Ask HN: How do I secure the domain for my business?

Apart from what's been said already: One basket per egg.

Your registrar should be under different administration from your DNS servers (more than one), which should be different from your service (e-mail/web/etc) host(s). If you want to play it real safe you could get matching names under different TLDs, but only after you've separated the above.

This way, either of your nameserver companies closing you off should pose little practical problem, while limiting the relationship with your registrar to nothing more will significantly lower the possibilities of issues occurring there.

Put the account e-mails for the above providers under a different domain than the one under management.

So assuming you don't run your own physical infrastructure (all the power to you if you do) for either part, you need at least 4 different accounts spread over at least 3 different companies.

Putting one of the name servers at either the registrar or the web-hosting provider is not that terrible though, as long as it's not the only one.

Some registries have a feature called “Registry lock”. This means that a domain cannot be transferred to another registrar without a lot of work to unlock it first.

Like I have said previously¹² about choosing a registrar: If you have regular backups, and if some downtime is not really a problem, it might be fine to use web server hosting, e-mail (and in extreme cases even DNS hosting), from some fly-by-night el cheapo provider. But your domain name registrar? Pick them carefully, don’t skimp, and make sure they have good support. Because when things go pear-shaped, you really want to be able to actually talk to someone to change your web server or e-mail DNS records (or even DNS servers) to somewhere else.

Big registrars can’t afford any support costs since they prefer to squeeze the price down as far as possible, and therefore they prefer to simply lose or outright drop any customer in case of any and all problems. Conversely, small registrars may charge more, but have better (i.e. actually existing, and sometimes even dedicated and personal) support for when things go wrong, and have a vested interest in keeping you as a customer.

A small registrar might also be so small as to know you personally, which will help monumentally against any social engineering attacks.

Full disclosure: I work at such a registrar, but I see that you’re not in our target market.

1. https://news.ycombinator.com/item?id=29112559

2. https://news.ycombinator.com/item?id=26865752

Hostgator left me in a terrible situation once. Domain name came with hosting package and expired after 10 years. Hostgator had lost my records?! I went to Nominet and they were really helpful. I think I recollect that if you login to Nominet with your admin email address from your domain name you see your domains in the Nominet control panel. I guess Nominet are the big player in this scenario. Not sure if Nominet is UK.

All my clients lost access to my saas for the guts of a day until I could get Nominet to fix.

The main question if you want to defend from technical issues or from legal, so measures extremely different.

For tech, just choose some big registar with good reputation, and use all measures, registar recommends, like 2FA, chrypto-keys, etc. For example my friend register his domain on GoDaddy.

For legal issues, it depends on your jurisdiction. For example, in Ukraine we could bye 2nd level domain .ua, if have registered trademark, and process of registration lasts for 2 years.

Mean, you send request to government registration service, that you want to register some name, than they make checks, to ensure nobody use this name, and that not exists some names which very similar (so you will not look associated with Mercedes or some other well known brand), and if all ok, you will receive official registration rights, and after that you could ask to registar .ua name, and it will be associated with your legal entity (I'm not sure, most probably possible register as private person just to your name).

And after that procedure, nobody could steal your domain without stealing your entity. Even if you will once forgot to pay for domain, it will just remain blocked, and nobody else could use it, until end official registration of trademark.

For other domains, like .com or local, things are slightly different, but all very similar, in that if you have registered trademark (same as domain name without suffix), you have legal power to defense. And nearly all hostings respect this power, so in most cases you will not need to call judge, just send to hosting support photo of documents of registered trademark, and hosting will immediately remove site of person, who try to use your registered trademark name.