I have recently heard of many security flaws in go daddy accounts. I have bought a domain through Google Apps but they use go daddy as their registrar. I was wondering whether this means I have an account with go daddy that can be hacked? (I don't remember ever creating one) Or is go daddy just managed through the Google Apps account? (which has obviously much better security than go daddy)
The good news: GoogleApps, when they use GoDaddy as the domain name registrar, seems to set the domain as 'protected'; which means that, if GoDaddy were hacked, there'd be a lot of steps for the hacker to go through to gain control of your domain. Unless you're a prime target, they're more likely to move on to easier prey.
Mixed-bag news: It's likely that Google is the registant of your domain. This is a common thing done by web hosting services that offer to register your domain for you. This means that GoDaddy likely has no idea what your GoogleApps passwords are. Which means, that a hacker wouldn't either. Of course, if you were the registrant, you'd be smart and setup different passwords anyway, right!? Which brings me to...
The not so great news: If Google is the actual registrant of your domain instead of you (highly likely); it means they, control your domain. It means that you have a lot of steps to go through to regain full control and ownership of your domain, move it to a different registrar (like EasyDNS or Namecheap), and make yourself the Registrant.
Something that may help further: This post is dated 2012; so I don't know how relevant that is for today's GoogleApps, but it outlines the steps the author went through to regain control of their domain. http://if.andonlyif.net/blog/2012/02/transferring-google-apps-domain-away-from-godaddy.html.
In reponse to Ramhound's suggestion, I'm copy-pasting the steps from the guy's site:
To get around this, the steps to transfer-out the domain are roughly:
- Log into the Google Apps control panel, go to Domain Settings -> Domain Names
- Log into GoDaddy ("Advanced DNS Settings") and disable Domain Locking
- Go to Domains by Proxy and first retrieve your username by looking up your domain name (using the email address you have on file for the domain, ie, the one used to register with Google Apps); then reset your password using that username.
- Log in to DBP and cancel domain privacy. If this is enabled, GoDaddy will prevent you from transferring out.
- Wait for domain privacy to be disabled, then go back to GoDaddy, and request authorization code.
- Use that authorization code to transfer to another registrar.