Domain guardian

Note

This feature is part of the Pro plan. See plans.

A domain is rarely lost to an attack. It is lost because a renewal did not happen, a transfer lock stood open, or an auth code was issued and nobody noticed. Those four things are exactly what the domain guardian watches.

It comes in two parts: an overview across all domains and a protection tab per domain, where the rules are set.

The overview

Security → Domain guardian, direct address: dash.regfish.com/my/guardian

At the top are the counters: how many domains are watched, how many count as endangered, and how many have an open auth code. The drift watch checks daily whether the lock, the renewal or the auth code has changed; changes also arrive by mail.

Below that, endangered domains lists the cases with expiry date, state of the auto renewal and auth code status. The guardian events underneath are the log: what happened when, for example that an auth code was issued.

The protection tab of a domain

Domains → your domain → Protection, direct address: dash.regfish.com/my/domains/<tld>/<sld>/guard

The three status cards show the current state:

• Expires with the date, the days remaining and whether auto renewal is on.
• Transfer lock. While it reads open, transfers are possible.
• AuthInfo. An issued auth code has a validity and is shown here with its deadline. As long as it is valid, the domain can be moved away with it.

Also here: certificate watch for exactly this domain, meaning the monitoring of the certificate transparency logs. It is covered in full under certificate watch.

Protection rules

Protection rules tie critical actions to a fresh confirmation with the second factor. Four points matter:

1. The approval lasts 5 minutes. After that the dash asks again.
2. API and DynDNS access is blocked for protected actions, not merely delayed. A script meant to run a protected action therefore fails until you exempt it explicitly below.
3. It does not work without account 2FA. The 2FA confirmation is the protection mechanism, so it has to be active for the account first. Until then the page shows the notice and a link to enable it instead of the rules.
4. The starting state is default (everything off). Protection only exists once you select actions.

If you use the API in automation, plan for this: protection rules and API keys work against each other unless the action in question is exempted. That is deliberate, because a stolen key should not be able to move a domain.

The guardian log

Below the rules sits the log for this domain. Besides the action it names the source, so whether it came from the dash or through the API, and for an API access the key that was used. After an unexpected event this is the first place to look: it answers whether a change came from your own script.