Separate Your Registrar, Hosting, Mail and Proxy to Cut Cyber Risk

Many small and mid-sized organisations run their entire online presence through one company and one login: the domain is registered with a host, the website sits on that host’s server, email runs on the same machine, and the DNS is edited from the same control panel. It is convenient and cheap. It is also a single point of failure. If an attacker gets into that one account, or that one server, they can take your website, read or redirect your email, and even obtain valid security certificates in your name.

This article is for business owners, IT managers, web developers and anyone responsible for a company’s domain, website or email. It explains why separating your domain registrar, DNS, web hosting, mail servers and external proxy layer is one of the most effective and least glamorous ways to strengthen your defences, and how to do it step by step without breaking anything.

Key takeaways

• Your domain registrar account is the master key. Whoever controls it can change where your website and email point. Protect it more carefully than any single server.
• Segregation limits the blast radius. If your web host is compromised, a separate registrar, DNS provider and mail service mean the attacker does not automatically get everything else.
• Running web and mail on the same server can expose your real server address and undo the protection of a reverse proxy or content delivery network.
• Separation only works with strong account security: multi-factor authentication, registrar locks, auto-renewal and monitoring of DNS records and certificate logs.
• Your organisation, not a web designer or hosting company, should own the domain, in an account tied to a company email address.

The four layers: what each one does

Before deciding how to separate things, it helps to be clear about what each layer controls.

Domain registrar

The registrar is the company you pay to register your domain name, for example a .com or .com.ng name. The registrar account decides which name servers are authoritative for your domain. Change those, and you change who answers for your entire domain on the internet.

DNS hosting

DNS records translate your domain into addresses: A and AAAA records for your website, MX records for your email, TXT records for email authentication and verification, and CNAME aliases for services. DNS can be hosted by your registrar, your web host, a dedicated DNS provider or your own servers.

Web hosting

The server or platform that actually serves your website and applications. This is the layer most exposed to attack, because it runs code such as a content management system, plugins and databases that face the internet all day.

Mail servers

The systems that send and receive your email. Email carries invoices, password reset links and confidential conversations, which makes it a prime target for fraud.

External proxy servers

A reverse proxy or content delivery network sits in front of your website. Visitors connect to the proxy, which filters malicious traffic, absorbs denial-of-service floods and forwards clean requests to your real server, known as the origin. The proxy only protects you if attackers cannot find and reach the origin directly.

Why putting everything in one place is risky

One stolen password can take everything

The US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 19-01 after a wave of DNS hijacking against government domains. It described how attackers obtained credentials for accounts that could change DNS records, then altered A, MX and NS records to send web and mail traffic through infrastructure they controlled. Because they controlled the DNS, they could also obtain valid certificates for the affected domains, letting them decrypt redirected traffic without browser warnings. CISA noted that the risk persisted even after the redirection ended.

Now imagine that the same login also controls your hosting server and your mailboxes. A single phishing email to the person who manages “the website” could hand an attacker your domain, your website files, your email archive and the ability to send convincing fraudulent invoices from your real address.

Shared servers leak your real address

Cloudflare’s documentation warns that when a website and email run on the same physical server, the DNS records for mail usually cannot be proxied. Anyone who looks up those records can discover the origin server’s real IP address and attack it directly, bypassing the proxy’s protections. Cloudflare also notes that bounce messages sent when someone emails a non-existent address can reveal the mail server’s IP. Its advice is not to host mail on the same server as the protected web resource, and to use non-contiguous IP addresses from different ranges.

Your hosting company may effectively own your domain

The UK National Cyber Security Centre (NCSC) advises organisations to make sure they, and not a web hosting company, control their domains, and to move domains registered with personal email accounts onto the organisation’s own systems. This is a very common problem across Nigeria and the wider continent, where a freelance developer or hosting reseller registered the domain years ago in their own account. If that relationship ends badly, or the developer’s email is compromised, the business can lose its name overnight.

What segregation looks like in practice

Segregation does not mean buying expensive enterprise products. It means each critical function lives with a provider and account chosen for that job, so a failure in one does not cascade into the others.

A sensible model for a small or mid-sized organisation

• Registrar: a reputable registrar that supports two-step verification and registrar lock, holding only domain registrations. Nobody logs in except to renew or change name servers.
• DNS: either the registrar’s DNS or a dedicated DNS provider, managed by a small number of named administrators with multi-factor authentication and change logging.
• Web hosting: your server or platform, with its own separate credentials. Ideally the hosting account has no power over the domain registration.
• Email: a dedicated email service or a mail server on separate infrastructure, not the same box as the website.
• Proxy: a reverse proxy or CDN in front of the website, with the origin locked down so it only accepts traffic from the proxy.

