This is a good question. I have to admit, it only recently occurred to me that my own domain is not by default completely secure from theft. I have focused on "

This is a good question. I have to admit, it only recently occurred to me that my own domain is not by default completely secure from theft. I have focused on "how secure is email-provider-x", or "hosting-company-y", but never the company that actually holds my domain registration. I currently use Amazon for my domains, and I'm not actually sure how vulnerable they are to social engineering attacks. I do remember losing my 2FA device years ago and calling them to get back into my account...which was convenient at the time, but is nagging at me right now.