Your website can disappear even when the web server is working perfectly. If the domain name expires, is transferred away, or has its DNS records changed by an attacker, customers may lose the website and email at the same time. For a small business, that can mean missed appointments, bounced invoices, failed password resets, and customers wondering whether the company has closed.
The expensive part is not the annual domain fee. It is the concentration of control: one registrar account can determine where the company’s website and email point. This guide shows how to audit that account before a forgotten renewal or hijacked login becomes an outage.
First, know what you are protecting
- Registrar: the company where the domain is registered and renewed.
- Registry: the operator responsible for the top-level domain, such as a particular “dot” extension.
- DNS host: the service publishing records that direct web, email, and other traffic. It may be the registrar, web host, Microsoft 365 provider, or a separate DNS company.
- Web host: the server or platform holding the website.
- Email provider: Microsoft 365, Google Workspace, or another mail service.
These may be four separate companies. Paying the web-hosting bill does not necessarily renew the domain. Likewise, renewing the domain does not repair incorrect DNS records or an expired Microsoft 365 subscription.
Who is affected—and who is not?
You should run this audit if you own a business website, use email at your own domain, manage a nonprofit or community site, or rely on a domain for remote access, payment links, or customer portals. It is especially important when the domain was originally purchased by a former employee, freelance designer, relative, or previous IT company.
This is not the same problem as a single computer losing internet access, a website plugin failing, or an email mailbox reaching its storage limit. Those faults can resemble a domain outage, but they do not call for changing registrar ownership or nameservers. Diagnose before editing DNS.
The 30-minute domain continuity audit
1. Identify the real registrar from a trusted path
Start with your existing records, accounting statements, and bookmarked vendor portal—not a renewal link in an unexpected email. Record the registrar’s name, the domain, the expiration date shown inside the authenticated account, and the account owner. If you cannot identify the registrar, use ICANN’s public registration-data lookup as a starting point, then navigate to the registrar independently.
Stop condition: if the domain is inside an unknown person’s account, do not create a second registration or casually change nameservers. Preserve invoices, contracts, and prior correspondence, then begin an ownership transfer with the current registrar and authorized business owner.
2. Verify the registrant and recovery contacts
Confirm that the business controls the registrant account, recovery email, recovery phone, and payment method. Use a role-based address that the organization can retain, with a second authorized person documented for continuity.
Avoid a circular dependency: if the registrar can only send password resets to an address at the very domain that is down, recovery becomes harder. Add an approved external recovery method where the registrar supports it, and protect that external account just as carefully.
3. Turn on auto-renew—but do not treat it as a guarantee
Enable automatic renewal and verify the payment method’s expiration date. Then add independent calendar reminders 60 and 30 days before the domain expires. Check renewal notices rather than assuming a stored card worked.
ICANN explains that renewal options after expiration vary by registrar and domain type. A domain may enter post-expiration or redemption processes, but those are recovery paths—not a continuity plan. Services can be interrupted, extra fees may apply, and waiting can eventually risk losing the name.
4. Protect the registrar account with strong MFA
Use a unique password stored in a reputable password manager and enable multifactor authentication. CISA specifically recommends MFA on domain-registrar accounts or other systems that can modify DNS. Prefer a phishing-resistant security key or passkey when offered; an authenticator app is generally better than relying only on SMS.
Save recovery codes in an approved offline or access-controlled location. Do not keep the only copy inside the same mailbox protected by that account.
5. Enable the appropriate domain lock
Confirm that the ordinary registrar transfer lock is enabled unless a legitimate transfer is in progress. Some registrars or registries offer stronger registry-lock services that require extra verification before high-risk changes. Availability and cost vary.
Good: a lock adds friction to unauthorized transfers. Bad: it does not replace MFA, correct ownership, renewal, or DNS monitoring. Also document how authorized staff can remove the lock during a planned transfer.
