DNS Security for Business Websites

Know who controls the registrar account

The registrar account is the root of the whole chain: it controls the domain registration, contact details and which nameservers are authoritative. Confirm the account is in the business's name, uses a business email address that outlives individual staff, and has multi-factor authentication enabled.

Check the expiry date and enable auto-renewal. A lapsed domain is a self-inflicted outage that can also let someone else register the name, and recovering from that is far harder than paying a renewal fee.

Review your nameserver delegation

Your domain delegates to a set of nameservers, and whoever runs those nameservers effectively controls your records. Confirm the delegation points to the DNS provider you intend to use and that no old provider is still listed from a previous migration.

Where the registrar supports it, enable registrar lock so the delegation cannot be transferred without an explicit unlock step.

Keep DNS records clean and intentional

Go through the zone record by record. Every A, AAAA, CNAME, MX and TXT entry should have a known purpose and a known owner. Records left behind from an old host, a trial service or a decommissioned application are a common source of unexpected exposure.

Pay particular attention to records pointing at third-party platforms. If the service was cancelled but the record still resolves, someone else can sometimes claim that endpoint and serve content under your name.

• Remove records for services the business no longer uses.
• Document which supplier or system each remaining record supports.
• Restrict who can edit the zone, and use individual accounts rather than a shared login.
• Keep a current export of the zone so it can be rebuilt quickly.

Watch for stale and forgotten subdomains

A subdomain such as a staging site, an old campaign page or a legacy admin panel is still part of your public attack surface. Test environments in particular tend to run older software with weaker access control than production.

Inventory your subdomains, retire what is finished, and put anything that must remain behind authentication or network restrictions.

Consider DNSSEC and understand what it does

DNSSEC adds cryptographic signatures to DNS answers so a resolver can detect tampered responses. It addresses forged answers in transit; it does not encrypt DNS queries and does not protect you if your registrar or DNS account is compromised.

Enabling it is worthwhile where your registrar and DNS provider both support it cleanly, but treat it as one control among several rather than a fix for weak account security.

Use DNS to protect your email identity

SPF, DKIM and DMARC all live in DNS, and together they let receiving servers tell genuine mail from forgeries that use your domain. For a small business this is often the single highest-value DNS change available, because invoice and payment fraud usually starts with a convincing email.

Publish an SPF record that reflects every legitimate sender, sign outbound mail with DKIM, then move DMARC from monitoring toward a policy that actually rejects failures.

What external checks can and cannot tell you

Because DNS is public, an outside scan can review your records, nameserver delegation and email authentication as any third party would. ScoutLab's Free Scan, Deep Scan and Monitoring report on those externally visible signals.

They do not log in to your registrar or DNS provider, do not perform malware or blacklist detection, are not a manual penetration test, do not provide compliance certification, and cannot guarantee your domain is secure. Account security and internal process remain your responsibility.