Whether you’ve managed to purchase your own name as a URL or you have a domain for
your small business or freelancing setup, it is absolutely critical to not only take
steps to protect your privacy but also build an added layer of security that most people
don’t even think about.
Welcome to All Things Secured, my name is Josh and I personally own over 30 different
domains, which for some of you might seem like a lot but the reality is that when you’re
running businesses online, that’s actually a small number of URLs.
I know a lot of people who are using custom domain names, which is something like your
business name .com or even your personal name .com and unfortunately they have no clue that
there are important security and privacy settings available to them for their domain.
So let’s change that.
Did you know that you can look up any domain and get the owner’s name, phone number,
address and when the domain will expire?
If you’ve never done it before on your own domain, it’s definitely worth trying.
Go ahead and pause this video, visit something like Godaddy.com/whois and check your domain
right now.
Ok, we good?
What did you find?
Hopefully all you saw was proxy information like what you see here for AllThingsSecured.com,
but if your real name, phone number and address showed up, or even that of your business,
you need to make some changes for the sake of your privacy and frankly the amount of
spam you’re probably having to deal with.
To do this, log into your domain registrar - that’s the company that hosts your domain,
not your website, although sometimes they’re one in the same.
I’m talking about companies like GoDaddy, Namecheap, Google Domains or others.
Within your domain dashboard you’re looking for something called Domain privacy, which
for the major registrars is included for free, so if you’re being asked to pay for it,
you might want to consider changing registrars.
Let’s say that you did want to change registrars or even sell your domain at some point.
If your domain is not locked, it’s surprisingly easy to make that transfer or even get caught
in a phishing scam and the last thing you want is somebody stealing your domain name
without your explicit consent.
That’s where domain lock comes in.
Again, you’ll find this in the settings of every registrar and hopefully you’ll
find that it’s on by default.
Basically what this means is that as long as a lock is turned on, the domain can’t
be transferred.
You would need to personally log in to your registrar account, turn off the domain lock
and then make the transfer request.
It’s an added step, but one that builds an important layer of security.
By the way, a little bonus tip here: GoDaddy and Namecheap two of the biggest domain registrars
both will try to up-sell you on added domain protections.
I’m sure others do as well and basically what they’re saying is that we’ll require
even more identity checks in order to make a change on the account.
Maybe that would give you some peace of mind, but honestly as long as you have your domain
is set to auto-renew, you keep an updated payment method on file, and you lock the domain,
those premium protections feel like an unnecessary expense.
It’s alarming to me how many businesses and people I see using custom domains for
email who haven’t set up basic protections on that domain.
I’ve already done a video explaining how this works, but the important thing you need
to know is that without these protections, anybody can send an email using your domain
and make it look like it’s coming from you.
I could pretend to be you or your business and make a request for payment or find a way
to scam your customers.
It’s really just a bad look, especially when the solution is so simple.
You need to set up what is known as DMARC records, and you can watch this video next
where I explain how to set that up manually.
But if you give it a try and find that it’s too complicated - and you wouldn’t be the
first to say that, so don’t be ashamed - I recommend a service I’ve used for a couple
years now called EasyDMARC.
They’ve graciously sponsored this video, so it may seem like I’m incentivized to
say what I’m about to say, but let me tell you, I’ve set up DMARC on my own before
and the deluge of DMARC reports that hit my inbox was unbelievable.
These reports are critical to understand when and how you move to a DMARC reject policy,
which is what you need to work toward, but if you can’t read the report, it’s of
no value to you.
EasyDMARC takes responsibility for all of these reports and presents me with an easy-to-understand
dashboard that alerted me when somebody in Russia was trying to use the All Things Secured
domain to send scam emails.
Yes, that really happened.
Visit EasyDMARC.com to test your own domain or to see how easy it is to protect it from
being spoofed for email scams by bad actors.
If you’ve been following me here on YouTube for any amount of time, you’re probably
sick of hearing me talk about 2 factor authentication.
I’m pretty sure it comes up at some point in almost every video I do now.
So I’ve decided to give you a break and no longer talk about 2FA anymore.
Psych!
Yea, that’s not happening.
2FA is just too dagum important for you to ignore, so I’m gonna keep beating that drum
until a better security option comes along.
In this case, setting up 2FA can be applied in a number of different places to protect
your domain.
It absolutely needs to be set up with your domain registrar, but if you’re using a
different DNS service like Cloudflare, you absolutely need to set it up there too.
And yes, you need 2FA for your domain email provider, whether you use Google Workspace
or a more private option like ProtonMail.
And when you set up 2FA, as best you can try to avoid using the SMS text option and instead
opt for the authenticator app or better yet, a physical 2FA key.
In both cases, this means that if somebody wants to try to steal your domain - which
you’ve already locked, right?
- then they would need to not only know your username and password, they would also need
to have access to your method of 2-factor authentication.
We’re adding layers of security here.
Nothing is foolproof, but it makes you less and less of an easy target.
Be sure to follow each of these steps and thanks again to EasyDMARC for sponsoring this
video.
Visit them at EasyDMARC.com and give yourself the peace of mind that your domain email protection
is being done right.
Oh, and watch one of these videos next.