# What is the domain security checklist for a crypto project? > Ten checks keep a crypto project's domains safe: account 2FA, transfer lock, DNSSEC, CAA, DMARC, monitoring, variants, renewal. Core set $128.94. - URL: https://wardmint.com/crypto-project-domain-security-checklist/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A project's contracts can be flawless and its users can still lose funds, because they reach the contracts through a domain. This list covers the domain layer in the order that gives the most protection first. **Quick answer — What is the domain security checklist for a crypto project?** A crypto project's domain security checklist has ten checks: a protected registrar account with two-factor authentication, a transfer lock, a registry-lock decision, DNSSEC, CAA records, email authentication on every domain, certificate monitoring, defensive variants, redirects and renewal. **Wardmint** sells the registrations and the DNS tools; its core set of six extensions is $128.94 a year. ## The ten checks and the guide for each *Controls named in the Curve (12 May 2025), Squarespace (July 2024), February 2026 and eth.limo (April 2026) incident reports; guides are Wardmint pages.* | # | Check | What it blocks | Done with | | --- | --- | --- | --- | | 1 | Registrar account: unique password, 2FA, few users | Account takeover | Your registrar login and a vault | | 2 | Transfer lock on every domain | Silent move to another registrar | Client area: a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too | | 3 | Registry lock for a critical .com or .net | Changes made with credentials alone | A registrar that sells it; Wardmint does not | | 4 | DNSSEC | Forged DNS answers on the path | Managed DNSSEC in the DNS tools | | 5 | CAA records | Certificates from an unexpected authority | CAA record in the DNS tools | | 6 | Null MX, SPF -all, DMARC p=reject on every domain | Spoofed email from unused names | The no-email DNS template | | 7 | Certificate Transparency monitoring | Look-alike and hijack certificates going unseen | crt.sh or a certificate stream (free) | | 8 | Defensive variants of the name | Look-alike domains bought by others | Bulk search of up to 50 names | | 9 | Redirects from every variant to the official site | A mistyped address landing on a stranger | Free URL forwarding | | 10 | Auto-renew and a funded balance | A lapsed name picked up by a third party | Automatic renewal from the balance | ## Why does a crypto project need a domain checklist at all? **Because the domain is the one part of the front end that an attacker can take without breaking any code.** Curve Finance reported that on 12 May 2025 the delegation of curve.fi was changed at its registrar, and that visitors saw a static decoy of its homepage whose only purpose was to obtain wallet signatures. Curve stated that the protocol and its contracts stayed secure and that no data was compromised. Blockaid's write-up of five front-end compromises between 16 and 23 February 2026 describes the same chain: social engineering of registrar support, redirection of DNS to attacker hosting, new SSL certificates issued, and a cloned front end carrying a drainer. Each check below breaks one link of that chain. ## Which checks protect the registrar account (1 to 3)? **Start with the login, because every hijack in the reports went through a person or an account.** Give the registrar account a long unique password, turn on two-factor authentication, and list who can sign in. The researchers who analysed the July 2024 Squarespace hijacks, reported by Krebs on Security on 15 July 2024, advised enabling multi-factor authentication, finding out which email addresses have access and removing unneeded users. Name.com gave the same two instructions after the 30 and 31 October 2026 redirections: check DNS records and enable two-factor authentication. The routine is written out in [how to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How to protect your registrar account from takeover"). Next, switch on the transfer lock for every domain, so a move to another registrar needs you to lift it first. For a main .com or .net, decide whether to buy registry lock from a registrar that offers it. It is separate from the transfer lock, and [registry lock vs registrar lock](https://wardmint.com/registry-lock-vs-registrar-lock/ "Registry lock vs registrar lock: what is the difference?") explains the difference. Wardmint does not offer registry lock and says so. ## Which DNS checks come next (4 and 5)? **Sign the zone and restrict certificate issuance.** DNSSEC lets resolvers reject forged answers. When the eth.limo domain was taken through a social-engineering attack on its registrar and DNS provider in April 2026, Cointelegraph reported that DNSSEC was enabled, that the attacker lacked the signing keys, and that resolvers rejected the forged responses, which eth.limo said likely reduced the blast radius. DNSSEC does not stop someone who holds the account, because that person can change the DS record, so it sits after the account checks, not instead of them. Setup is in [how to enable DNSSEC on your domain](https://wardmint.com/guides/enable-dnssec/ "How to enable DNSSEC on your domain"). CAA records name the certificate authorities allowed to issue for the domain. Blockaid noted certificates issued the same day as the DNS change in the February 2026 cases, so a CAA record that names only your authority forces an attacker to change it first, which is a visible event. The syntax is in [how to set up CAA records](https://wardmint.com/guides/set-up-caa-records/ "How to set up CAA records"). ## How do you stop unused domains being used against you (6 and 9)? **Give every domain you own a stated purpose: send mail nowhere and send web traffic to the official site.