Your domain name sits behind your website and every company email address. When it lapses, or its DNS records change unexpectedly, both can stop at the same time, and the first person to notice is often a client who cannot reach you. Keeping a domain safe is not complicated, but it needs someone accountable for it. Here is what good domain management covers, and how to know it is being done.
Why the domain matters more than the website
Your domain tells browsers where to find your website, and tells other mail systems where to deliver email sent to your staff.
If you use Microsoft 365, email depends on DNS records published for your domain: the MX record that routes incoming mail, and the SPF, DKIM and DMARC records that help other mail servers trust what you send. Your subscription can be paid up and working, but if the domain expires or those records change, mail stops arriving.
Someone who gains access to the domain's accounts may also be able to change those records, redirecting visitors or interfering with email. The accounts behind your domain deserve the same care as your Microsoft 365 admin accounts.
Two domains to look after, not one
Many firms in Hong Kong and Singapore hold a generic domain such as .com alongside a local one. They can sit with different companies under different rules, so both need the same care.
- Hong Kong: .hk domains are run by the Hong Kong Internet Registration Corporation (HKIRC). A .com.hk domain needs a Hong Kong business registration.
- Singapore: .sg domains are run by SGNIC. A .com.sg domain needs a Singapore-registered entity.
Because these local domains are tied to a registered business, their registration details need to stay in line with your company's current registration.
1. Renewal that never depends on one person
Most domain outages start with a renewal that nobody saw coming. Good practice is simple:
- Automatic renewal turned on, paid with a card the business maintains rather than one person's card.
- A reminder in a shared calendar a few weeks before the renewal date, and a check that the payment went through.
- Renewal notices sent to a business mailbox that someone reads, such as a shared mailbox in Microsoft 365, so they still arrive after a person leaves.
If a domain does expire, some have a grace or recovery period, but the length, cost and process vary. Renewing early is far easier.
2. Contact and recovery details that outlast staff changes
Security notices and transfer requests go to whatever address is on file. Use business-controlled addresses, and add a recovery method that still works if your email is down, such as a second address on a different domain, a phone number or recovery codes. If the domain lapses, recovery email sent to that domain will not arrive.
At least two trusted people should know which provider looks after the domain and how to reach them. Any logins belong in a company password manager, never in an email or shared document.
3. Accounts that are locked down
Whoever manages the registration and DNS, the accounts behind them should have:
- a unique password, stored in a password manager;
- multifactor authentication (MFA), using the strongest option offered;
- no access left for former employees or suppliers who no longer need it;
- alerts for DNS changes, transfers, contact updates and renewals, where offered;
- the transfer lock switched on, which registrars may call "Registrar Lock" or "Client Transfer Prohibited".
A transfer lock helps prevent an unauthorised transfer, but anyone who takes over the login may be able to remove it, so MFA and current recovery details matter just as much.
4. DNS that is managed and documented
The nameservers on the registration show which provider holds your DNS records: the registrar, a cloud DNS service or your web host. Those records control your website, email and the security settings other mail systems check, so changes should go through someone who knows what each record does and records what was changed and why.
The UK's National Cyber Security Centre recommends monitoring important DNS records for changes.
5. Monitoring that catches problems early
That monitoring can be automatic. For our clients we use DriftSensor, which checks your DNS records at short intervals, keeps a history of every change and alerts you by email or in Microsoft Teams when a record such as MX or SPF changes unexpectedly. It also watches the domain's expiry date and registrar details, so a lapsing renewal or an unexpected transfer is caught early. An unexplained change is often the first sign that something is wrong.
Know what is being done for you
If your IT provider manages your domains, you do not need to do any of this yourself. You should, however, know the essentials: which provider looks after the registration and DNS, when each domain renews, how changes are approved, and who to call if something looks wrong. A good provider confirms these in a short yearly review, tells you before anything changes, and includes the domain in the checklist when you change web agency or staff with access leave.
How Dual Layer IT can help
We look after domains and DNS for businesses in Hong Kong and Singapore, so none of the above depends on one person remembering it:
- Domain registration and transfers: we register new .com, .hk and .sg domains for your company and bring existing ones under our management.
- Domain management: renewals, contact details, transfer locks and access reviews, kept up to date when people join and leave.
- Premium DNS hosting: your DNS records hosted and managed alongside your Microsoft 365 and website settings.
- Domain and DNS drift monitoring: continuous monitoring through DriftSensor, with alerts when a DNS record changes, when the expiry date approaches or when registrar details change, plus regular checks of your SPF, DKIM, DMARC, DNSSEC and SSL settings.
Frequently asked questions
What happens if our domain expires?
Your website and email can stop working, often at the same time. Some domains have a grace period, but the rules and costs vary, so it is far better to renew automatically and monitor the expiry date.
Why can I not see our company's details in a public domain lookup?
Contact details are often hidden from public lookups for privacy. That is normal. The full registration details are held in the registrar account, and your provider can confirm them for you.
Will moving our DNS or registration to a new provider interrupt email?
It should not, as long as the DNS records are copied accurately and the change is planned. Your IT provider should check the website and email during and after the move.
Sources and further reading
- ICANN: Information for domain name registrants
- ICANN: About locked domains
- UK National Cyber Security Centre: Managing public domain names (PDF)
If you would like us to look after your domains, DNS hosting and monitoring, or simply check that your .com and local domains are set to renew, our IT infrastructure team can help. Talk to our team.
