest insurance you’ll ever buy.
Types of 2FA Ranked
- Hardware key (FIDO2/U2F): phishing-proof, best choice
- TOTP app (Authy, Google): time-based, offline, good
- SMS/voice: vulnerable to SIM swap, accept only if nothing else
- Email magic link: single-factor in disguise, avoid
Setting Up TOTP
In registrar security settings, scan QR code with Authy. Write down the 16-char backup code and store in password manager. Test login on a second browser to confirm prompt appears.
Hardware Key Walkthrough
Buy two YubiKey 5C NFC keys. Register primary at Cloudflare, Namecheap, Google Workspace. Store backup key in bank safe. Both keys can be registered simultaneously—no “primary/secondary” limit.
Account Recovery Planning
Add hardware key to more than one admin account. Print backup codes, seal in envelope, give to legal counsel. If all keys are lost, registrar will accept notarized affidavit + photo ID + domain invoice.
API Key Compartmentalization
Some registrars allow IP-restricted API tokens that bypass 2FA. Whitelist only office IP, rotate monthly, and store in vault (1Password CLI). Never embed in GitHub.
Enforcing 2FA Across Team
Use Google Workspace security dashboard to mandate 2FA for all users with access to registrar email. Set session timeout to 12 hours; require re-auth for WHOIS changes.
Mobile Authenticator Security
Enable screen lock + biometrics on phone. Disable cloud backup of TOTP secrets in Authy to prevent multi-device hijack. Encrypt phone storage to protect keys if device is stolen.
Lost Phone Scenario
Buy new phone, install Authy on same phone number, restore encrypted backup with password. If no backup, use printed recovery codes to regain access, then re-enroll new device.
Audit Trail
Download 2FA logs monthly. Sudden removal of hardware key followed by password change is red flag indicating account compromise—freeze registrar immediately.