Protect your domain from hijacking and accidental expiration

TL;DR — The fastest way to reduce the risk of domain theft or accidental expiration is to do four things at your domain registrar: turn on auto-renew, verify your payment method and contact email, enable registrar lock (prevents unauthorized transfers), and enable two-factor authentication (a second login check). If your domain supports it, also turn on registry lock and DNSSEC (protects DNS records from tampering). Reading time: ~5 min

Goal

When you finish, your domain will be set to auto-renew, protected by account-level two-factor authentication, locked against unauthorized transfer, and configured so renewal and security alerts go to an email address you actually monitor.

Prerequisites

• Your domain registrar login (the company where you pay for the domain each year)
• Permission to change domain settings in the registrar dashboard
• Access to the email inbox listed as the domain account contact and registrant contact
• A phone with an authenticator app installed, such as Google Authenticator, Microsoft Authenticator, or 1Password
• A valid payment method saved in your registrar account
• Your domain name written exactly, for example example.com
• Optional but recommended: access to your DNS provider dashboard (where DNS records are managed)

Steps

Step 1: Find the registrar that controls your domain

In your registrar dashboard, open the page that lists your domains. Common paths are:

Registrar dashboard → Domain List → click example.com

If you are not sure which company is your registrar, use an ICANN lookup in your browser and search for your domain:

https://lookup.icann.org/

What you should see when this works: a domain details page showing your domain name, expiration date, nameservers, and transfer/lock settings.

Step 2: Turn on auto-renew and confirm the payment method

Open your domain’s billing or renewal settings. Common paths are:

Registrar dashboard → Domain List → example.com → Renewal Settings → Auto-Renew → On
Registrar dashboard → Billing → Payment Methods → Add card or bank method

Set these literal values:

Auto-Renew: On
Renewal term: 1 year or the longest term your registrar allows
Default payment method: your current active card

What you should see when this works: the domain page shows Auto-Renew: On and a future expiration date with a valid payment method on file.

Step 3: Update the contact email to a monitored mailbox

Open the account profile and the domain contact section. Common paths are:

Registrar dashboard → Account Settings → Profile → Email
Registrar dashboard → Domain List → example.com → Contact Information

Set these literal values:

Account email: ops@yourcompany.com or another shared mailbox your team monitors
Registrant/Admin email: the same monitored mailbox, if your process allows it

If the registrar sends a verification email, click the verification link from that inbox.

What you should see when this works: the dashboard shows the new email address as verified, and you receive registrar notifications in that inbox.

Step 4: Enable two-factor authentication on the registrar account

Open your account security page. Common paths are:

Registrar dashboard → Account Settings → Security → Two-Factor Authentication → Enable

Choose these literal values if offered:

Method: Authenticator app
SMS: Off, unless authenticator app is unavailable
Backup codes: Generate and download

Scan the QR code with your authenticator app, then enter the 6-digit code shown in the app.

What you should see when this works: the security page shows Two-Factor Authentication: Enabled, and backup codes are available to download.

Step 5: Turn on registrar lock to block unauthorized transfers

Open the domain security or transfer section. Common paths are:

Registrar dashboard → Domain List → example.com → Domain Settings → Transfer Lock → On
Registrar dashboard → Domain List → example.com → Security → Registrar Lock → On

Set this literal value:

Transfer Lock / Registrar Lock: On

What you should see when this works: the domain page shows Transfer Lock: On, ClientTransferProhibited, or similar wording.

Step 6: Turn on registry lock if your registrar and TLD support it

Registry lock is a higher-level lock at the domain registry (the central operator for a domain ending like .com or .org). It usually requires manual approval before critical changes.

Open the domain security page and look for:

Registrar dashboard → Domain List → example.com → Security → Registry Lock → Enable

If the option exists, set this literal value:

Registry Lock: On

If your registrar does not offer it, skip this step.

What you should see when this works: the security page shows Registry Lock: Enabled or a support-confirmed status in your domain settings.

