Protecting your domain: auto-renew, registrar lock and alerts

Most domain losses are administrative, not dramatic. A card on file expired, a renewal notice went to a staff member who left, or the domain turned out to be registered in a former developer's personal account. Protecting your domain name is mostly a matter of five settings being right and one person knowing where they are.

This is a walk through those settings: ownership records, auto-renew that actually charges, a contact address you can still read, transfer locks, and alerts that reach a human being rather than an abandoned inbox.

First, confirm who the domain actually belongs to

Look up your own domain in a public WHOIS service and read the registrant organisation. For a business domain it should be your company's legal name, not an individual's, and not your web agency's.

Domains registered on a client's behalf by a developer or an employee are extremely common and cause real trouble later. The person leaves, the relationship ends, and the business finds it has no access to a name its entire identity depends on. If that is your situation, ask for the domain to be transferred into an account your company controls, ideally before your next renewal rather than during a dispute.

Privacy protection, which replaces your contact details in public records, is fine and often sensible. Just make sure the underlying registrant details held by the registrar are accurate, because those are the ones that matter for ownership and recovery.

Auto-renew is only as reliable as the payment behind it

Ticking auto-renew feels like the job is done. It is not, because the renewal still has to be paid on the day the registrar attempts it.

• Check that the card on file has not expired, and note that cards expire silently without anyone telling your registrar.
• If you pay by a recurring mandate or wallet balance, confirm the mandate is still active and the balance will cover the charge.
• Confirm auto-renew is enabled on each domain individually. An account-level default does not always apply to names added later.
• Use a company payment method rather than an employee's personal card, so a departure does not break the renewal.
• Read the renewal receipt when it arrives. No receipt is itself a signal worth investigating.

Registrars generally attempt the charge some days before expiry and retry a few times, then notify you when it fails. That notification is the one email you cannot afford to miss, which brings us to the contact address.

Keep the registrant email reachable and monitored

Do not use an address on the domain itself as your registrar contact. If the domain lapses or stops resolving, mail to that address stops too, and the warning about the problem is delivered into the problem.

Use a shared mailbox on a different domain, such as a free provider account owned by the business, and make sure at least two people can read it. Avoid a single person's address entirely; it is the most common single point of failure in the whole chain.

For generic extensions, registrars are also required to verify registrant contact details, and an unverified or bouncing address can lead to the domain being suspended even though it is paid for. Respond to those verification emails promptly rather than treating them as marketing.

Review the contact details annually, along with the phone number, since some registrar recovery processes fall back to it.

Transfer locks: cheap protection against the worst case

A registrar lock, which appears in WHOIS as a transfer-prohibited status, stops the domain being moved to another registrar without you first unlocking it. It is usually enabled by default, free, and one of the strongest protections available. Check it is on, and switch it back on after any legitimate transfer.

Two related mechanisms are worth knowing. The authorisation code, sometimes called an EPP code, is required to move a domain; treat it like a password and never share it casually or leave it in an old email thread. Separately, registries typically impose a transfer restriction for a period after a transfer or a change of registrant, which is a nuisance if you were planning a move, but useful as a brake against unauthorised changes.

For high-value names, some registrars offer a registry-level lock as a paid service. It requires an out-of-band confirmation before any change, which makes an unauthorised transfer very difficult. For most small businesses the standard lock plus good account security is proportionate, but if your domain is the entire business, ask about it.

Secure the account, not just the domain

Whoever controls your registrar account controls your domain, your email routing and, by extension, password resets for many other services. Treat it as your most sensitive login.

Enable two-factor authentication, preferably with an authenticator app rather than SMS. Use a unique password stored in a password manager. Keep the registrar account separate from staff logins that get shared around, and if your registrar supports sub-users with limited permissions, use those instead of handing out the master credentials.

Record where the account lives and who has access in the same document as your other critical credentials, so a single absence never blocks an urgent change.

Multi-year renewals and the calendar that backs them up

Renewing for several years at once removes the annual failure point and sometimes costs slightly less per year. It also signals stability. The trade-off is that a long gap between renewals is exactly when contact details and payment methods quietly go stale, so a multi-year registration still needs an annual review.

Alongside auto-renew, keep an independent reminder that does not depend on the registrar. A shared calendar entry ninety days before expiry, repeated at thirty days and again at seven, gives you time to act even if every automated email fails. Invite two people to the event.

If you manage several domains, keep a simple list with the name, registrar, expiry date, account owner and whether auto-renew and lock are on. Updating one row a year is easier than reconstructing the whole picture in an emergency.

A fifteen-minute domain audit

Work through this list today for every domain your business owns, including ones you only redirect:

1. Registrant organisation is your company's legal name
2. You can log in to the registrar account yourself
3. Two-factor authentication is enabled on that account
4. Auto-renew is on for this specific domain
5. The payment method on file is valid and not personal
6. The contact email is on a different domain and read by two people
7. Transfer lock shows as enabled in WHOIS
8. Expiry date is in a shared calendar with reminders
9. Nameserver settings match what you expect

Anything you cannot tick is a small task now and a crisis later.

Fix the weakest item on that list first

For most businesses the weakest item is the contact email or the ownership record, and both are straightforward to correct once someone decides to do it. Start there, then work down the rest of the audit at your own pace.

If your domains are scattered across registrars and old accounts, consolidating them is worth the effort. We handle transfers, renewals and ongoing management through our domain registration service, and you can ask an expert if you are unsure who currently holds a name.

Frequently asked questions

Should I keep my domain and hosting with the same company?

Either arrangement works. Keeping them together is simpler to manage; keeping them separate means a dispute or outage with one provider does not affect the other. What matters more is that the accounts are in your business's name with access you control.

Is WHOIS privacy protection worth paying for?

It reduces spam and keeps personal contact details out of public view, which most owners find worthwhile. It does not affect your ownership or renewal in any way, and the registrar still holds your real details.

Does a transfer lock stop me changing my own DNS or nameservers?

No. The lock only prevents the domain moving to a different registrar. You can still change nameservers, DNS records and contact details from within your registrar account as usual.

How do I check whether auto-renew is actually working?

Look for the renewal receipt in the year it should have charged, and verify the expiry date in a public WHOIS lookup rather than in the registrar dashboard alone. If the date has not moved forward, the renewal did not happen whatever the setting says.