Academy › Courses › Domain and email
Don't let anyone take what's already yours: locking down your domain and your email
Knows how to close off the ways someone can steal a domain or an email account, like a weak password, a recovery option, two-factor verification, or a missing transfer lock, and knows what to do in the first two hours if it's already happened.
One day you log into your email and the password doesn't work anymore. Or you get a notice that your domain has changed owners without you signing off on anything. It happens fast: you use the same password on three sites and someone tries it here, or you click a link that looks like the usual one and hand over the next step without realizing it. Almost everything else can be recovered through email, so whoever gets in there doesn't just take your inbox: they take the key to your entire business.
This course closes, one by one, the gaps where someone pretending to be you can slip in: the reused password, the recovery email set up the wrong way, the two-factor step tied to your phone, the unlocked transfer, and the link that imitates your registrar. It follows the order those gaps would actually get used, and ends with the two hours that matter most if the theft has already happened: who you call first and what you ask for.
This is for anyone who already has a business with their own domain and email and wants to close the gaps before someone else uses them; it's not for anyone who hasn't set up either one yet, since there's nothing to lock down there.
- Change your email password and your registrar panel password to two new ones, generated and not reused anywhere else
- Set a recovery address outside your own domain and store it with your master password
- Turn on app-based two-factor instead of SMS and turn on your domain's transfer lock
- Recognize a fake expiration notice and always verify it by logging into the panel yourself, never through the link in the email
Have your current email access and the panel where you bought your domain ready before you start.
The 6 lessons
In the order it makes the most sense to read them.
- 1
The password you can't reuse here
By the end you'll have two new passwords, generated and not reused anywhere else: one for email and one for your registrar panel.
7 min - 2
The recovery email can't live inside the domain it's protecting
Your business domain and email have a recovery address that's separate from both, controlled by the owner and stored with their password.
6 min - 3
The app, not SMS, for two-factor authentication
Your two-factor lock stops depending on your phone carrier and depends instead on an app that only you have.
7 min - 4
The lock that stops anyone from taking it without your say-so
Turn on the transfer lock for your domain, and know that only you decide the day it comes off.
6 min - 5
Verify in the panel, never through the link in the email
You'll recognize the fake expiration or transfer notice for your domain and email, and you'll check it by logging into your registrar yourself, never through the link.
8 min - 6
The first two hours after it's already happened
You'll walk away knowing who to call in what order, what to ask each one for, and what to write when someone has already gotten into your domain or your email.
8 min