Protect your domain from expiry, theft and hijacking

The short version

• Auto-renew on, with a payment card that won’t expire soon, and renewal emails going to an address someone reads.
• Registrar account secured: your own login, two-step sign-in, and a recovery email that doesn’t depend on the domain itself.
• Transfer lock on. At ICANN Lookup, the status should include clientTransferProhibited.
• DNSSEC if your DNS host and registrar make it easy.
• Unused domains with records that tell mail servers to reject email sent in their name.

Ownership comes first. If the domain isn’t in your business’s name, start with our answer on who should own your domain.

How do I lock it down, step by step?

1. Find the registrar and check the dates

Look up your domain at ICANN Lookup. Note the registrar, the expiry date and the Domain Status lines. Our help page on who owns your domain and who to call explains the result.

2. Make renewal automatic

1. Sign in to the registrar and turn on auto-renew.
2. Check the payment card on file and its expiry date. A declined or expired card is a common reason auto-renew quietly fails, and a lapsed domain takes the site and email offline with it.
3. Consider renewing for several years at once. It’s one less yearly event to miss.
4. Put the expiry date in a shared calendar anyway, with a reminder a month ahead, or use a monitor. See uptime, SSL and domain monitoring.

If you get a renewal letter or email, check it’s from your actual registrar before paying. ICANN’s registrant guidance notes ICANN itself never sends renewal notices. Our help page on whether a renewal notice is real covers the common scams.

3. Secure the registrar account

ICANN’s guidance recommends:

• Multi-factor authentication on the registrar account.
• A strong, unique password kept in a password manager.
• An account email that’s different from the one in your domain’s registration data, so you can still prove you’re the holder if the account is taken over.

Also make sure the account email isn’t only on the domain itself. If the domain lapses, email on that domain stops too, and you can’t receive the registrar’s warnings. Give each person who needs access their own login if the registrar supports it. Our answers on two-factor authentication and business passwords cover the habits.

4. Turn on the transfer lock

Ask your registrar to turn on its domain lock, sometimes called registrar lock or transfer lock. ICANN’s status code page explains what you’ll then see:

• clientTransferProhibited: the domain can’t be moved to another registrar.
• clientUpdateProhibited: its details can’t be changed.
• clientDeleteProhibited: it can’t be deleted.

Most registrars offer at least the transfer lock. You’ll need to turn it off yourself before any planned transfer; see transferring your domain.

For a domain the business really can’t lose, ask about registry lock. ICANN describes it as an extra layer some registries offer, which sets server statuses that take more steps to change. It usually costs extra.

5. Consider DNSSEC

DNSSEC adds digital signatures to your DNS so that tampered answers are rejected. ICANN’s DNSSEC page explains why it matters. It needs two parts: your DNS host signs the zone, and your registrar publishes a DS record.

On Cloudflare, it’s DNS, then Settings, then Enable DNSSEC, then add the DS record it shows at your registrar, per Cloudflare’s DNSSEC page. Cloudflare Registrar adds the DS record for you.

The big warning: changing DNS hosts on a DNSSEC domain has to happen in a set order. Do it out of order and your website and email can stop working for many visitors. Cloudflare’s DNSSEC page gives the standard order:

1. Remove the DS record at your registrar. Leave DNSSEC signing switched on at your current DNS host for now.
2. Wait for the old DS record to expire everywhere. Cloudflare says this is commonly 24 to 48 hours. Whoever manages your DNS can confirm it’s gone with a lookup such as dig DS yourbusiness.com.
3. Only then change the name servers to the new DNS host, and turn off signing at the old one.
4. Wait for the change to settle, then turn on DNSSEC at the new host and add its new DS record at the registrar.

Change name servers while the old DS record is still cached, and Cloudflare warns that checking resolvers return errors (SERVFAIL), so the domain fails to load for anyone using them. Some DNS hosts support a multi-signer migration that avoids the gap without DNSSEC.

Stop point: if you’re not sure which company is your DNS host, or you can’t see the DS record at your registrar, don’t change anything. Ask your DNS administrator, host or registrar to handle the move. Write this order into your notes so whoever moves DNS next knows.

6. Protect domains you don’t use

Old domains, misspellings and other extensions you own can still be used to send fake email. Microsoft’s SPF page suggests v=spf1 -all for domains that never send mail, and a DMARC record of v=DMARC1; p=reject; asks receiving servers to reject mail that fails the check. These records don’t stop anyone sending a fake message. They tell the receiving mail server what to do with it, and most large providers follow them, but each server decides for itself. Redirect their web traffic to your main site with our help page on pointing another domain at your website.

Why does it matter?

Your domain carries your website, your email and every link and listing that points to you. Lose it, to expiry or to someone who got into the registrar account, and all of those stop at once. Getting it back, if it’s possible at all, is slow. Our answer on what happens when a domain expires explains the grace periods.

What are the common mistakes?

• Auto-renew on, card expired.
• The registrar account in a former employee’s personal email.
• Renewal notices going to an address on the domain that’s about to expire.
• A domain registered through a chain of resellers, so nobody can tell who really holds it. This often happens after resellers are bought out. Moving to a registrar you deal with directly avoids it.
• Changing contact details just before a transfer. Some registrars lock transfers for 60 days after an owner’s contact details change, which can delay a planned move.
• Turning on DNSSEC and forgetting it, then changing DNS hosts without removing the DS record first and waiting.

What if something already went wrong?

• The domain expired: renew it at the registrar right away. See what happens if my domain name expires.
• You can’t get into the registrar account: use its recovery process, with proof the business holds the domain. Don’t create a new registration somewhere else.
• Someone changed your DNS or moved the domain: contact the registrar’s abuse or security team at once, and change every related password from a trusted device.

How much does it cost, and how long does it take?

Auto-renew, account security, the transfer lock and DNSSEC are usually free. Registry lock and multi-year renewals cost extra, priced by the registrar. Working through this guide takes about an hour.

How does E-3 handle this?

When we manage a domain, it is registered to the client, not to us. For the sites we look after, our monitoring tracks domain renewal dates, so an upcoming renewal is visible before it runs out. Before we change DNS, we save the existing records. Not sure where your domain stands? Our free website check is a good first step.

Related questions

• Who should own my business domain name?
• What happens if my domain name expires?
• How do I transfer my domain to another registrar?
• How do I change DNS records without breaking my email?
• Back to the complete guide to website basics

Sources

1. Do you have a domain name? Here's what you need to know (ICANN blog)
2. EPP status codes: what do they mean, and why should I know? (ICANN)
3. DNSSEC: what is it and why is it important? (ICANN)
4. DNSSEC (Cloudflare DNS docs)
5. Migrate DNSSEC with multi-signer setups (Cloudflare DNS docs)
6. Set up SPF to identify valid email sources for your Microsoft 365 domain: parked domains (Microsoft Learn)