6. Record a clean DNS baseline
Export the current DNS zone if the provider allows it. At minimum, record the authoritative nameservers and the important A/AAAA, CNAME, MX, TXT, and CAA records, along with the date and responsible vendor. Store this inventory somewhere that remains available if the domain or normal cloud account is unavailable.
CISA recommends reviewing public domain records and verifying that nameserver delegations point to the intended DNS servers. For business email, also maintain SPF, DKIM, and DMARC deliberately; our email-authentication checklist explains what each record does.
7. Turn on change alerts and test the response path
Enable registrar alerts for logins, contact changes, DNS changes, transfer requests, and renewal failures. Send them to more than one accountable person when policy permits. Then test the process safely: confirm that both people can find the registrar, escalation contacts, DNS baseline, and recovery-code location—without actually changing production DNS.
Add the registrar and DNS provider to a one-page emergency record. The IT Guys has a separate guide for building a technology emergency sheet.
Two examples: harmless warning versus costly wrong turn
Harmless warning: the owner receives a renewal reminder, navigates to the registrar through a saved bookmark, sees that auto-renew is active, and verifies the payment method. No DNS changes are needed.
Costly wrong turn: an employee clicks an urgent “domain suspended” email, signs into a fake registrar page, and approves an MFA prompt. The attacker changes nameservers. The website and mail may then be redirected even though both hosting subscriptions are paid. The correct first moves are to contact the registrar through a known channel, secure the account and recovery email, preserve alerts and change records, restore the verified DNS baseline, and check for unauthorized certificates or email-routing changes—not to rebuild every office PC.
If the website and email suddenly stop together
- Preserve evidence. Screenshot browser errors, bounced-mail messages, registrar alerts, and timestamps.
- Check scope from another connection. Test the website and email from a phone on cellular data. Do not rely on one office network.
- Verify account security. Use a known registrar URL. Check recent logins, recovery-contact changes, renewal status, nameservers, transfer status, and DNS edits.
- Secure the control points. If compromise is suspected, contact the registrar’s security channel, change the registrar and recovery-email credentials from a trusted device, revoke unknown sessions, and re-establish MFA.
- Compare DNS to the saved baseline. Restore records only when their correct values and owners are known. Guessing at MX or nameserver values can prolong the outage.
- Notify affected providers. The web host, email provider, certificate authority, cyber-insurance contact, and legal or incident-response team may each have a role.
Do not transfer the domain, delete the DNS zone, or replace nameservers during a live incident merely to “try something.” Those state-changing actions can erase evidence, create additional delays, and make rollback harder.
FAQ
Is domain privacy the same as domain security?
No. Privacy or proxy services can reduce public exposure of registration contact data. They do not renew the domain, secure the account, or prevent DNS changes.
Will auto-renew prevent every expiration?
No. Cards expire, banks decline charges, account contacts become outdated, and renewal settings can change. Auto-renew plus independent reminders and accountable ownership is safer.
Should the web designer own the domain?
The business should retain documented control of its domain, even when a trusted designer or IT provider manages the technical work. Vendor access should be authorized, limited, reviewable, and recoverable.
Does a registrar lock stop DNS hijacking?
Not by itself. A transfer lock helps prevent movement to another registrar, but a compromised account may still allow DNS or contact changes depending on the provider. Use MFA, alerts, least-privilege access, and a verified baseline too.
How often should this be checked?
Review it at least quarterly and whenever an owner, employee, designer, MSP, payment card, email system, DNS host, or registrar changes. Also review it before hurricane season or any period when key staff may be unavailable.
Your next action
Open your domain registrar through a known bookmark today. Verify the expiration date, business ownership, recovery contacts, auto-renew payment, MFA, transfer lock, nameservers, and alerts. Put the result in your emergency record and assign a second accountable reviewer.
If your domain is controlled by a former provider, the account owner is unclear, or you need help documenting website and email dependencies, review our small-business IT services or contact The IT Guys before making production changes.