What to ask your agency about domain management

We end up explaining this on discovery calls often enough that it deserved writing down. If you are briefing an agency or a freelancer on domain management, these questions are worth asking early.

The cheapest security work is the boring kind done on a schedule. It is the sort of thing that looks like polish right up until it costs you an enquiry.

Questions worth asking

• Who will actually do this work, and have they done it before?
• How will we know afterwards whether it worked?
• What happens if it needs changing in a year?
• What are you assuming that we have not confirmed?

What a good answer sounds like

An expired domain is a self-inflicted outage. This is the sort of thing that compounds, quietly, in both directions. Doing this properly once is usually cheaper than doing it approximately three times.

Registrar access deserves the strongest protection you have. The reasoning matters more than the rule, because the rule has exceptions. Assume whoever inherits this will have half your context and none of your patience.

How to tell if yours is fine

Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about domain management before you move on:

• Someone can say what the current setup is without going to look
• Auto-renew and keep the contact address current — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Most of the value here comes from doing the first two things, not all of them.