Keep your domain and hosting under control

Five areas to check after registering a domain, before a hosting migration or when business email stops arriving. Each section includes concrete steps and ways to verify them.

01

Domain ownership, protection and renewal

Problems often start when only a former contractor can access the registrar account or the registrant contact mailbox stops working.

1. Confirm who controls the registrar account and registrant mailbox. Enable two-factor authentication.
2. Use a transfer lock where supported and store recovery information securely.
3. Enable auto-renewal, verify the payment method and set reminders 30, 14 and 7 days before expiry.
4. Check registry-specific transfer restrictions before changing registrars.

How to verify: Locate the expiry date, transfer lock, 2FA, renewal settings and registrant contacts in your registrar account.

02

Move hosting without breaking DNS or email

Changing web hosting, domain registration and email hosting are separate operations. Each requires its own migration checklist.

1. Back up files, databases, environment configuration and current DNS records.
2. Test the new hosting environment before cutover, including forms, checkout, login and SSL certificates.
3. Lower the affected DNS TTL ahead of migration where possible and allow old caches time to expire.
4. Avoid changing MX, SPF, DKIM or DMARC records unless email is also moving.
5. Compare DNS responses after switching and test incoming and outgoing mail.

How to verify: Check site functionality, DNS answers, HTTPS, forms and sending and receiving test emails.

03

Email authentication: SPF, DKIM and DMARC

Mailbox providers consider sender authentication, domain reputation, message content and recipient responses.

1. Publish one valid SPF policy per DNS hostname, covering every legitimate sending service.
2. Enable DKIM signing with your mail provider and publish the DNS records it provides.
3. Start DMARC in monitoring mode (p=none), check legitimate mail flows, then gradually enforce quarantine or reject.
4. Avoid purchased lists and sudden bulk campaigns from a fresh domain. Respect recipients’ marketing preferences.
5. Monitor bounces, spam complaints and email authentication results.

How to verify: Send tests to different mailbox providers and inspect SPF, DKIM and DMARC results in the message headers.

04

Backups and tested restores

A backup only matters if you can restore a working site from it, including databases and order history.

1. Follow the 3-2-1 backup principle: three copies, two media types, one off the production host.
2. Restrict backup access and encrypt off-site copies.
3. Keep several restore points rather than overwriting yesterday’s backup.
4. Document restoration of files, database, configuration, DNS and key services.

How to verify: Test a restore on a staging environment at least once a quarter and record the recovery time.

05

Updates, HTTPS and uptime monitoring

A working domain does not protect a website from outdated plugins, weak credentials or unnoticed downtime.

1. Update your CMS, PHP, libraries and plugins after testing and backing up changes.
2. Use HTTPS with automatic certificate renewal and test redirects after migrations.
3. Enforce two-factor authentication and least-privilege access.
4. Monitor availability, certificate expiry, unexpected DNS changes and admin sign-in failures.
5. Keep a short change log and a tested rollback procedure.

How to verify: Check TLS, pending updates and monitoring alerts from a private browser session.