DNS translates domain names into the addresses systems actually connect to, which makes it a high-value target: control DNS, and you can redirect traffic, intercept email, or issue fraudulent certificates for a domain, all without touching the actual servers behind it. It’s also one of the least monitored parts of most small business infrastructure.
Domain and registrar hijacking
If an attacker gains access to your domain registrar account, often through a weak or reused password, since it’s an account that gets logged into rarely, they can redirect your entire domain, including email, without needing to breach anything else. Registrar accounts deserve MFA and a strong, unique password specifically because they’re checked infrequently and therefore often under-protected.
DNS record changes as an early warning sign
An unauthorized MX record change can silently redirect incoming email to an attacker for as long as it goes unnoticed. Monitoring DNS records for unexpected changes is a simple, high-value control that many businesses simply don’t have in place, because it requires someone to be actively watching a system that usually never changes.
What we set up for clients
Registry locks where the registrar supports them, MFA on registrar and DNS provider accounts, DNSSEC where the domain and registrar support it, and automated alerting on DNS record changes so an unauthorized change is caught in minutes, not discovered weeks later when email stops arriving.