Domain name security best practices - Domain Names - Alibaba Cloud Documentation Center

Domain hijacking, unauthorized transfers, and DNS tampering can cause service outages, data leaks, brand damage, and financial loss. Alibaba Cloud provides a multi-layer defense system that protects your domain names at the account, registrar, and DNS layers, with flexible configurations ranging from basic protection to enterprise-grade security.

The following overview helps you choose the right protections for your business needs. For detailed configuration instructions, see the documentation for each feature.

Key security features

Protection layer	Security feature	Description	Cost
Account	MFA	Prevents unauthorized account access by requiring a second factor of authentication in addition to a username and password.	Free
Registrar	Transfer lock	Prevents unauthorized transfers of the domain name to another registrar.	Free
Registrar	Update lock	Prevents unauthorized changes to critical domain name settings, such as contact information and name servers.	Free
DNS	DNSSEC	Protects against DNS hijacking and cache poisoning by cryptographically signing your DNS records, ensuring users are directed to the authentic server for your domain name.	Paid

Recommended protection matrix

Choose a protection level based on your business scenario.

User type	Use case	Recommended protection matrix
Individual developer or blogger (Manages a personal domain name for a blog, portfolio, or test project)	- The domain name is used primarily for display or learning purposes. - You do not log on to the console frequently. - You are concerned about losing the domain name because of a forgotten renewal or account theft. - You may use a weak password or a shared email address for logon.	MFA + Transfer lock
Small and medium-sized enterprise (SME) operator (Manages online portals like the company website, apps, mini-programs, or e-commerce platforms)	- The website is online and serves external users. - The DNS configuration is stable and is not changed frequently. - You are aware of other websites being hijacked and redirected to ad pages, and are concerned about similar risks. - The account is managed by multiple people, which raises concerns about accidental operations or inadequate permission control.	MFA + Transfer lock + Update lock
Enterprise IT/operations lead (Manages the primary brand domain name, core business systems, or high-traffic platforms)	- The primary domain name hosts logon systems, payment pages, or member services. - A service breakdown would significantly impact users and revenue. - The domain name is a target for attacks or is subject to high-level protection requirements from industry regulations. - You require the highest level of security, where the domain name cannot be operated on even if the account is compromised.	MFA + Transfer lock + Update lock + DNSSEC

Overview of protection features

Multi-factor authentication (MFA)

MFA adds a second layer of protection to your account beyond your username and password.

After you enable MFA, you must complete the following two steps to log on to Alibaba Cloud:

First factor: Enter your username and password.
Second factor: Provide a temporary, one-time code from an MFA device, such as a 6-digit code generated by a virtual MFA application.

Even if an unauthorized party obtains your password, they cannot access your account without your MFA device. For more information, see Configure MFA for your account.

Transfer lock

Transfer lock sets the domain name's status to clientTransferProhibited at the registrar level, preventing unauthorized transfers of your domain name away from Alibaba Cloud.

Note

To transfer a domain name, you must first disable this lock to obtain an authorization code.

For more information, see Lock a domain name to prevent unauthorized transfer.

Update lock

Update lock prevents unauthorized changes to critical domain name information, including contact details and name servers. This feature is supported for domain names with TLDs such as .com, .net, .org, .info, .biz, .mobi, .asia, .me, .so, .cc, .tv, .name, and .cn.

For more information, see Update lock.

DNSSEC

Domain Name System Security Extensions (DNSSEC) prevents DNS hijacking and cache poisoning by adding cryptographic verification to your DNS records, ensuring that users who access your domain name are connected to the authentic server. For more information, see Configure DNSSEC.