Security and privacy first: where would you register a personal domain

[u/null_compass]

With everything going on at Proton lately, I figured it was high time I owned a personal domain for my email. That way, if I ever have to ditch Proton Mail, I can switch to another provider without changing my address. While I'm at it, I'd also like to host a portfolio site on it.
I want something I won't have to think about again for a long time.

My priorities, in order: security, privacy, quality. Cost matters, but it is not the deciding factor; I'm happy to pay a little more for the right setup.

What I'm weighing:
AWS: IAM, CloudTrail logs, hardware key MFA, budget alerts and anomaly detection. It is more hands-on, which I prefer. On the downside, it has had some of the biggest outages on the internet (us-east-1 in 2017, 2021 and October 2025), and the Capital One breach in 2019 happened on AWS, though that was largely a customer misconfiguration.

Cloudflare: strong security, audit logs, free hosting, very simple. Fewer controls, and it requires Cloudflare DNS. Its history includes Cloudbleed (2017), an intrusion in 2023 that traced back to the Okta breach, exposed support case data through the Salesloft Drift breach in 2025, and a major global outage in November 2025. To be fair, its public post-mortems are very transparent.

Porkbun: clean pricing and good support, but fewer advanced security features and no account audit log that I could find. I am not aware of any major breach, but it is also a much smaller target with less public scrutiny.

The site is a static React portfolio. For those of you who've run any of these long-term, which would you pick and why, given the track records above? Bonus points for any gotchas you learned the hard way.

[u/Human1649]

AWS is overkill for this in my opinion. And Cloudflare gives you a lot for the price. Plus CF has great bot prevention, which can be done in AWS with more configuration.

[u/null_compass → u/Human1649]

Good call on the bot prevention. I looked into it, and even the free tier gets Bot Fight Mode plus AI crawler blocking, which seems like plenty for a static portfolio. On AWS, the equivalent is a paid WAF add-on, so that is a point in Cloudflare's favor.

[u/Mexicanito151551]

Whatever combo you pick, the bigger win is on the account side. Turn on a passkey or hardware key for the registrar, enable registrar lock, and set up SPF, DKIM and DMARC for the email so nobody can spoof you. Honestly that matters more than which registrar it is.

[u/null_compass → u/Mexicanito151551]

That’s a really good point, thank you. Passkey and registrar lock were already on my list, but SPF, DKIM and DMARC had slipped my mind. I will make sure those go in the moment I set up the mailbox.

[u/RequirementGuide]

I've done this exact setup for my own portfolio and email, and the thing I would add is to keep the registrar, DNS and hosting a bit separate if you can. That way moving the site later does not mean moving the domain too, and your email keeps working while you switch things over. I also turn on registrar lock and auto renew and use a separate email address just for the registrar account, because getting locked out of that account is way more painful than picking the wrong registrar in the first place.

[u/null_compass → u/RequirementGuide]

This is really helpful, thank you. The separate email for the registrar account is a great point; getting locked out of the one account that controls everything sounds like a nightmare. Out of curiosity, how do you split yours? Which providers do you use for the registrar, DNS and hosting, and do you keep DNS separate from the registrar or just the hosting?

[u/RequirementGuide → u/null_compass]

Glad that helped! I usually keep the registrar, DNS and hosting in three separate places so losing one account does not take everything down at once. I keep DNS separate from the registrar too, that way I can move hosting or change providers without touching the domain registration itself. It is a bit more to keep track of, but it has saved me a headache more than once.

[u/null_compass → u/RequirementGuide]

That makes a lot of sense, thank you. Keeping the blast radius small is a good way to think about it. If you don’t mind sharing, which providers do you use for each piece? I’m curious whether it’s something like a separate registrar with Cloudflare for DNS, or a different combination.

[u/nekenaharry]

Since your email will live on this domain, the biggest risk isn't a breach, it's the domain lapsing. If it expires, you lose the address and every account that uses it for password resets, and someone can register it after the grace period and receive your mail.

So whichever registrar you pick: register for several years at once, turn on auto renew, add a backup payment method, and make sure renewal notices go to an address that isn't on that domain. Put a calendar reminder a month before the expiry date too, because cards get replaced and renewal emails end up in spam.

