The most expensive outages are often the simplest: expired domain, lapsed card, DNS edited by someone who left, TLS renewal that emailed a mailbox nobody reads.

Your homepage framework did not fail. Ownership of the name system failed.

Key and blank metal tag with indigo thread

If you do not hold the keys, you do not hold the site.

Inventory every public hostname

For each hostname:

  • Registrar account (org-owned email, 2FA — not a freelancer personal login)
  • DNS host (may differ from registrar)
  • TLS issuance path (CDN, load balancer, ACME)
  • Billing method (company card; alerts to ops + backup)
  • Expiry calendar with dual notification

Domain ownership diagram

Change control

DNS changes deserve production seriousness: ticket, dual review for apex/MX/TXT that affect mail and auth, rollback notes. Capture before/after. “Quick fix in the UI” is how mail breaks while the website “still works.”

Common landmines

  • Domain on an ex-employee personal registrar
  • Split-brain DNS (half the records in an abandoned host)
  • SPF/DKIM/DMARC drift breaking mail
  • Staging hostnames missing noindex but sharing parent cookies poorly
  • CAA records blocking the certificate issuer you switched to

Pair with post-launch ownership

Domains belong on the same ownership map as hosting and incidents. Renewals and access reviews are reliability work — not admin trivia you postpone until the reminder fails.

Closing

Put domains on the ownership map next to hosting. The brand name in the browser bar is infrastructure.

Need a domain/DNS ownership audit? Start a project inquiry with your public host list and who can log into the registrar today.

Registrar hygiene checklist

  • Org email as account owner (alias to multiple humans)
  • 2FA enforced for all users
  • Transfer lock enabled
  • WHOIS privacy consistent with policy
  • Auto-renew on; billing alerts to finance + eng
  • Recovery codes stored in company secret store

DNS record documentation

Keep a living table: host, type, value purpose, last change ticket. Especially document verification TXT records so nobody deletes the “mystery string” that keeps email or certificates alive.

Incident: domain expiry

Runbook steps: who notices, who pays, who updates DNS if registrar restores slowly, what status page copy to use. Practice once before you need it.

TLS

Know whether certificates are CDN-managed or origin-managed. Calendar renewals if not fully automated. Monitor expiry with the same seriousness as uptime.

Multi-cloud DNS

If marketing uses one DNS host and IT uses another for mail, document the split. The danger is two consoles both looking “complete” while the public view of the zone is a merge of neither.

Subdomains inventory

List every subdomain: www, app, api, staging, cdn, email-tracking, etc. Forgotten subdomains are takeover risks when services are cancelled but DNS remains.