Check ID:
Provider: AWS
Service:
Severity: MEDIUM
Categories:
Resource type:
route53_domains_privacy_protection_enabledProvider: AWS
Service:
route53Severity: MEDIUM
Categories:
internet-exposedResource type:
OtherWhat this check verifies
Route 53 domain administrative contact has privacy protection enabled, so WHOIS queries return redacted or proxy details. Evaluates whether contact data is hidden instead of publicly listed.Risk
Public WHOIS contact data exposes names, emails, phones, and addresses, enabling:- Phishing/social engineering of the registrar
- SIM-swap or account takeover
- Domain hijacking, affecting DNS integrity/availability It also increases spam and targeted harassment.
Recommendation
Enable WHOIS privacy for all contacts (admin, registrant, tech) to minimize exposure. Apply defense in depth: use dedicated, monitored contact emails, enforce transfer lock and MFA on registrar access, and regularly review settings. If a TLD lacks privacy, provide minimal, role-based contact details.Remediation
- CLI
- Terraform
- Dashboard steps
aws route53domains update-domain-contact-privacy —domain-name <DOMAIN_NAME> —admin-privacy
References
- https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-privacy-protection.html
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/Route53/privacy-protection.html
- https://support.icompaas.com/support/solutions/articles/62000233459-enable-privacy-protection-for-for-a-route53-domain-
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = route53_domains_privacy_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks