Three myths about domain management

Most teams know this matters. Fewer have decided who owns it. A few things about domain management that get repeated more often than they get checked.

The realistic threat for most small businesses is automated and opportunistic, not targeted. Write the reasoning down alongside the decision, because the reasoning is what changes first.

“It only matters for big sites”

An expired domain is a self-inflicted outage. There is a version of this that is over-engineered, and it is worth avoiding. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

“We can deal with it after launch”

Sometimes true, usually expensive. This is the sort of thing that compounds, quietly, in both directions.

“Our platform handles it”

Registrar access deserves the strongest protection you have. Getting it slightly wrong is survivable. Ignoring it entirely is not. The teams that stay on top of it are the ones who put it on a calendar rather than a wish list.

The short version

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about domain management before you move on:

• Someone can say what the current setup is without going to look
• Auto-renew and keep the contact address current — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If you are not sure where your systems currently stand on this, it takes us about an hour to find out.