Domain & DNS Security — Overview
🔑 Key Takeaway: Compromised DNS or registrar control can serve wallet drainers as "the real site." Lock registrars, monitor changes, and treat domain security as fund security.
DNS (Domain Name System) is the backbone of the internet, translating domain names into IP addresses. In Web3, domain security is particularly critical as compromised domains can lead to irreversible financial losses through wallet drainers and phishing attacks. Unlike traditional web applications where stolen funds can sometimes be recovered, blockchain transactions are permanent.
Moreover, DNS controls your email infrastructure through MX records - once compromised, attackers gain the keys to your entire organization through password resets and intercepted communications, making domain security a matter of both financial and operational survival.
Web3-Specific Considerations
Why Domain Security is Critical in Web3
Domain security is exponentially more critical in Web3 compared to traditional web applications due to the unique characteristics of blockchain technology:
- Irreversible transactions: Unlike traditional banking where stolen funds can sometimes be recovered, blockchain transactions are permanent. Once funds are stolen through a domain hijack, they're gone forever.
- Direct wallet interactions: Users connect their wallets directly to your domain, giving attackers immediate access to user funds without needing to compromise individual accounts.
- Reputation damage: One domain hijack incident can permanently destroy protocol trust, as users lose confidence in the project's security practices.
What this framework covers
- DNS Basics and Common Attacks: resolution model and common attack paths.
- DNSSEC, CAA, SMTP DANE and Email Security: integrity and email authentication controls.
- Registrar Security and Registry Locks: account and lock controls that stop many seizures.
- Monitoring, Alerts, and GitOps: detect and revert hostile changes quickly.
Historical Context
Notable Domain Security Incidents
Domain hijacking has impacted numerous Web3 projects:
- Curve Finance (2025): Domain hijacking at the registrar level, unrelated to any breach of Curve's infrastructure.
- Puffer Finance (2024): DNS hijack exploited centralized infrastructure vulnerabilities
- Compound Finance (2024): Domain takeover attempt prevented by registry lock
- Galxe (2023): DNS hijack resulted in over 1,100 wallets drained for $270k
- Curve Finance (2022): DNS hijacking led to $575k in stolen funds through frontend compromise
These incidents highlight the critical importance of proper domain security measures and the recurring nature of these attacks.
References and Resources
Incident Response Contacts
- SEAL Alliance TG Bot - Web3 emergency response team
- Your registrar's security team (document contact info)
- Local FBI/law enforcement cybercrime division
Standards and Best Practices
- NIST Special Publication 800-81-2 - Secure Domain Name System Deployment Guide
- ICANN DNSSEC Resources
- RFC 8461 - MTA-STS specification
- RFC 7489 - DMARC specification
- DNS Security in Web3: Attacks & Monitoring Setup Explained - Comprehensive Web3 DNS security guide
Further Reading
- Infrastructure overview: how this subsection fits the wider framework
- DNS Hijack Runbook: response steps when records change without authorization
- GoDaddy Security: hardening a registrar account in practice
- Front-End & Web App: the site users reach once DNS resolves