Benefits you gain

• Containment: a hacked WordPress plugin on your web server does not give the attacker your email or your domain.
• Resilience: if your web host suffers an outage, email keeps flowing; the NCSC notes that combining DNS hosting options adds resilience against outages and denial-of-service attacks.
• Clear accountability: each layer has named owners, and access can be granted on a least-privilege basis.
• Easier migration: moving to a new web host is a matter of changing a few records, not untangling domain ownership.

Costs and trade-offs

More providers means more accounts to secure, more renewals to track and slightly more complex troubleshooting. That is manageable with a simple inventory and a password manager, and the trade is usually worth it for any organisation whose income depends on its website or email.

Step-by-step: how to separate your services safely

Plan changes during a quiet period, lower DNS record TTL values a day or two before moving anything so changes take effect faster, and keep a written rollback plan.

1. Build an inventory. List every domain you own, the registrar, who has the login, where DNS is hosted, where the website and mail run, and when each domain expires.
2. Take ownership of your domains. Make sure each domain is registered to the organisation, with contact details on a role-based company address such as domains@yourcompany. The NCSC also advises keeping documents that prove ownership, in case you ever need to reclaim a hijacked domain.
3. Secure the registrar account. Turn on two-step verification for every administrator, use a long unique password stored in a password manager, and ensure more than one trusted person can manage the account so you are not locked out if someone leaves.
4. Apply registrar lock. A registrar lock is a status that tells the registry to block transfers and deletions while it is active; renewals still work. For high-value domains, ask whether your registrar offers stronger registry-level locking, which the NCSC suggests weighing against its cost.
5. Turn on auto-renewal. Use a company-maintained payment method so a domain never lapses and gets snapped up by someone else.
6. Move email off the web server. Migrate mailboxes to a dedicated mail service or separate server, update MX records, and set up SPF, DKIM and DMARC for the new provider.
7. Put a proxy in front of the website. Point the website’s records through the proxy and confirm every record that can be proxied is proxied.
8. Hide and protect the origin. Following Cloudflare’s guidance, consider changing the origin’s IP address after moving behind a proxy, because historical DNS records are public. Review DNS-only records such as FTP or SSH entries that might reveal the origin, and configure the server’s firewall to accept web traffic only from the proxy’s published address ranges.
9. Separate credentials and roles. The person who updates website content should not need registrar access. Remove old staff, former agencies and unused accounts at every layer.
10. Clean up old records. Remove delegations and CNAME aliases pointing to services you no longer use. The NCSC warns that forgotten aliases can lead to subdomain takeover.

Monitoring: how to spot trouble early

Separation reduces damage, but you still need to know quickly when something changes.

• Watch critical DNS records. The NCSC recommends monitoring name server, MX and other service-critical records for unexpected changes, and logging all DNS changes. CISA’s directive likewise ordered agencies to audit their DNS records, prioritising NS and MX records.
• Monitor certificate transparency logs. Every publicly trusted certificate is recorded in public logs. A certificate for your domain that you did not request can be an early sign of DNS compromise, a check both CISA and the NCSC recommend.
• Check blocklists. If your domain or mail server appears on a DNS blocklist, it may indicate abuse such as spam sent from a compromised account.
• Enable registrar and DNS alerts. Most providers can email you when records, contacts or locks change. Send these to a monitored team address, not one person’s inbox.

Common mistakes to avoid

• Leaving the domain in a developer’s or reseller’s personal account.
• Using the same password, or the same email address that receives password resets, across registrar, DNS, hosting and email.
• Relying on SMS codes alone; CISA recommends phishing-resistant methods such as security keys and advises against SMS for DNS accounts.
• Putting a proxy in front of a site while leaving the origin open to the whole internet.
• Forgetting that the registrar’s own password reset emails go to a mailbox that may itself be hosted on the server you are trying to protect.

Frequently asked questions

Is this overkill for a small business?

No. The basics, owning your domain, turning on two-step verification and registrar lock, and running email separately from the website, cost little and prevent some of the most damaging incidents a small business can face.

Can I use one provider for several layers?

Yes, if each layer uses separate, well-protected access and the provider is reputable. The goal is to avoid one compromised login or server controlling everything, not to collect providers for their own sake.

Should I enable DNSSEC?

DNSSEC adds protection against forged DNS answers, but the NCSC advises weighing its costs and benefits first, as it adds key-management work and not every service supports it.

Next steps

• This week: list every domain, registrar, DNS host, web host and mail service you use, and who holds each login.
• Turn on two-step verification and registrar lock for every domain, and switch on auto-renewal.
• Move any domain held in a personal or agency account into a company-owned account.
• Plan to move email off your web server if they currently share a machine.
• Set up alerts for DNS changes and new certificates issued for your domains.
• Review the setup every six months, and whenever staff or suppliers change.

Sources

• NCSC: Managing public domain names
• CISA Emergency Directive 19-01: Mitigate DNS Infrastructure Tampering
• Cloudflare: Exposed IP addresses
• Cloudflare: Protect your origin IP
• Web4Africa: What is registrar lock?