Chapter 6

Email and domain hygiene

6.1 Learning objectives

Protect domains from unauthorized transfer with a registrar lock.
Understand what DNSSEC is, when to enable it and how to check it.
Configure basic email records: MX, SPF, DKIM, DMARC.
Clean up "dangling" DNS records and manage renewals systematically.

6.2 Concepts

Domain transfer lock

A transfer lock (e.g. the clientTransferProhibited status) prevents the domain being transferred to another registrar until unlocked. For many international domains the registrar enables it by default; for country-code domains it may be a separate service you must request. Always check, never assume.

Nameservers and DNS

The registrar is where you rent the domain. The DNS provider answers "where does this domain point". The two roles can be at two different companies.
The NS records at the registrar must point to the correct nameservers of the DNS provider.

DNSSEC

DNSSEC digitally signs DNS answers to prevent spoofing. Enabling it usually takes two steps: (1) enable signing at the DNS provider, (2) submit the DS record to the registrar. When changing DNS providers you must remove the old DS first, or the domain may "disappear" from the Internet.

Email records

Record	Purpose
MX	Points to the mail servers receiving mail for the domain
SPF	Lists the servers allowed to send mail on behalf of the domain
DKIM	Digital signature on outgoing mail
DMARC	Policy for mail that fails SPF/DKIM; receives spoofing reports

Domains that do not send mail should also have an SPF "nobody may send" record and a reject DMARC policy, so scammers cannot impersonate them.

Dangling records

Records pointing to a service you have cancelled (old hosting, old web platform). Attackers can re-register that resource and take over your subdomain.

6.3 Worked example

Mr. A has domains at two registrars but consolidates DNS at one provider. He builds a tracking table:

Domain	Registrar	NS correct	DNSSEC	Transfer lock	MX/SPF/DKIM/DMARC	Dangling records
example.vn	Registrar X	Yes	Enabled, DS submitted	Requested	All 4	None
example.com	Registrar Y	Yes	Enabled	On	All 4	1 record pointing to old web platform: delete
example-shop.net	Registrar Y	Yes	Not yet	On	No mail: SPF -all, DMARC reject	None

6.4 Common mistakes

Logging in to the registrar with an email on a domain that same registrar manages.
Enabling DNSSEC, then switching DNS providers and forgetting to remove the DS.
Leaving DMARC at "none" forever without reading the reports.
Not knowing whether the registrar and DNS accounts have 2FA.

6.5 Checklist

Every domain is in the tracking table: registrar, NS, DNSSEC, transfer lock, expiry.
Registrar and DNS accounts have strong 2FA, and their login emails are outside those domains.
The transfer lock is on and the whois status has been checked.
DNSSEC is enabled and has been checked with a DNSSEC testing tool.
Domains with email have MX, SPF, DKIM, DMARC; domains that send no mail have blocking SPF/DMARC.
No dangling records remain.

6.6 Exercises

Look up the whois status of a sample domain and find the transfer-lock status line.
Write the SPF/DMARC records for a domain not used for sending mail.
List all CNAME records in your DNS zone and mark which services are still in use.

6.7 Summary

The ROOT domain needs a transfer lock, DNSSEC, auto-renew and a registrar account with an independent way in.
Registrar and DNS are two different roles; manage both.
Cleaning up dangling records is a recurring task.

I have finished this section