Once a year, review every domain you own: who holds the registrar account, when each domain expires, which DNS records are stale, whether email authentication is in place and who can change records. Domains underpin email, sign in and trust, so a mistake here is large.
Registrar account
- List every domain you own, including old campaign domains, defensive variants and domains bought by individuals on personal cards.
- Company owned account with a role mailbox as contact, not one person's address.
- Multi factor authentication with a hardware key or passkey for every user, and at least two trusted administrators.
- Registrar lock on, and transfer authorisation codes kept private.
- Auto renew on, with a payment method that does not expire this year, and renewal notices sent to a monitored mailbox.
- Contact details correct. Out of date contacts mean you miss expiry and transfer notices.
DNS records
- Export the full record set for each domain.
- For each record, name the service and the owner. If nobody can, investigate.
- Remove records pointing to services you no longer use. A record that points to a deleted cloud resource or hosted service can allow someone else to claim that name and serve content from your domain.
- Check for wildcard records that cover more than intended.
- Limit who can edit DNS, and log changes. Consider requiring review for changes to mail and root records.
Email authentication
Check that SPF, DKIM and DMARC are present and correct for each domain that sends mail. Keep the SPF list to the senders you actually use. For domains that never send mail, publish records that say so. Review DMARC reports and move towards an enforcing policy at a pace you can manage.
Certificates and trust
Check that certificates renew automatically and that alerts exist for failures. Consider certificate authority authorisation records so that only chosen authorities can issue for your domain. Review certificate transparency logs for certificates you did not request.
Look for lookalikes
Search for domains that resemble yours, especially ones with active mail records. Decide which defensive registrations are worthwhile, and have a process for reporting abuse.
Record the outcome
Update a simple register: domain, purpose, owner, expiry, status. Set reminders ninety days before each expiry.
Put the review on the calendar, and give it a named owner. Domain mistakes tend to be quiet until they are not: a lapsed renewal, a record pointing at nothing, a former employee still listed as administrator. A thirty minute review each year, plus alerts for expiry and unexpected record changes, handles most of the risk for most companies.
Quick check
Why remove old DNS records?
A record pointing at a resource you no longer control can be taken over, letting someone else publish under your name.
Do parked domains need email records?
Yes. Publish records stating that no mail is sent, so they cannot be used to spoof you.
Last reviewed: 19 October 2026.
