The Quiet Asset: Auditing Domain Ownership and Email Authentication Before It Costs You

Most UK SMEs treat their domain name as scenery. It sits behind the website, behind the email signatures, behind the invoices, and nobody in the business considers it an asset with a renewal date, an owner and an attack surface. Then a supplier's finance team receives a politely worded request to change bank details from an address that looks almost exactly like yours, and the conversation stops being about DNS.

The uncomfortable truth is that domain lapses and email spoofing are two expressions of the same neglect. Both thrive where ownership is assumed rather than documented. Both are cheap to prevent and expensive to discover.

Two failures, one neglected drawer

The first failure is administrative. A domain expires because the card paying for it belonged to someone who left, or because the renewal notice went to a mailbox hosted on the domain itself. The registrant then enters a grace period, and depending on the registry, a redemption phase with fees attached. If the name is released, it can be bought by anyone within minutes and used to resurrect your brand.

The second failure is technical. Your domain sends email without telling receiving servers which systems are permitted to send on its behalf. Spammers and fraudsters exploit that gap, and your customers' mail filters eventually learn to distrust anything from your name.

Neither failure is unusual. Both are preventable with a half-day of structured work.

Establish who actually controls the name

Begin at the registry, not the website. For a .uk name, Nominet's lookup will confirm the registrar and the registration status. For other suffixes, an RDAP query returns similar detail. What you are looking for is the registrar of record, the registrant organisation, and whether the domain is locked against unauthorised transfer.

Then answer a harder question: who holds the login to that registrar account? In too many SMEs the answer is a former employee, a web designer who has since rebranded, or a shared mailbox nobody monitors. If the login uses an email address on the same domain, you have created a circular dependency that fails at precisely the wrong moment.

Record, in writing:

• the registrar, account holder and billing contact
• the registrant email address and who can access it
• whether multi-factor authentication protects the account
• the transfer lock status and where the authorisation code is stored
• the nameservers in use and which supplier operates them

Move registrar and DNS credentials into a controlled password manager with at least two named custodians. Where a supplier holds them, ask for delegated access rather than shared logins.

Make renewal a control, not a memory

Auto-renew is useful but not sufficient. Cards expire, and a single failed payment can start a countdown that nobody watches. Set renewal dates in the same calendar the finance team already respects, with an alert ninety days out and a second at thirty.

Consider the registrar's own lock and, where offered, a registry-level lock. Confirm that the contact email for renewal notices is a mailbox independent of the domain itself. That single change removes the most common cause of silent expiry.

Document the recovery path too. If the domain lapses, who is authorised to pay the redemption fee, and up to what amount? A pre-agreed threshold turns a panicked afternoon into a fifteen-minute decision.

The authentication trio

Email authentication rests on three records that work together, and a fourth that tells receiving servers what to do when they disagree.

SPF lists the servers permitted to send mail for the domain. It is a TXT record, it is limited to ten DNS lookups, and it should end with a qualifier that fails rather than soft-fails. Many SMEs still carry records inherited from marketing platforms they no longer use, which push the lookup count over the limit and cause a permanent error.

DKIM adds a cryptographic signature. Check that signing is active on your primary mail route, that the selector is documented, and that key rotation is somebody's job rather than an annual surprise. A 2048-bit key is the sensible baseline.

DMARC publishes a policy and a reporting address. Start at monitoring, read the aggregate reports for a fortnight, then move to quarantine and finally to rejection. Insist on a subdomain policy as well; attackers frequently spoof a subdomain precisely because the parent is protected.

Reports, subdomains and the long tail

Aggregate reports are dense XML files. Use a DMARC analysis service, or your IT partner's tooling, to see which sources are sending as you and whether they align. Alignment matters more than raw pass rates: a message can pass SPF and still fail DMARC if the envelope domain does not match the visible From address.

While you are in the DNS console, take an inventory of subdomains. Forgotten staging environments and marketing microsites often send mail nobody has authenticated. Check for a CAA record restricting which certificate authorities may issue for the domain, and consider DNSSEC if your registrar supports it cleanly.

Finally, decide whether to register defensive variants of your name. For most SMEs the answer is a short list of obvious lookalikes and the .co.uk or .com counterpart, not an unlimited portfolio.

What good looks like on one page

The audit should end with a document a non-technical director can read in five minutes: the asset, the owner, the renewal date, the recovery route, the authentication posture and the date of the next review. That page is what you produce to an insurer, a new managing director, or an acquirer conducting due diligence.

A domain is not an IT curiosity. It is the name your business trades under, and it deserves the same discipline as a bank mandate. The work takes less time than the incident it prevents.