Domain security
Your domain is a set of public instructions.
They say who may send email as you, who may move your registration, and who may issue certificates in your name. Most business owners have never read theirs. They were set up years ago by somebody else, or never set up at all.
Free. No sign-up. About ten seconds.
The four layers
They stack. A problem at the top makes everything under it irrelevant, which is also the order worth fixing them in.
01
The registration
The name itself, held at the registry. Whether it is locked against transfer, when it expires, and who the registrar is.
The only failure here that cannot be undone by editing a record. Lose the name and every record below it stops mattering.
02
DNS
The zone: where your website points, where mail is routed, and whether the answers can be cryptographically verified.
Whoever operates this can redirect your traffic and your mail. It is frequently a different company from your registrar, and from whoever built your website.
03
Email authentication
The records that decide who may send email as you, whether receivers can prove a message is genuine, and what they should do when it is not.
Without them, anyone can send mail that appears to come from your domain, and no receiver has grounds to reject it.
04
Certificates and transport
Which certificate authorities may issue for your name, and whether mail to you must travel encrypted.
Supplementary rather than urgent — worth closing once the three above are in order.
Why nothing gets fixed
When something is wrong with a domain, most people do not know who to ask — so they ask nobody, or they ask the wrong person and are told it is not their department. Three things decide who can actually help you, and every finding in the check names which one applies.
- Control
- Who holds your registration, and who operates your DNS. That decides what is even possible. It is often two different companies, and neither is necessarily the one who built your website.
- Knowledge
- Some records depend on knowing every system that sends email as you — your accounting software, your newsletter, your CRM, an AI assistant somebody connected last month. No provider can know that list. Only you can.
- Risk
- A few of these changes can stop your mail or take your domain offline if they are done carelessly. Somebody has to own the decision, and the plan for putting it back.
In depth
One page each for the three failures that actually cost people something.
- How a business loses its domain
Transfer locks, expiry, and the registrar account. The only failure here that cannot be undone by editing a record.
- Someone can send email as you
SPF, DKIM and DMARC — getting to enforcement without blocking your own invoices, and what enforcement will never stop.
- Can anyone prove your DNS answers are real?
What DNSSEC protects against, why it needs both your DNS operator and your registrar, and how to do it without taking the domain offline.
Start here
The check reads what your domain publishes and explains each finding in plain language, including who can change it and who decides. Every finding comes with the fix, in full, free, on the page. Nothing is gated and no email address is required.
If a term is unfamiliar, the glossary defines all twelve in plain language.
Reading
- An AI agent in your inbox obeys whoever emails you
Connect an assistant to your email and every message becomes an instruction it might follow. Part of the defence is not in the AI — it is in your DNS.
- Over 100 parastatal CEOs face action on email security. Check yours.
State agency heads face action over domain and email protection. I built a free checker to see what Kenyan domains actually publish. The first one it caught was mine.
- What Running Infrastructure Taught Me
Lessons from building systems in real markets, and why operational reliability still matters more than the next big idea.
- AI in Kenya Is About Workflow, Not Hype
Where AI is already creating real value for SMEs, and where the conversation has gotten ahead of itself.