A short guide to domain management

We end up explaining this on discovery calls often enough that it deserved writing down. Everything we would tell a client about domain management in the time it takes to drink a coffee.

The cheapest security work is the boring kind done on a schedule. It is the sort of thing that looks like polish right up until it costs you an enquiry.

The reason this keeps coming up

An expired domain is a self-inflicted outage. Where this goes wrong is almost never a lack of knowledge. Write the reasoning down alongside the decision, because the reasoning is what changes first.

How to approach it

Auto-renew and keep the contact address current. The reasoning matters more than the rule, because the rule has exceptions. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.

Warning signs

Registrar access deserves the strongest protection you have. It is worth being explicit about, because assumptions differ quietly. Assume whoever inherits this will have half your context and none of your patience.

How to tell if yours is fine

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about domain management before you move on:

• Someone can say what the current setup is without going to look
• Registrar access deserves the strongest protection you have — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Worth checking on your own setup before it becomes someone else's problem to fix.