Defending democracy
Page 3 of 6
Guidance for high-risk individuals to protect your website and custom email domain
Using this guidance
This guidance is for high-risk individuals who already have their own website or custom email domain, or who intend to set one up.
If you are a high-risk individual and you do not manage (or intend to manage) your website or domain yourself, you should refer this guidance to the person who maintains them on your behalf.
The guidance outlines:
- how and why you may be targeted
- how you can protect your domain
- how you can protect emails sent from your domain
- how you can protect your website
It also signposts to the NCSC services that will help you manage the security of your website and custom email domain.
How and why you may be targeted
Threat actors may try to gain control of your domain name, website or emails for different motivations. They may seek to damage your reputation or cause you embarrassment, promote their own views, or profit financially from you, your contacts or visitors to your site.
Securing your domain name
To set up a website, or to send and receive emails from a custom email address, you need a domain name.
Domain names, such as example.co.uk, are purchased through domain name registrars. They are intermediaries who work with registries to handle the registration and allocation of domain names.
As your website and email domain rely on the security of your domain name, threat actors may try to gain control of your domain name to hijack your website, email accounts and other services that use it.
It’s therefore important to secure it by following the advice below.
Protecting your custom email domain
Securing email for a domain requires different standards to be correctly configured. You should follow the advice below to make sure that you are taking the right steps to take this across the standards.
Note that the signposted guidance assumes some prior knowledge and experience of managing domains and email systems. If you are sending and receiving emails from your domain name, some providers offer a managed service to help you do this, which may include securing your email domain in line with this guidance. Check if you’re not sure.
Setting up your website
Further resources
Once set up, the NCSC offers services to help you maintain the security of your website and email:
- Early Warning helps an organisation investigate threats on their network by notifying them of potential malicious activity detected in information feeds. To get started, you need a MyNCSC account.
- The IP address and website check service helps you check if your IP address or website has any common weaknesses that could allow cyber criminals to access your networks and devices.
- The email security check service helps you check that you have applied the standards SPF, DKIM, DMARC, TLS and MTA-STS correctly to prevent spoofing of your domain and to protect email privacy.
- As a high-risk individual, you can also register your personal details (including email addresses and domain names) with the NCSC so we can easily notify you if we become aware of suspicious activity. You can also sign up for personal internet protection to help counter the threat from spear-phishing by emailing [email protected] and providing your email address and a short business case.