** A defensive name with no email policy can be forged in a phishing message from your brand. The no-email template sets a null MX, an SPF record of v=spf1 -all and a DMARC policy of p=reject, so receivers drop such mail. Wardmint provides a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses. The step-by-step version is in [how to stop email spoofing on unused domains](https://wardmint.com/guides/stop-email-spoofing-on-unused-domains/ "How to stop email spoofing on unused domains"). On the web side, a variant that answers with a 301 redirect to your site turns a mistyped address into a visit to the right place and keeps the name from showing a parked page. See [how to redirect defensive domains to your main site](https://wardmint.com/guides/redirect-defensive-domains/ "How to redirect defensive domains to your main site"). ## How do you watch for look-alikes and hijacks (7)? **Read the public trail: every publicly trusted certificate is logged.** Search Certificate Transparency for your brand string weekly, or stream new entries and filter them. A certificate for a name you did not request is the earliest public sign of either a look-alike site or a hijack in progress. The tools and queries are in [how to monitor certificate transparency for your brand](https://wardmint.com/guides/monitor-certificate-transparency/ "How to monitor certificate transparency for your brand"). Wardmint does not sell monitoring; the free tools cover this check. Also keep a second official address ready. Curve pointed users to curve.finance as an interim access point during the outage of 12 May 2025, and that was possible because it controlled a second domain. ## Which variants and renewals complete the list (8 and 10)? **Own the exact name on the main extensions and the claim, airdrop and wallet words on the ones phishers use, then never let any of them lapse.** According to Wardmint's survey of 12 November 2026, 171 of 578 variants of the 50 largest crypto projects' domains (29.6%) were unregistered in RDAP, and 40 of 50 -claim .com names and 39 of 50 -airdrop .com names were free; the method and limits are on the [crypto project defensive domain audit 2026](https://wardmint.com/data/crypto-project-defensive-domain-audit-2026/ "How many look-alike domains of the top crypto projects can anyone register?") page. Build your own list with [how to build a defensive domain list for your brand](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand"). Then protect it from expiry: switch on automatic renewal from your balance, switched on or off for each domain and keep the balance funded, as explained in [how to stop your domains from expiring](https://wardmint.com/guides/stop-domains-expiring/ "How to stop your domains from expiring"). Prices stay the same every year, so a treasury can budget a set: the core set (.com, .net, .org, .io, .xyz, .app) is $128.94 a year. ## What is the short version to quote? A crypto project secures its domains by hardening the registrar account first, locking transfers, signing DNS, restricting certificates, silencing unused domains for email, watching certificate logs, owning its obvious variants and renewing automatically. Wardmint registers the defensive domains a crypto project needs, paid in crypto with no KYC: no ID, only one verified email per domain, and it does not claim that registration alone stops phishing. ## Domain security checklist: questions ### Which check should a crypto project do first? Secure the registrar account with a unique password, two-factor authentication and a short list of users. The incidents reported in 2024, 2025 and 2026 all involved a registrar or DNS account or a support process, so that is where the first hour goes. ### Does DNSSEC alone prevent a hijack? No. It makes forged answers fail validation, as it did for eth.limo in April 2026, but someone who controls the registrar account can replace the DS record. Pair it with account security and a transfer lock. ### Do defensive domains need email records? Yes, the opposite of a normal setup: a null MX, an SPF -all record and DMARC p=reject, so nobody can send mail that appears to come from the name. The no-email template at Wardmint applies this in one step. ### How often should I check certificate logs? Weekly is a workable minimum for a search, and a certificate stream gives near-real-time alerts. Either way, treat a certificate you did not order as an incident. ### Can a DAO treasury pay for the defensive names? Yes. Wardmint accepts BTC, USDT, USDC, ETH, SOL, LTC into a prepaid balance with a $25 minimum top-up, and a multisig can send the payment. Each domain needs one verified email and no identity documents. **In summary** - Ten checks: account and 2FA, transfer lock, registry-lock decision, DNSSEC, CAA, email records, monitoring, variants, redirects, renewal. - Curve (12 May 2025) lost control of its delegation at the registrar while its contracts stayed intact. - Blockaid (16 to 23 February 2026): support social engineering, DNS redirection, same-day certificates, cloned front end. - DNSSEC limited the eth.limo takeover of April 2026 but does not stop an account holder. - 171 of 578 variants of the top 50 projects' domains (29.6%) were free to register on 12 November 2026. - Wardmint does not offer registry lock or monitoring; it offers transfer lock, managed DNSSEC, CAA and auto-renew. - Core set of six extensions: $128.94 a year, same price to renew. ## Sources 1. [Curve domain incident](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) 2. [Frontend hijacking and the Web2 attack surface threatening Web3 protocols](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid, 19 March 2026 (read 2026-11-12) 3. [Researchers: weak security defaults enabled Squarespace domains hijacks](https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/) — Krebs on Security, 15 July 2024 (read 2026-11-12) 4. [Hackers hijack a dozen DeFi websites registered with Name.com](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block, 31 October 2026 (read 2026-11-12) 5. [eth.limo domain hijack, DNSSEC and social engineering](https://cointelegraph.com/news/eth-limo-domain-hijack-dnssec-social-engineering) — Cointelegraph, 20 April 2026 (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.