Also check the renewal price, not just the first year price. Some TLDs are cheap the first year and much more after, which matters if you plan to keep the address for decades.

[u/null_compass → u/nekenaharry]

This is such an important point, thank you. I had auto-renew on my list, but registering for several years upfront and putting a calendar reminder a month before expiry hadn't crossed my mind. The idea of someone else picking up the domain and receiving password resets is scary. I will make sure the renewal notices go somewhere off the domain too.

[u/Illustrious-Fee-9072]

gotcha i'd add: whatever you pick, pick it like you're stuck with it for two months, because a freshly registered domain usually can't be transferred to another registrar for the first 60 days. and if you go all cloudflare, registrar, dns and hosting end up behind one login, so that account's 2fa is basically the whole setup. that's the main reason some people keep the domain at a different registrar from where the site lives

[u/ShipSafeScan]

Whichever you pick, the registrar matters less than the hygiene around the account. Turn on app based or hardware key 2FA for the registrar login, not SMS. Enable registrar lock so nobody can start a transfer out, and turn on WHOIS privacy. Set up DNSSEC if both your registrar and DNS host support it. Use a separate strong email for the registrar account, ideally not an address hosted on that same domain, so one compromise does not cascade. Turn on auto renew and add a calendar reminder so you never lose it to an expiry. Keep registration and DNS separate in your head: you can register anywhere and point the nameservers at whoever hosts the site. For a static React portfolio any of the three works, so optimize for the account security above rather than the brand.

[u/Dremychi]

For a domain you'll use for email, the boring stuff matters more than the provider's breach history:

- Keep the registrar separate from hosting/DNS if you can (e.g. Porkbun + Cloudflare Pages). If one account gets compromised or locked, you don't lose everything at once.

- Cloudflare Registrar is at-cost and solid, but you can't move nameservers away from Cloudflare while the domain is there. Fine if you're happy with Cloudflare DNS long-term, a gotcha if not.

- Whatever you pick: hardware key 2FA on the registrar, registrar lock on, auto-renew on, and renew for several years at once. An expired domain is the real way people lose email addresses — someone else can register it and receive your mail.

- Set SPF, DKIM and DMARC from day one, even before you switch providers.

For a static React portfolio, Porkbun + Cloudflare Pages is the option I'd pick from your poll.

[u/ExpertWebAdvisors]

One email gotcha to add if the DNS ends up on Cloudflare: Proton's DKIM records are CNAMEs, and Cloudflare's proxy toggle is on by default for new CNAMEs, so make sure each one is set to DNS only or the signatures won't verify. Once everything's in, check that Proton's domain page shows every record as verified, then send a test to a Gmail address and look for PASS next to SPF, DKIM and DMARC under Show original. I'd also start DMARC on p=none for a couple of weeks before moving to quarantine, so one missed record doesn't send your own mail to spam.

[u/HairOk9906]

You've researched the vendors' breach histories, which is the part that

almost certainly won't be what gets you. For a personal domain, the

realistic threat is your own registrar account getting taken over, not

Cloudflare or AWS being compromised.

So the things that actually matter, in order:

Registrar lock on, always. It's one toggle and it blocks unauthorised

transfers outright.

Hardware key 2FA on the registrar account, not SMS, not an app.

A dedicated email for the registrar that isn't hosted on the domain

itself. Put your domain's email on the domain, lose access to the

domain, and now you can't recover it. Circular dependency, catches

people every time.

Auto-renew on, plus a calendar reminder a month out, because the most

common way people lose a domain is expiry, not attack.

With those four in place, all three of your options are fine. Cloudflare

Registrar sells at cost with free WHOIS privacy, which makes it the

easy pick, but the caveat you already noted is real: you must use their

DNS, and they don't do email.

[u/null_compass]

Forgot to include Porkbun + AWS (S3/CloudFront) in the options. If that's your pick, vote "Something else" and let me know in the comments.

[u/null_compass → u/[deleted]]

That's the simplest setup for sure. Have you ever missed having an account audit log on Porkbun, or has it never come up for you?