Securing your domain and DNS: A practical guide to modern web protection

Business email compromise, domain hijacking, lookalike phishing, and web application attacks all have one thing in common: they exploit weaknesses at the domain and DNS layer that most organisations don't even know they have. Expired domains, missing DMARC, unmonitored registrar accounts, and wide-open DNS zones are still everywhere in 2026, and attackers know it. The controls to fix these issues are well documented and mostly free, yet they remain some of the most consistently neglected parts of the security stack.

Domains and DNS are usually invisible until they break, and when they do, the fallout is immediate: email stops flowing, websites disappear, and users are locked out within minutes. As MSPs working in the trenches of Microsoft 365, web hosting, and everything in between, we've seen time and again that the root cause of these incidents is almost always a domain, a DNS record, or an authentication control that wasn't properly owned or maintained.

This session walks through a practical, repeatable framework for securing domains and DNS end to end, drawn from real-world examples of how we protect our customers' environments. We'll start with domain custody, covering registrar governance, auto-renew, domain lock, scoped third-party access, and ticketed change control - the unglamorous basics that prevent avoidable outages. From there, we'll move into DNS hardening with DNSSEC, and 'export-before-change' discipline.

We'll then tackle Microsoft 365 email authentication in detail, with a clear rollout plan for SPF (staying under the 10-lookup limit), DKIM (enablement, publishing, and selector rotation), and DMARC (staged from none to quarantine to reject). Attendees will walk away with template records and a repeatable process they can apply across multiple environments.

The final section covers web protection using Cloudflare, where we'll demo both the Free plan (DNS, CDN, DNSSEC, CNAME flattening) and Pro plan (WAF, Super Bot Fight Mode, APO), plus lightweight scripting and automation with dry-run safety, backups, and protection of core records. This session is aimed at MSPs, internal IT teams, and security practitioners who want a field-tested playbook they can start applying to real environments as soon as they get back to the office.