Comment by samwillis
5 years ago
Outside the best practices others are mentioning there are companies that specialise or provide high security domain registration, Mark Monitor are the big one. CloudFlare also offer this type of service. I have no idea how much it costs, would actually love to know if anyone has any experience with any of them?
https://www.cloudflare.com/products/registrar/custom-domain-...
This. You can use 'whois' to find the registrars used by big sites.
The registrar for google.com? microsoft.com? netflix.com? ubuntu.com? reddit.com? amazon.com? They all use Markmonitor.
Of course, markmonitor aren't perfect: https://news.ycombinator.com/item?id=28351432
Other options include 'CSC corporate domains', the registrar for apple.com and twitter.com - and some companies, like facebook and cloudflare, are their own registrars.
One problem startups will run into with MarkMonitor and CSC is that they have a substantial minimum initial purchase. If you've got a domain portfolio, then that works out OK because you're just buying additional years on the domains you've already decided to keep, but it makes it impractical to use them for registry-locking one or two domains.
I believe Cloudflare's initial purchase requirement is much lower.
At my last job, I worked with MarkMonitor to get registry lock on our domains after an incident at Network Solutions [1]. It was expensive, but the price didn't matter because they had an annual spending requirement that was more than our annual renewals, since we didn't have many domains. Ownership has changed since then, and I don't have the slightest idea about current pricing. I think they charged us $1000/year for registry locks, on top of the $100/year for a .com/.net. If you had more domains, they might have had a bulk discount; but from our perspective, it was pay $$$$/year for registry locks on our two important domains and get the rest of our registrations free.
Never had any hijacks after that. We did have to postpone a DNS service change because the CEO didn't answer the verification call and the registry wouldn't try again on the same day. No big deal, we set up the lock for a reason and fail-closed is desirable.
[1] I know, but the CEO thought they must still be good, because they were in charge in the 90s. I'll check closer on these things in the future, I guess.