Your profile and account security

Profile holds your details, your password and your email address.

Your password

Passwords are stored hashed — they cannot be read back by us or by anyone with access to the database, and a reset produces a new one rather than telling you the old one.

Use a password manager and a password unique to this account. The account controls DNS for every domain you host, which makes it a more valuable target than it feels like.

Changing your email address

The address is what identifies you, receives password resets and receives billing notices. Changing it is therefore not immediate: the change is confirmed at the new address before it takes effect, and it can be cancelled from the portal while it is pending.

That matters. If a change request appears that you did not make, cancelling it is right there — and until it is confirmed, the old address is still the account's address.

If you never receive the confirmation, check the address for a typo and cancel the pending change rather than requesting a second one.

Your timezone

Timestamps through the portal are shown in the timezone set here. Worth setting correctly before you next read an incident timeline, not during.

If you think the account is compromised

1. Change the password immediately.
2. Check API keys and revoke any you do not recognise — a key is a way in that a password change does not close. See API keys.
3. Check Payment methods for cards you did not add.
4. Check your zones for records you did not create. Time Machine shows what changed and when.
5. Tell us through Support, or the contact form if you cannot sign in.

Closing the account

Closing is not a button to press casually: it ends DNS for every zone on the account. Move your domains to another provider first, confirm they resolve there, and close afterwards. Data retention after closure is set out in the Privacy Policy.

Last reviewed 2026-08-19.