Keeping your domain name secure
Source: gov.uk (2025-11-14)

A domain name is an important asset and is not protected by default. Follow these recommendations to keep your domain secure.

Use this guidance if you’re the nominated Technical Point of Contact who is responsible for the secure management of a .gov.uk domain name. The Technical Point of Contact must be someone from the registrant’s or registrar’s organisation.

If you’ve been issued a .gov.uk domain but are not technical, follow the guidance on how to get started with your .gov.uk domain (https://www.gov.uk/guidance/use-your-govuk-domain-name).

Contact xxx@xxx.xx if you have any questions about the security of .gov.uk domains.

If attackers take partial or full control of a .gov.uk domain name they can:
- intercept emails
- send emails impersonating public sector organisations
- send your website visitors to inappropriate or illegal sites
- trick users into giving over their personal details like credit card information
- use your domain to access other digital services to cause critical national disruption
If the Domains Team contacts you to fix issues with a .gov.uk domain, you must fix this to help keep the public sector secure. The time frames to fix issues will depend on the severity of the problem.

1. Make sure your domains are registry locked

Most organisations have a change control process to prevent unauthorised changes being made to domains. Despite this, changes can still be made by:
- current or former staff in an organisation with the right credentials
- anything that compromises your registrar’s service
To reduce this risk, it is recommended that you lock your:
- domain objects
- host objects if you are using name servers that have host names you control (for example, ns1.example.gov.uk when you control example.gov.uk)
- contact objects
Use the Registry Lock service

Registrars can use the free Registry Lock service in the .gov.uk registry operated by Nominet. The service is not compulsory, but organisations should use it to help secure your domains.

The Registry Lock service can:

prevent unauthorised changes being made to .gov.uk domain records, name servers and contact details in the .gov.uk registry

notify any relevant teams when changes to these records are made

The service does not not prevent changes to individual Domain Name Service (DNS) records like A, MX and TXT records held with your DNS provider.

How the Registry Lock service works

Registry Lock applies separately to domains, hosts and contacts. Each object can have different lock statuses that prevent changes.

This table shows what each Registry Lock status prevents, depending on whether it’s applied to a domain, host or contact object.

The service will check any changes to the .gov.uk zone file for your domain as well as your contact details held at the registry. The zone file usually contains your name server records but can occasionally include other records as well. It will not prevent changes to individual DNS records like A, MX and TXT held with your DNS provider.

Registry Lock will not affect your day-to-day DNS management and only works for .gov.uk domains. For other domains you should check with your registrar.

How registrars can activate and use the Registry Lock service

Ask your Registrants to provide you Registry Lock contacts who are authorised to approve changes and upload these contacts into the Nominet portal.

Set up the required lock statuses in the Nominet portal.

Put a process in place with Registrants to get authorisation and permission to temporarily or permanently remove Registry Lock.

Get permission from the relevant Registry Lock contacts each time a major change is made to the domain.

2. Set up any services on the domain securely

If you set up all emails and websites on .gov.uk domains you must follow guidance on how to:

set up government email securely (https://www.gov.uk/guidance/set-up-government-email-services-securely)

make sure websites on the domain are accessible (https://www.gov.uk/service-manual/helping-people-to-use-your-service/making-your-service-accessible-an-introduction)

When setting up digital services, additional laws and standard you must follow include the:

Data Protection Act (https://www.gov.uk/data-protection)

Equality Act (https://www.gov.uk/guidance/equality-act-2010-guidance)

Cyber Security Standard (https://www.security.gov.uk/policy-and-guidance/the-cyber-security-standard/) (if you’re a central government department)

3. Sign up the domain up to Active Cyber Defence tools

The National Cyber Security Centre (NCSC) offers a number of free Active Cyber Defence (ACD) tools to public sector organisations.

Sign up your domain to the:

Mail Check service to help you to adopt secure email standards

Web Check service to help you find and fix common vulnerabilities

Register your domain for the free Active Cyber Defence tools (https://www.ncsc.gov.uk/section/active-cyber-defence/introduction).

4. Renew domains on time

All .gov.uk Approved Registrars are required to contact registrants approximately 30 days and 7 days before expiry.

A registrar must not renew a domain without the explicit consent of a Registrant.

More information on renewals is available in the gov.uk Registry-Registrar Lifecycle Policy (https://registrars.nominet.uk/registry/dot-gov-uk/policies/#lifecycle).

5. Check name servers are configured properly and working

Make sure all of your .gov.uk domain’s name servers are:
- using a valid domain name
- active and responding
Always check name servers to make sure there are no spelling mistakes or typos in the record. Remove any inactive name servers as soon as possible.

Inactive or unresponsive name servers might cause traffic to services on your domain, including email and web, to work intermittently or stop working. If the inactive server is on an unregistered domain, your domain is also at a higher risk of hijacking.

6. Check name servers critical to your domain are locked

If any of the name servers on your domain depend on a second level domain, make sure they are locked at the registry level if this service is available to you. Critical name servers are at higher risk of being compromised if they are not locked.

Example: The registrant is responsible for the domain name ‘example.gov.uk’.

This domain name uses the name server ‘ns1.example.net’ provided by their supplier.

The supplier must make sure ‘example.net’ is server locked at the registry level.

You should consider changing your registrar or supplier if you experience any ongoing issues with them. Follow our guidance on how to choose a good registrar (https://www.gov.uk/guidance/choose-a-good-registrar-or-dns-provider?step-by-step-nav=5a9309a3-9a80-4faa-b24f-1797023e897f).

7. Check name server records are resilient

Make sure every .gov.uk domain is set up with:

at least 2 name servers

all name servers resolving to a different IP address

Name servers should be spread across multiple physical locations for resilience and there should be restricted privileges for different administrators, for example limiting them to certain domains. Where possible you should make sure your domain also has a different class C subnet (https://support.microsoft.com/en-gb/help/xx-xxxx-xxxx/understanding-tcp-ip-addressing-and-subnetting-basics) for these name servers.

This will help you to make sure traffic to services on your domain, including email and web services, continue to work if a single name server, IP address or subnet goes down.

You should have multiple name servers registered against your domain by following IANA recommendations (https://www.iana.org/help/nameserver-requirements).

8. Check delegation and authoritative name server records match

If your domain name server records at your registrar do not match the name server records at the registry level there is a high risk of domain compromise or hijack.

To check your delegation and authoritative records match you should:

Use a tool like the dig command to carry out a manual check to make sure all delegation and authoritative records match.

Make sure there are no spelling mistakes in your name server records.

Update name server records to match the registry level records if there is an incorrect record.

9. Check your name servers responses are consistent

Your name servers may be behaving inconsistently, for example by returning different name servers or TXT records.

If your domain name server records are inconsistent, there is an increased risk of your domain being hijacked. Traffic to services on your domain, including email and web also could:

send traffic to the wrong place

work intermittently

stop working altogether

To make sure all your name server records are consistent you should check that all name servers:

respond with the same records and there are no spelling or numerical mistakes

serve the same name server (NS) record for the designated domain

serve the same Start of Authority (SoA) record for the designated domain

10. Backup domain data

Suppliers should ideally have an export functionality so backups of .gov.uk DNS zones can be made. information so that you can restore lost records or recreate the zone elsewhere if required.You should take regular backups or copies of your zone.

11. Secure expired or unused .gov.uk domains

Make sure you secure expired or unused .gov.uk domain names properly by following the stop using your domain guidance.

12. Check the zone transfer (AXFR) status is closed

An open zone transfer (AXFR) status allows anyone on the internet to download all domain name server records.

Make sure the zone transfer (AXFR) status is closed on all of your name servers. This will protect your domain records from being downloaded and used to identify and exploit vulnerabilities.

To check your AXFR status you should:

Use an online tool to check your AXFR status on all of your name servers.

Turn off the AXFR status if it is open.

13. Check glue records are correct

A glue record contains the IP address of a name server. You would use glue records if you’re using in-zone name servers for your domain. For example if your domain is test.gov.uk and your nameservers are ns1.test.gov.uk and ns2.test.gov.uk.

If you change the IP address of your name server you need to update the glue records at the registry with the new IPs.

If your records do not match, traffic to services on your domain, including email and web, might work intermittently or stop working entirely.

You should contact your registrar or DNS supplier and ask them to make sure your glue records are consistent.

14. Remove glue records when you delete domains

Make sure you do not leave any glue records at the registry when you delete a domain as this deleted domain could be hijacked. Records which are not removed when a domain is deleted are known as ‘orphan glue records’.

You should contact your registrar or DNS supplier and ask them to remove glue records when domains are deleted from the zone.

15. Check CNAMEs

You can use a Canonical Name (CNAME) record to point a domain to another domain. For example, you might want to point ‘domain.gov.uk’ to ‘www.domain.gov.uk’ or to a domain hosted by your cloud service provider.

Make sure CNAME records are updated or deleted when you no longer need them to avoid your domain being hijacked.

16. Consider using Certification Authority Authorisation records

Check whether DNS Certification Authority Authorisation (CAA) records (https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization) are appropriate for you to use with your domain names.

A CAA record limits the number of suppliers that can issue certificates for a domain to a predefined list.

17. Monitor how SSL certificates are issued

Monitor how SSL certificates are issued to check no one has managed to gain access to issue certificates on your domains or subdomains.