Use this guidance if you’re the nominated Technical Point of Contact who is responsible for the secure management of a .gov.uk domain name. The Technical Point of Contact must be someone from the Registrant’sregistrant’s or Registrar’sregistrar’s organisation.

If you’ve been issued a .gov.uk domain but are not technical, follow the guidance on how to get started with your .gov.uk domain.

If attackers take partial or full control of a .gov.uk domain name they can:

• intercept emails
• send emailemails impersonating public sector organisations
• send your website visitors to inappropriate or illegal sites
• trick users into giving over their personal details like credit card information
• use your domain to access other digital services to cause critical national disruption

1. Make sure your domains are registry locked

Most organisations have a change control process to prevent unauthorised changes being made to domains. Despite this, changes can still be made by:

• current or former staff in an organisation with the right credentials

• anything that compromises your registrar’s service 

To reduce this risk, it is recommended that you lock your:

• domain objects
• host objects if you are using name servers that have host names you control (for example, ns1.example.gov.uk when you control example.gov.uk)
• contact objects

Use the Registry Lock service

Registrars can use the free Registry Lock service in the .gov.uk registry operated by Nominet. The service is not compulsory, but organisations should use it to help secure your domains.

The Registry Lock service:service can:

• preventsprevent unauthorised changes being made to .gov.uk domain recordsrecords, name servers and contact details in the .gov.uk registry

• notifiesnotify any relevant teams when changes to these records are made

The service does not not prevent changes to individual Domain Name Service (DNS) records like A, MX and TXT records held with your DNS provider.

How the Registry Lock service works

Registry Lock applies separately to domains, hosts and contacts. Each object can have different lock statuses that prevent changes.

This table shows what each Registry Lock status prevents, depending on whether it’s applied to a domain, host or contact object.

Object	Lock status	What it prevents
Domain	Server Delete Prohibited	Prevents the domain from being deleted.
	Server Update Prohibited	Prevents changes to nameservers, delegation signer records or linked contacts.
	Server Transfer Prohibited	Prevents the domain from being transferred to another registrar.
Host	Server Delete Prohibited	Prevents deletion of a nameserver record that is not in use by a domain.
	Server Update Prohibited	Prevents renaming of a nameserver or changes to glue records.
	Server Transfer Prohibited	Not applicable.
Contact	Server Delete Prohibited	Prevents deletion of a contact record that is not in use by a domain.
	Server Update Prohibited	Prevents changes to contact information.
	Server Transfer Prohibited	Prevents the contact from being moved to another registrar.

The service will check any changes to the .gov.uk zone file for your domain as well as your contact details held at the registry. The zone file usually contains your name server records but can occasionally include other records as well. It will not prevent changes to individual DNS records like A, MX and TXT held with your DNS provider.

Registry Lock will not affect your day-to-day DomainDNS Name Service (DNS) management and only works for .gov.uk domains. For other domains you should check with your registrar.

How registrars can activate and use the Registry Lock service

1. Ask your Registrants to provide you Registry Lock contacts who are authorised to approve changes and upload these contacts into the Nominet portal.

2. Set up the required lock statuses in the Nominet portal.

3. Put a process in place with Registrants to get authorisation and permission to temporarily or permanently remove Registry Lock.

4. Get permission from the relevant Registry Lock contacts each time a major change is made to the domain.

2. Set up any services on the domain securely

If you set up all emails and websites on .gov.uk domains you must follow guidance on how to:

• set up government email securely

• make sure websites on the domain are accessible

When setting up digital services, additional laws and standard you must follow include:include the:

• Data Protection Act 

• Equality Act

• Minimum Cyber Security Standard (if you’re a central government department)

3. Sign up the domain up to Active Cyber Defence tools 

The National Cyber Security Centre (NCSC) offers a number of free Active Cyber Defence (ACD) tools to public sector organisations.

Sign up your domain to the:

• Mail Check service to help you to adopt secure email standards

• Web Check service to help you find and fix common vulnerabilities

Register your domain for the free Active Cyber Defence tools.

4. Renew domains on time

All .gov.uk Approved Registrars are required to contactscontact Registrants registrants approximately 30 days and 7 days before expiry.

A Registrarregistrar must not renew a domain without the explicit consent of a Registrant.

More information on renewals is available in the gov.uk Registry-Registrar Lifecycle Policy.