Step 7: Turn on DNSSEC at the registrar if your DNS provider supports it

DNSSEC (signs DNS answers so resolvers can detect tampering) helps protect visitors from forged DNS responses.

First, check whether your DNS provider shows a DNSSEC or DS record section. Common paths are:

DNS provider dashboard → DNS → DNSSEC
Registrar dashboard → Domain List → example.com → DNSSEC

If your DNS provider gives you DS record values, copy them exactly into the registrar’s DNSSEC section. The fields usually look like this:

Key Tag: 12345
Algorithm: 13
Digest Type: 2
Digest: 49FD46E6C4B45C55D4AC...

If your registrar has a single switch and manages DNS itself, use:

DNSSEC: On

What you should see when this works: the registrar shows DNSSEC enabled or a DS record saved without errors.

Step 8: Save recovery material somewhere your team can reach

In your password manager or internal documentation, save these exact items:

- Registrar name
- Registrar login URL
- Domain name
- Account email used for alerts
- 2FA recovery codes
- Billing owner and last 4 digits of payment method
- Whether Transfer Lock is On
- Whether Registry Lock is On
- Whether DNSSEC is On
- Domain expiration date

What you should see when this works: another authorized person on your team can find the registrar, sign in through the normal process, and confirm the protection settings without guessing.

[Team Inbox] <---- renewal alerts ---- [Registrar]
      ^                                  |
      |                                  v
2. monitor email                 1. auto-renew on
      |
      v
[Password Manager] <---- 4. recovery data ---- [Security Settings]
      ^                                         |
      |                                         v
3. 2FA backup codes                    [Lock + DNSSEC]

Verify it works

Check these items in the registrar dashboard for your domain:

Auto-Renew: On
Transfer Lock / Registrar Lock: On
Two-Factor Authentication: Enabled
Account email: Verified
Expiration date: future date you expect

If DNSSEC was enabled, verify it publicly in your browser with a DNS checker, or ask your DNS provider’s dashboard to confirm DNSSEC: Active.

If you are comfortable with command-line tools, you can also verify the transfer lock and expiration date with a WHOIS-style lookup service in your browser. Look for:

Domain Status: clientTransferProhibited
Registry Expiry Date: 2027-... or later

Expected result: all five checks above are visible, and renewal/security emails arrive in the monitored mailbox.

Common pitfalls

Auto-renew is on, but the card is expired

Mistake: turning on auto-renew without checking the saved payment method.

Symptom: the domain still expires, or you receive a failed renewal payment email.

Fix: open Registrar dashboard → Billing → Payment Methods and replace the expired card, then confirm it is the default payment method.

The alert email goes to a personal inbox nobody watches

Mistake: leaving the account or registrant email set to a former employee or a personal address.

Symptom: transfer alerts, verification requests, and renewal failures are missed.

Fix: open Account Settings → Profile → Email and Domain List → example.com → Contact Information, then change both to a monitored shared mailbox and complete email verification.

Two-factor authentication is enabled, but recovery codes were never saved

Mistake: enabling 2FA and skipping the backup codes.

Symptom: you get locked out when the phone is lost or replaced.

Fix: open Account Settings → Security → Two-Factor Authentication, regenerate backup codes if needed, and store them in your password manager.

DNSSEC is enabled at the registrar with the wrong DS record

Mistake: pasting old or incorrect DS record values after changing DNS providers.

Symptom: the domain becomes unreachable for some users even though DNS records look correct.

Fix: remove the bad DS record in the registrar dashboard, get the current DS values from the active DNS provider, and paste those exact values.

Transfer lock was turned off for a transfer and never turned back on

Mistake: unlocking the domain temporarily and leaving it unlocked.

Symptom: the domain page shows no transfer protection, or WHOIS-style status no longer shows clientTransferProhibited.

Fix: open Domain Settings → Transfer Lock and switch it back to On immediately after the legitimate transfer or update is complete.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.