Domain renewal, registrar lock and DNS ownership hygiene

Goal

Never lose a domain to an administrative failure, and be able to prove and exercise ownership when a registrar, an employee or a payment method changes.

Prerequisites

A list of every domain the organisation uses (including typo and legacy domains), access to each registrar account, and a mailbox that does not depend on any of those domains.

Steps

1. Inventory: for each domain record registrar, expiry date, registrant contact, name servers and login holder. Read the authoritative view from RDAP; RFC 9083 defines the domain response with an events array whose eventAction values include registration, expiration and last changed, and a status array.
2. Set the client locks. RFC 5731 defines the EPP status values: with clientTransferProhibited or serverTransferProhibited, requests to transfer the object must be rejected; clientUpdateProhibited and clientDeleteProhibited reject updates and deletion; clientHold stops delegation from being published. Registrars expose the client-side ones as "lock" switches; keep transfer, update and delete locks on and unlock only for a planned change.
3. Move the registrant and account contact to an address on a different domain, and add a second contact; a reminder sent to admin@example.com after example.com stops resolving reaches nobody.
4. Enable auto-renewal with a payment method that has an owner and an expiry date in the inventory, and renew for several years where the registry allows it.
5. Put the expiry dates in a calendar that the team owns, independent of registrar mail. ICANN's Expired Registration Recovery Policy requires registrars to send reminders about one month and one week before expiry, but the policy also allows registrars to delete registrations after expiry and requires them to interrupt the DNS resolution path first: from expiry until deletion if they delete within eight days, otherwise for at least the last eight consecutive days in which the name is still renewable. A site that stops resolving around its expiry date is therefore the last warning, not a DNS fault. gTLD registries must offer a 30-day Redemption Grace Period immediately after deletion, during which the deleted registration may be restored.
6. Protect the registrar account: a password from the secrets store, two-factor authentication, and an access list reviewed when someone leaves.
7. Quarterly, re-read RDAP for every domain and compare expiry, status and name servers with the inventory.

Expected result

Every domain has a known expiry far ahead, locks set, contacts that survive an outage of the domain itself, and a record of who can act on it.

Limits and test basis

The policy citations apply to gTLDs under ICANN contracts; country-code registries have their own rules and grace periods. Fees and contractual terms are out of scope. No incidents or figures are claimed.