Domain portfolios accumulate. A main domain, a few variants bought defensively, a campaign domain, a misspelling someone registered, a domain from a product that no longer exists. They sit across several registrars and several accounts, tracked — if at all — in a spreadsheet someone made once.
Then one expires. Usually the one that mattered.
Why the spreadsheet fails
It is never current. It records what was true when written. Domains get added and nobody updates it.
It does not raise alarms. A date in a cell does nothing. The renewal notice goes to whichever email was used at registration — frequently a personal address, frequently someone who has left.
It does not know what it is missing. The domains at risk are the ones not in it, because nobody knew they existed.
It does not record who controls what. Which account, which registrar, who has the password. This is what actually matters in an emergency.
What a lapse costs
An expired domain does not fail gracefully. The website stops. Email stops — which is usually worse, because mail sent to you silently fails and you do not know what you did not receive.
Recovery is possible during a grace period, usually at a penalty. After that the domain can be released, and a dropped domain with any history is frequently registered within minutes by someone who monitors expirations. Getting it back may be expensive or impossible.
Regaining control
1. Find everything
Check every registrar anyone might have used, ask everyone who might have registered something, and look at what actually resolves — DNS records for subdomains often reveal domains nobody remembered.
Expect to find more than expected, including at least one nobody can account for.
2. Consolidate into corporate accounts
Ideally one registrar, certainly accounts owned by the company with billing to a company method and contact details pointing at a shared mailbox rather than a person.
Transfers take a few days: unlock, get the authorisation code, initiate. Do them well before expiry — a transfer attempted in the final days is how domains lapse during the move.
3. Set alerts that do not depend on a person
Registrar notifications to a shared mailbox, plus independent monitoring that alerts on approaching expiry. The independent check matters: registrar emails get filtered, and a spam folder is where renewal notices go to die.
Auto-renew where you are certain you want to keep the domain, and a valid payment method on file. An auto-renew that fails because a card expired is not an auto-renew.
4. Lock what matters
Registrar lock on and two-factor authentication on the account. Domain hijacking is rare and catastrophic, and the defences are free.
5. Decide what to drop
Not every domain is worth keeping. Review annually and let go of the ones that serve no purpose. A smaller portfolio is easier to manage and less likely to contain the one nobody is watching.
Keep a register anyway
A spreadsheet is fine as a record — domain, registrar, expiry, owner, purpose. What it cannot be is the alerting mechanism. Combine a written register with automated alerts and the problem largely goes away.
Review it at a fixed point each year, ideally alongside whatever other annual renewals you check.
About the author. Kislay Chandan has worked with schools since 2014. Rather than gathering requirements from the outside, he worked inside a school to see what actually goes wrong day to day, and built what he found into the software. He still works with Shemrock Glitters in Patna — most changes to the product start with something that came up there.
Gallery
