Consider these eight safeguards to keep thieves away from your domain names.

If you own domain names–particularly good names–you are at risk of having your valuable assets stolen from you.

Thieves will try to compromise your domain registrar account (sometimes by first compromising your email account) and transfer the domains to another registrar. Sometimes they won’t change your nameservers, so you might not realize the domain name is stolen until much later. This makes it harder to recover the domain name.

Here are some tips to protect yourself from domain theft:

1. Use two-factor authentication at your domain name registrar. Any reputable domain name registrar offers two-factor authentication. A thief then needs access to a secondary device (such as your phone number) if they want to crack into your account.
2. Use secure email with two-factor authentication. A common way thieves get into your registrar account is by compromising your email. Once they have access to your email they can reset the password at your registrar. I’ve heard some advice that suggests you shouldn’t use free email services for your domain accounts. I disagree; web-based email services can be some of the most secure options. Consider using Gmail with a physical security key as secondary authentication.
3. Use a different email address for your registrar account than Whois. While many registrars have masked email addresses in Whois, some still show it. Thieves use the email address on a Whois record as a starting point. They try to hack that email account to access the registrar account. One way to stump them is to use a different email address for your registrar account.
4. Use a password manager. Another way thieves get into your registrar account is by phishing. They use your email address from Whois to ask you to log in to a fake site. They grab your credentials when you do this. Two-factor authentication (see #1) can stump them even if they have your username and password. Using a password manager can stop you from falling for the phishing scam because it won’t allow you to auto-fill your credentials on the wrong site.
5. Remember that Whois privacy is a double-edged sword. While thieves use public Whois info to try to break into your account, masked Whois records aren’t always better. After all, if your domain is stolen it might not be reflected in the public database. It will be more difficult for you to discover that your domain is stolen.
6. Use GoDaddy’s domain transfer verification services. This only applies to GoDaddy customers that have Premier Services account managers. The minimum to be considered is 300 domains but there are other qualifications, too. (Here are the qualifications from 2013.) With this added service, your account representative will call you to verify all domain transfers that aren’t Afternic fast transfer sales. It slows down the process but it’s a very good layer of additional security.
7. Add transfer lock to your domains at your registrar. 
8. Track your domains. Use a service like DomainTools to track your domains. You’ll get alerts when a domain is unlocked, transferred to another registrar, etc.

Feel free to comment about additional safeguards you take to protect your domain name portfolio.