Protecting your email domain: renewals, registrar lock and ownership
If your domain lapses or its registrar account is hijacked, your email stops or is stolen. The few settings that prevent it, and who should own the account.
On this page(10 sections)
- Why this is an email problem, not only a website problem
- Step 1: put the account in the company's name
- Step 2: protect the login
- Step 3: turn on the registrar lock
- Step 4: never let it expire
- Step 5: protect the DNS
- Step 6: protect the names around it
- If something already went wrong
- A one-page checklist
- Key takeaways
Everything about your company email rests on one thing that is easy to forget: you rent the domain, and the account that rents it controls your DNS. If the domain lapses, mail stops and the name can be bought by someone else. If the account is taken over, the thief can point your mail at their own server and read it.
Neither problem needs advanced tools to prevent. It takes about an hour of careful setup and a calendar reminder. This post lists the settings that matter, in order.
Why this is an email problem, not only a website problem
A website that goes down is visible. A domain that lapses can fail more quietly: new mail bounces, password-reset messages for every service tied to that address stop arriving, and customers see errors you cannot see. Worse, anyone who registers the expired name can start receiving mail sent to it, including reset links for accounts that used your address.
An attacker who gets into your registrar account does not need to touch your mail provider. They change the MX records, collect messages, and use reset links to take over other accounts. That is why the registrar login is as sensitive as your main admin password.
Step 1: put the account in the company's name
Check who owns the registrar account today.
- Use a role address you control, such as a company admin address on a different domain from the one being protected, so a locked-out domain cannot lock you out of its own account.
- Avoid a single person's personal login. If that person leaves or loses access, you lose the domain.
- Keep the contact details real. The registrant email receives renewal notices and transfer confirmations; if it points to a dead mailbox, you will not see them.
- Write down who can recover it: the second person who knows where the login lives, and where the recovery codes are kept. The same idea appears in our post on handing off an inbox.
Step 2: protect the login
- Turn on two-step sign-in, preferably with an app or a hardware key rather than text messages.
- Use a long, unique password stored in a password manager, not reused anywhere.
- Save the recovery codes somewhere offline.
- Review who has access. Remove former contractors and old users.
Our 2FA rollout guide covers how to bring a team along.
Step 3: turn on the registrar lock
Most registrars offer a transfer lock (sometimes called a registrar lock). It stops the domain being moved to another registrar without an extra step. Switch it on and leave it on, except in the moment you are deliberately moving the domain.
Some also offer a stronger lock that requires manual verification for changes to critical settings. If your registrar has one and the cost is reasonable for what the domain protects, consider it.
Also keep the transfer authorization code private. Treat it like a password.
Step 4: never let it expire
- Enable auto-renew and make sure the payment method is current.
- Renew for several years if the price is acceptable, since a longer term gives you more margin.
- Keep two payment methods where the registrar allows it, so one expired card does not stop the renewal.
- Add your own reminders 60, 30 and 7 days before the date, sent to two people. An auto-renew that fails on a stale card is a common cause of lost domains.
- Know the grace period. After expiry, most registrars allow a window to renew, often at a higher price, followed by a period when the domain cannot be used. Do not plan around it.
Our post on renewal reminder emails is about reminding your customers, but the habit is the same.
Step 5: protect the DNS
The records that make your email work live at your DNS host, which may or may not be the registrar. Whoever controls it controls your mail.
- Limit who can edit DNS to the people who need to.
- Turn on two-step sign-in there as well.
- Keep a copy of your current records, especially MX, SPF, DKIM and DMARC. A saved list makes recovery quick if something changes. See the email DNS reference.
- Set a calendar check to review the records every few months. The 30-minute authentication audit is a good routine.
Step 6: protect the names around it
Think about which other names matter:
- Variants and common typos of your main domain that could be used to impersonate you. See lookalike domain phishing.
- Old domains that still receive mail. If you stop using one, do not let it lapse while it is still printed on cards, in old emails or on accounts.
- Domains you own but do not send from. Publish records that say so; our post on locking down parked domains shows how.
If something already went wrong
The domain expired recently: renew immediately through the registrar; the redemption fee is cheaper than losing the name. Then check your records are intact and send a test.
You suspect a hijack: sign in, change the password, revoke other sessions, check the contact email and the DNS records, and compare MX and other records against your saved copy. Contact the registrar's support and, if mail was diverted, tell the people affected.
A former employee holds the account: ask for a transfer of ownership through the registrar's process and keep the evidence that you are the registrant.
A one-page checklist
- Account owned by the company, with a role address and a named backup person.
- Two-step sign-in, a strong password and saved recovery codes.
- Transfer lock on.
- Auto-renew on, a current payment method and reminders to two people.
- DNS access limited, with two-step sign-in and a saved copy of the records.
- A list of every domain the company owns and what each one is for.
Key takeaways
- Your domain is rented; lapse or hijack takes your email and your reset links with it.
- Own the registrar account as a company, protect the login and turn on the transfer lock.
- Use auto-renew, a valid card and independent reminders sent to two people.
- Keep a copy of your DNS records and limit who can edit them.
- List every domain you own and decide what to do with each.
Start with Koltrix
Your domain, one inbox, and an API that sends.
A team inbox where AI sorts and drafts (nothing is sent without your click), plus the transactional API and SMTP relay your product sends with. 7 days free, no card.