5. Check name servers are configured properly and working

Make sure all of your .gov.uk domain’s name servers are: -

• using a valid domain name -
• active and responding

Inactive or unresponsive name servers might cause traffic to services on your domain, including email and web, to work intermittently or stop working. If the inactive server is on an unregistered domain, your domain is also at a higher risk of hijacking.

6. Check name servers critical to your domain are locked

If any of the name servers on your domain depend on a second level domain, make sure they are locked at the registry level if this service is available to you. Critical name servers are at higher risk of being compromised if they are not locked.

Example: The registrant is responsible for the domain name ‘example.gov.uk’.

This domain name uses the name server ‘ns1.example.net’ provided by their supplier.

The supplier must make sure ‘example.net’ is server locked at the registry level.

You should consider changing your registrar or supplier if you experience any ongoing issues with them. Follow our guidance on how to choose a good registrar.

7. Check name server records are resilient

Make sure every .gov.uk domain is set up with:

• at least 2 name servers

• all name servers resolving to a different IP address

Name servers should be spread across multiple physical locations for resilience and there should be restricted privileges for different administrators, for example limiting them to certain domains. Where possible you should make sure your domain also has a different class C subnet for these name servers.

This will help you to make sure traffic to services on your domain, including email and web services, continue to work if a single name server, IP address or subnet goes down.

You should have multiple name servers registered against your domain by following IANA recommendations.

8. Check delegation and authoritative name server records match

If your domain name server records at your registrar do not match the name server records at the registry level there is a high risk of domain compromise or hijack.hijack.

To check your delegation and authoritative records match you should:

1. Use a tool like the dig command to carry out a manual check to make sure all delegation and authoritative records match.

2. Make sure there are no spelling mistakes in your name server records.

3. Update name server records to match the registry level records if there is an incorrect record.

9. Check your name servers responses are consistent

Your name servers may be behaving inconsistently, for example by returning different name servers or TXT records.

If your domain name server records are inconsistent, there is an increased risk of your domain being hijacked. Traffic to services on your domain, including email and web also could: 

• send traffic to the wrong place

• work intermittently

• stop working altogether 

To make sure all your name server records are consistent you should check that all name servers:

• respond with the same records and there are no spelling or numerical mistakes

• serve the same name server (NS) record for the designated domain

• serve the same Start of Authority (SoA) record for the designated domain

10. Backup domain data

Suppliers should ideally have an export functionality so backups of .gov.uk DNS zones can be made. information so that you can restore lost records or recreate the zone elsewhere if required.You should take regular backups or copies of your zone.

11. Secure expired or unused .gov.uk domains 

Make sure you secure expired or unused .gov.uk domain names properly by following the  stop using your domain guidance. 

12. Check the zone transfer (AXFR) status is closed

An open zone transfer (AXFR) status allows anyone on the internet to download all domain name server records.

Make sure the zone transfer (AXFR) status is closed on all of your name servers. This will protect your domain records from being downloaded and used to identify and exploit vulnerabilities.

To check your AXFR status you should:

1. Use an online tool to check your AXFR status on all of your name servers.

2. Turn off the AXFR status if it is open.

13. Check glue records are correct

A glue record contains the IP address of a name server. You would use glue records if you’re using in-zone name servers for your domain. For example if your domain is test.gov.uk and your nameservers are ns1.test.gov.uk and ns2.test.gov.uk.

If you change the IP address of your name server you need to update the glue records at the registry with the new IPs.

If your records do not match, traffic to services on your domain, including email and web, might work intermittently or stop working entirely.

You should contact your registrar or DNS supplier and ask them to make sure your glue records are consistent.

14. Remove glue records when you delete domains

Make sure you do not leave any glue records at the registry when you delete a domain as this deleted domain could be hijacked. Records which are not removed when a domain is deleted are known as ‘orphan glue records’.

You should contact your registrar or DNS supplier and ask them to remove glue records when domains are deleted from the zone.

15. Check CNAMEs

You can use a Canonical Name (CNAME) record to point a domain to another domain. For example, you might want to point ‘domain.gov.uk’ to ‘www.domain.gov.uk’ or to a domain hosted by your cloud service provider.

Make sure CNAME records are updated or deleted when you no longer need them to avoid your domain being hijacked. 

16. Consider using Certification Authority Authorisation records

Check whether DNS Certification Authority Authorisation (CAA) records are appropriate for you to use with your domain names.

A CAA record limits the number of suppliers that can issue certificates for a domain to a predefined list.

17. Monitor how SSL certificates are issued

Monitor how SSL certificates are issued to check no one has managed to gain access to issue certificates on your domains or subdomains.