The Leasehold Illusion: Board Governance of Domains, DNS and Digital Brand

In most board packs, the corporate website appears under marketing. The domain renewal is a modest line item, often handled by an agency or a long-serving administrator. That framing is understandable, but it is incomplete. The domain and the DNS records behind it form part of the control plane for email, payments, customer portals, remote access and supplier trust. When they fail, they tend to fail outside the perimeter that conventional defences were built to protect.

For UK boards, the question is not whether the homepage looks right. It is whether the organisation can prove who controls the address, who can change the records, and how quickly it could take both back.

The leasehold illusion

A domain is often described as a digital asset. In practice, it is closer to a leasehold: the organisation holds registration rights subject to renewal, accurate registrant data and the conduct of intermediaries. The .uk namespace is administered by Nominet, while generic top-level domains sit within the ICANN-accredited registrar system. In both cases, the practical keys to the property are held in a registrar account.

That distinction matters at board level because it changes the ownership question. A board would not accept a property lease in which the keys sat with a former employee, the rent was paid from a personal card and the alarm code was shared by email. Yet equivalent arrangements persist in many organisations because the domain has never been treated as an operational control.

Registrar accounts can be compromised through credential theft, social engineering of support staff or simple neglect. Nameservers can be changed in minutes. A lapsed renewal can place a domain in a redemption period or, worse, make it available to a third party. None of these events requires an attacker to defeat the corporate firewall.

Two failure modes that bypass conventional defences

The first is domain hijacking. An attacker gains access to the registrar account, changes the nameservers or transfers the registration, and then controls email and web traffic. From the outside, the organisation's own domain may appear to be sending fraudulent invoices or hosting a credential-harvesting page. Internal security tools may see nothing unusual because the traffic is legitimate at the network layer.

The second is DNS misconfiguration, which is often quieter. A dangling CNAME record pointing to a cloud service that has been deprovisioned can allow an attacker to claim the underlying resource and serve content from a trusted subdomain. Permissive zone transfers, unmonitored subdomains and stale records left by former projects all widen the surface. The organisation's brand lends credibility to the attacker's infrastructure.

Brand impersonation completes the picture. Lookalike domains, homoglyphs and combosquatting variants are used in invoice fraud, phishing and fake supplier onboarding. The organisation does not own these domains, so conventional asset inventories will not list them. Monitoring and takedown routes become part of the control set.

The brand outside the perimeter

Email authentication is the clearest board-level indicator. DMARC at p=none provides reporting but not enforcement. A board should ask whether every sending domain in the group, including subsidiaries, marketing platforms and bulk senders, is covered by an enforced DMARC policy aligned with SPF and DKIM. The answer is often more complicated than the one-page summary suggests.

Impersonation monitoring is equally important. Who watches certificate transparency logs, newly registered lookalike domains and typo-squatting variants? What is the agreed route for takedown, and who authorises it? For .uk domains, Nominet operates a dispute resolution service; for generic top-level domains, the Uniform Domain-Name Dispute-Resolution Policy applies. Both take time. A board should know whether the organisation has pre-agreed authority to act, rather than discovering the process after a fraudulent email campaign has already reached customers.

A short board protocol

The following questions are not a technical audit. They are the minimum a board should be able to answer without calling a specialist into the room.

1. Inventory. Which domains, subdomains and sending domains does the group rely on for revenue, email and customer access? Who is the registrant of record for each?
2. Control. Is the registrar account held in the corporate name, protected by hardware-backed multi-factor authentication, and is registry lock enabled for critical domains?
3. Renewal. Who owns the renewal calendar, and what happens if a payment fails or a card expires?
4. DNS change control. Who can alter records, are changes peer-reviewed, and are dangling records reviewed on a fixed cycle?
5. Email enforcement. Is DMARC enforced at reject for all domains, with SPF and DKIM aligned, and are exceptions documented?
6. Monitoring and takedown. Who watches for lookalike domains and certificate issuance, and what is the playbook for removal?
7. Recovery. Has the organisation tested restoring registrar access and DNS records without the usual administrator?

Recovery is a board-level capability

If a domain is hijacked, recovery depends on proving corporate identity to the registrar and, in some cases, to the registry. It can take days. The board should ensure that pre-authorised contacts, recovery codes and legal escalation routes are documented and stored offline. The incident response plan should include a domain and DNS scenario, not merely a data breach or ransomware scenario. A tabletop exercise is a reasonable test of whether the organisation can reunite the brand with its address under pressure.

Cyber insurance deserves a specific question. Many policies respond to network interruption, but domain recovery costs, brand impersonation and registrar disputes may be excluded or sublimited. The board should not assume cover exists because the policy says "cyber".

What to ask for in the next paper

A one-page domain and DNS assurance paper, refreshed annually, is sufficient for most boards. It should list the critical domains, attest to registrar controls, state DMARC enforcement status, summarise monitoring coverage and record the date of the last recovery test. Exceptions should be visible, not buried. The audit committee can then challenge the exceptions rather than the technical detail.

The homepage is the shop window. The domain and DNS are the deeds and the keys. Boards that govern the latter protect the former, and they do so before the renewal reminder arrives.