How to Protect Your Domain Name

How a domain is actually lost

Lock the domain at the registrar, put two-factor authentication on the account that holds it, keep the registrant email off the domain itself, and let auto-renew run on a card that does not expire. Those four moves stop the expiry and account-takeover cases that account for most lost domains.

Real theft is rare. Most domains change hands because nobody renewed them, or because somebody logged in as the owner. Four routes cover almost every case, and each one has a free fix.

Everything else, including a lookalike domain selling your brand's products, is impersonation rather than theft. It is worth handling, but it does not put your site offline.

The four settings that stop most of it

Do these four before anything else. They take about twenty minutes and cost nothing beyond the registration you already pay.

1. Check that the registrant is you or your company, with your own email. A developer or agency listed as registrant can hold the name after a falling out.
2. Turn on the registrar lock. The domain status should read clientTransferProhibited in a WHOIS lookup.
3. Turn on two-factor authentication for the registrar account, using an authenticator app rather than SMS where it is offered.
4. Turn on auto-renew and register for more than one year if the registrar allows it. Two years removes one renewal cycle from the risk list.

You know the settings took when a public WHOIS lookup shows clientTransferProhibited, the registrant organisation is yours, and the expiry date is at least a year away. Anything less means one step did not save.

Turn on the lock, privacy and auto-renew

All three live in the domain control panel at the registrar, not in cPanel. The hosting panel manages the website; the registrar manages the name.

1. Sign in to the registrar, open the domain list and select the domain.
2. Find the transfer lock switch, usually labelled Domain Lock or Transfer Lock, and set it to on.
3. Turn on WHOIS privacy if the extension allows it. Most gTLDs do; some country extensions restrict it and offer a proxy instead, so read what your registrar shows for your TLD.
4. Turn on auto-renew, confirm the card on file, and add a second contact email you control.
5. Run a WHOIS lookup from outside your account to confirm the status line and the expiry date.

WHOIS privacy does not protect the domain. It stops your home address and phone number being scraped from a public database, which cuts the spam and the convincing phishing call that follows it. Keep it on, but do not mistake it for the lock.

Treat the registrant email as the master key

Whoever reads the registrant mailbox can usually reset the registrar password. That makes the mailbox more important than the domain password itself.

• Register with a mailbox that is not on the domain, so losing the domain does not lock you out of the recovery email.
• Put 2FA on that mailbox before you put it anywhere near a registrar.
• Use a role address such as domains@yourcompany.com for the business contact, not a personal one that leaves with an employee.
• Give staff delegated access from inside the registrar account instead of sharing the password.
• Keep the recovery codes offline. A printed sheet in a drawer beats a note in the same inbox.

A password manager makes the unique-password rule practical. The one password you memorise should be the vault, not the registrar.

DNS is the second door into the domain

An attacker who cannot move the domain can still move the traffic. The DNS account is the one to harden after the registrar account.

• Turn on 2FA at the DNS provider, whether that is the registrar, Cloudflare or the host.
• Switch on change alerts so an edit to an A or MX record emails you.
• Delete dangling records, especially a CNAME pointing at a service you cancelled, because that is how subdomain takeover happens.
• Publish SPF, DKIM and DMARC so nobody can send mail as your domain, which is the most common brand attack after a lookalike registration.
• Enable DNSSEC where the registrar and the DNS provider both support it. If only one does, leave it off rather than half-configure it.

The DNS records explained page covers what each record does if any of those names are new to you.

What happens after the expiry date

An expired domain is not released on the day it expires. For .com and most gTLDs there is a grace window, then a paid redemption window, then a short delete window, and only after that does the name go back to the market.

Windows vary by extension and registry; country-code domains such as .in follow their own registry policy. Treat the days as the shape of the process, not a promise.

The recovery path is the registrar's support desk, not a broker who emails you offering to buy it back. If the domain has already been re-registered by someone else, stop negotiating and gather evidence: invoices, the WHOIS history, and the dates of your last renewal.

If the name is taken or your brand is copied

A trademark gives you a route that a registration alone does not. For gTLDs, the Uniform Domain-Name Dispute-Resolution Policy handles cases where a name was registered and used in bad faith; for .in, the registry runs its own dispute process.

• Register the obvious lookalikes yourself only if they matter commercially. It is cheaper than a dispute and stops the obvious phishing domain.
• Keep the trademark registration certificate number handy; a dispute costs less when the right is documented.
• Report a hijack to the registrar first and to CERT-In if the site is being used to defraud your customers.
• Set up a free alert for the brand string so a new lookalike surfaces in days, not after a customer complains.

WebJi® registers and renews domains from the same billing account you use for hosting, and the registrar lock guide covers the transfer protection in more detail. Prices and extensions are on domain registration in India, and a name bought elsewhere can be moved with domain transfer when it suits you.