New Domain Checklist: What to Do After You Buy a Domain

Buying a domain takes two minutes. The setup you skip in the first week is what causes trouble later: a registrar account taken over with a reused password, a domain suspended because nobody clicked a verification email, a renewal that failed on an expired card, or spammers sending "from" your brand-new name before you send anything yourself.

This checklist splits the work into what you must do on day one, whatever the domain is for, and what you should do before you rely on it for a website or email.

What to do right after buying a domain

These steps protect the registration itself. Skipping any of them can cost you the domain, and none takes more than a few minutes.

1. Lock down the registrar account

Whoever controls your registrar account controls the domain: they can change its nameservers, move it to another registrar, or let it lapse. Treat the login like your bank's.

• Use a unique, generated password stored in a password manager.
• Turn on two-factor authentication, with an authenticator app or security key rather than SMS where the registrar allows it.
• Use an account email address on a different domain. If the account email is [email protected] and that domain ever stops working, the password reset and renewal reminders go to an inbox you can't reach.

2. Verify the registrant email address

For generic TLDs such as .com, .net and .org, ICANN requires the registrar to verify the registrant's email address. Shortly after registering, you'll get a verification email. If it isn't confirmed within 15 days, the domain is suspended and stops resolving until you confirm. Many country-code TLDs have similar rules.

While you're there, check that the name and contact details are accurate. They're what the registrar uses to prove ownership in a dispute, and the email is where renewal and transfer notices go. Most registrars hide these details from public WHOIS automatically; confirm that privacy or redaction is switched on if you don't want them published.

3. Turn on auto-renew and note the expiry date

Expiry is the most common way people lose a domain they meant to keep. When it lapses, the website and email stop working, and if the grace and redemption periods pass, anyone can register it.

• Turn on auto-renew and check that the payment card won't expire before the renewal date.
• Consider registering for several years for an important domain. It's one less renewal that can fail.
• Put the expiry date in a calendar, with a reminder a month before.

A WHOIS lookup shows the expiry date and status straight from the registry, which is the date that counts, whatever your registrar's dashboard says.

4. Make sure the transfer lock is on

A transfer lock (the clientTransferProhibited status) stops the domain being moved to another registrar without you first unlocking it in your account. It's the main defence against domain theft. Most registrars turn it on by default, but not all, and some turn it off when you request a transfer code and never turn it back on.

Registries also block transfers for a short period after a new registration, which can make the lock look unnecessary at first. That block expires; the registrar lock doesn't. Check the domain's status in a WHOIS lookup: you want to see "client transfer prohibited".

5. Stop others sending email as your domain

A domain with no email records is an easy target for spoofing: anyone can send mail with your address in the From line, and receivers have nothing to check it against. That damages the domain's reputation before you've sent a single message. Publish these records now, even if you don't plan to send email from it yet.

If the domain won't send or receive email, publish records that say so:

example.com.         3600  IN  MX   0 .
example.com.         3600  IN  TXT  "v=spf1 -all"
_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=reject"

The null MX (0 .) tells senders the domain accepts no mail, v=spf1 -all says no server is allowed to send for it, and the DMARC policy tells receivers to reject anything that claims to be from it.

If the domain will send email, set up SPF, DKIM and DMARC with your mail provider before the first message goes out, and start with low volumes. Mail from a domain only days old is treated with suspicion, and some security filters block newly registered domains outright for their first few weeks. Our guide to SPF, DKIM and DMARC covers what each record does, and the SPF, DKIM and DMARC checker confirms they pass.

Should do before you rely on it

These steps are about running the domain well. A domain works without them, but each one closes a gap that tends to cause problems later.

6. Choose your DNS host and check the delegation

Your registrar's nameservers are fine to start with, but if you plan to use a different DNS provider, such as your host or a CDN, switch the nameservers now, before there are records and email to migrate. Then check that the registry lists the nameservers you expect and that every one of them answers for the zone. The nameserver check does both. If they disagree, see nameserver mismatches.

7. Point both the bare domain and www

Visitors type both example.com and www.example.com. Publish records for both, pick one as the main address, and redirect the other to it. Remember that the bare domain (the apex) can't be a CNAME; use your host's IP addresses, or an ALIAS or flattened record if your DNS provider offers one. DNS record types explains the difference.

8. Serve HTTPS from the start

Browsers mark plain-HTTP sites as "Not secure", and many TLDs, including .app and .dev, only work over HTTPS. Get a certificate that covers both the bare domain and www, redirect all HTTP traffic to HTTPS with a permanent redirect, and make sure the certificate renews automatically. The SSL Certificate Checker confirms the certificate covers every name and the redirects are right. Add HSTS once everything has worked over HTTPS for a while; HTTPS redirects and HSTS explains how to roll it out safely.

9. Add a CAA record

A CAA record lists the certificate authorities allowed to issue certificates for your domain. Without one, any public CA may issue. With one, a certificate request through any other CA is refused, which makes a certificate issued to someone else much harder to get.

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"

List every CA your hosting, CDN and email providers use. A CAA record that leaves one out makes that provider's next automatic renewal fail.

10. Turn on DNSSEC

DNSSEC signs your DNS records so resolvers can detect forged answers. If your DNS provider supports it, turn on signing there, then add the DS record it gives you at your registrar. Many providers do both steps for you when the registrar and DNS host are the same company. Check the chain of trust with the DNSSEC checker.

The one rule to remember: before you ever change DNS provider, deal with DNSSEC first. A DS record left pointing at the old provider's keys takes the whole domain offline for validating resolvers. Common DNSSEC failures covers how to move safely.

11. Write down where everything lives

A year from now, someone will need to know which company is the registrar, which hosts the DNS, which handles email, and who has the logins. Record it somewhere your team can find, along with the expiry date. Give a second trusted person access to the registrar account, so the domain doesn't depend on one person's inbox.

12. Monitor it

Most of the problems above don't announce themselves. A renewal fails quietly, a certificate stops renewing, a nameserver is changed without anyone noticing, and you find out when the site or email stops working. dnsdon monitoring watches the domain for you, free for one domain: it reminds you before the registration or certificate expires, and emails you when SPF, DKIM, DMARC or DNSSEC break or your nameservers change.

The full new domain checklist

Must, on day one:

• Unique password and two-factor authentication on the registrar account, with an account email on another domain
• Registrant email verified within 15 days, contact details accurate
• Auto-renew on, payment card current, expiry date in a calendar
• Transfer lock on
• SPF and DMARC published, plus a null MX if the domain won't handle email

Should, before you rely on it:

• Nameservers set at the registrar and answering for the zone
• Bare domain and www both resolve, one redirects to the other
• HTTPS on every name, with automatic renewal
• CAA record listing every CA your providers use
• DNSSEC signed, with the DS record at the registrar
• Registrar, DNS host, email provider and logins written down, with a second person who has access
• Monitoring for expiry and changes