Domain management for small teams

The gap between knowing this and actually doing it is where most teams lose ground. Most advice about domain management assumes a team that does not exist at your size. Here is the version that does not.

Security is a maintenance habit rather than a purchase, which is why it drifts. Write the reasoning down alongside the decision, because the reasoning is what changes first.

What to keep

An expired domain is a self-inflicted outage. It is worth being explicit about, because assumptions differ quietly. It rarely shows up as a line item, which is exactly why it slips.

What to drop

Process that exists to coordinate ten people is overhead when there are two of you. There is a version of this that is over-engineered, and it is worth avoiding.

Where to start

Registrar access deserves the strongest protection you have. The cost of getting this wrong is rarely visible on the day it happens. The practical test is whether someone new to the project could tell, in a minute, that it had been handled.

In practice

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about domain management before you move on:

• Someone can say what the current setup is without going to look
• Auto-renew and keep the contact address current — and you know whether that is true here
• There is a way to tell whether the last change to this helped

The point is not perfection, it is knowing which of these you have consciously chosen to skip.