Skip to content
Domain and DNS Ownership: A Hygiene Checklist for Mid-Market Owners and Operators

Domain and DNS Ownership: A Hygiene Checklist for Mid-Market Owners and Operators

2026-10-30 · By the Yellow Coop Team

Your website and your email both hang off one thing most companies treat like a parking permit: the domain name. The takeaway up front: know exactly who owns your domain, lock it, put strong login protection on every account that can change it, and review its DNS records on a schedule. It’s an afternoon of work that protects the address your business lives at.

Why a boring registrar account deserves attention

A few plain definitions first:

  • Registrar: the company you pay to hold your domain (example.com).
  • DNS (Domain Name System): the internet’s address book. DNS records tell the world where your website lives and which servers take your email.
  • Registrar lock: a status setting that blocks transfers or changes to your domain until someone deliberately unlocks it.

In January 2019, CISA issued Emergency Directive 19-01 after tracking a campaign of DNS infrastructure tampering that hit multiple federal agency domains. CISA described the pattern: attackers compromised credentials for an account that could change DNS records, altered records such as website (A), mail (MX), and name server (NS) entries to point at infrastructure they controlled, and then obtained valid encryption certificates for the victim’s domain. That let them decrypt redirected traffic without users seeing a browser warning.

The directive applied to federal agencies, and CISA has since closed it, saying its purposes were met. Its four required actions still make a good checklist: audit DNS records, change passwords on DNS accounts, add multi-factor authentication (MFA), and monitor certificate logs.

The checklist

1. Find out who actually owns the domain

ICANN’s Security and Stability Advisory Committee (SSAC), in its registrant guide SAC 044 (November 5, 2010), recommends registering domains in the name of the business and using role-based contacts, such as a “domain administrator” address, instead of one person’s name or inbox. The point is that responsibility can pass from one employee to a successor “without the threat of an employee claiming ownership of the domain registration.”

If your domain sits in a former marketing manager’s personal account, or with the web agency you fired in 2019, fix that first.

2. Lock the login and the domain

CISA’s directive required MFA on every account that can change DNS records, including registrar accounts, and recommended phishing-resistant options over text-message codes. If your registrar doesn’t offer MFA, CISA’s FAQ says to move the domain to one that does.

SAC 044 encourages registrants to make sure the transfer lock (clientTransferProhibited) and update lock (clientUpdateProhibited) are set. It also suggests considering a registry lock, an extra layer applied at the registry level, as a complement for your most important domains.

3. Make renewal someone’s job

Losing a domain to an expired credit card is the least glamorous outage there is. SAC 044 notes that a lapsed registration can be picked up by another party and may force “a potentially expensive and time-consuming dispute resolution process” to get it back.

For generic top-level domains like .com, ICANN’s Expired Registration Recovery Policy (updated February 21, 2024) requires registrars to send at least two reminders, roughly one month and one week before expiration, plus one more within five days after. Most gTLD registries (sponsored ones excepted) must also offer a 30-day Redemption Grace Period after deletion. Country-code domains can follow different rules, so check yours.

Reminders only help if a human reads them. The policy’s suggested best practices tell registrars to advise a secondary email contact that isn’t on the domain itself, since an expired domain can take its own email down with it. Turn on auto-renew, put the date on the finance calendar, and keep the card on file current.

4. Clean up dangling DNS records

NIST SP 800-81r3, the Secure Domain Name System (DNS) Deployment Guide (final March 2026), warns about two leftovers:

  • Dangling CNAME: a record pointing a subdomain (say, promo.example.com) at an outside service or domain you no longer control. NIST says attackers can register the abandoned target and make your subdomain resolve to their infrastructure.
  • Lame delegation: a subdomain still handed off to a DNS hosting provider after the contract lapses. NIST says this “can result in domain hijacking.”

NIST’s fix: review records regularly, delete CNAMEs you no longer need, and when you retire a service, remove the delegation as well as the zone data.

5. Watch for certificates you didn’t order

Certificate Transparency (CT) logs are public records of certificates issued for domains. CISA’s directive required agencies to monitor them for certificates they didn’t request; its FAQ notes free and paid monitoring services exist. An unexpected certificate for your domain is a smoke alarm worth hearing.

6. Add domains to offboarding

SAC 044 recommends that employee termination and transfer processes check whether the person has domain registration access, the same way you’d check bank access. When people with access change roles, issue new credentials and revoke the old ones.

A quarterly 30-minute review

Once a quarter, confirm the registrant name, contacts, expiration dates, locks, and MFA for every domain; read the DNS record list and ask “what is this for?” about anything unfamiliar; and check CT alerts and registrar change notices.

Conclusion

Your domain is a business asset nobody tracks until it breaks. Own it in the company’s name, lock it down, make renewal a named job, and prune old DNS records before someone else adopts them.

If you’d like help, Yellow Coop’s Operate work includes an inventory of systems, licenses, and contracts with owners and renewal dates, and our Secure work covers the security questions customers and insurers ask. You can get it as Virtual advisory hours or as a Fractional engagement of 1 to 4 days a week. Book a 20-minute call to talk it through.

Sources