The Domain Portfolio Audit Checklist
Most portfolios fail in the same six ways: a card that expired, a domain nobody owns internally, a lock that was never on. A practical annual audit you can run in an afternoon.
September 21, 20268 min readPortfolio · Security · Monitoring
The short answer. Domains are not lost to sophisticated attacks. They are lost to an expired credit card, a departed employee's email address on the registrar account, and a transfer lock nobody ever switched on. This checklist covers the six failures that account for almost all of them.
CSC's Domain Security Report 2026 found that 67% of Global 2000 companies have implemented fewer than half of eight basic domain security controls. These are companies with security teams. If that is the enterprise baseline, a portfolio held by a small team without a formal owner is almost certainly worse.
Run this once a year. An afternoon covers most portfolios.
Step 1: Build the actual inventory
You cannot audit what you have not listed, and almost nobody's list is complete. Domains accumulate: the campaign microsite, the misspelling someone defensively registered, the ccTLD bought for a market you never entered.
Pull a list from every registrar account you know about. Then find the ones you have forgotten:
- search company card statements for registrar names
- check DNS zones for names that resolve to your infrastructure
- look at your certificate transparency records, because every certificate you have issued names a domain
- ask whoever has been there longest
Put the result in one place. Our Domain Hub accepts a pasted list or a file import, which is the fastest way to turn several registrar exports into one view.
Step 2: Ownership and access
For each domain, answer three questions.
Whose email is on the registrar account? If it is a person rather than a role address, that is a single point of failure. When they leave, password resets go to a mailbox you have disabled. Move to a role address that several people can reach.
Is two-factor authentication on? The registrar account is the actual crown jewel. Someone with access to it can move everything, and no amount of DNS configuration protects against that.
Who pays, and on what card? An expired card is the single most common cause of domain loss. Check the card on file is not expiring before the domain does.
Step 3: Expiry and renewal
| Check | Why |
|---|---|
| Auto-renew is on | Removes the most common failure entirely |
| Expiry date is more than 90 days out | Below that, a billing failure leaves no recovery room |
| Renewal price is what you expect | First-year discounts end; see our registrar price comparison |
| Multi-year renewal on anything critical | Registry prices only move up |
One note on timing: .com wholesale pricing rises 7% on 1 November 2026, so renewing critical .com names before then locks the current rate.
Step 4: Registry status codes
This is the step almost every checklist skips, and it is the one that detects trouble.
Every domain carries EPP status codes set by your registrar or the registry. You can see them in any RDAP lookup, including our checker. ICANN documents what each one means in its EPP status codes reference.
Codes you want to see:
| Code | What it does |
|---|---|
| clientTransferProhibited | Registry rejects requests to transfer the domain to another registrar |
| clientDeleteProhibited | Registry rejects requests to delete the domain |
| clientUpdateProhibited | Registry rejects requests to update the domain |
ICANN describes the first two as protection "against unauthorized transfers as a result of hijacking and/or fraud". They are usually free and off by default. Turn them on for every domain that matters.
Codes that mean something is wrong:
| Code | What it means |
|---|---|
| clientHold | Your domain is not activated in DNS. The site is down. Usually non-payment or a dispute |
| serverTransferProhibited | The registry, not your registrar, has blocked transfers. Often a legal dispute |
| redemptionPeriod | The domain was deleted. You have about 30 days to recover it for a fee |
| pendingDelete | Redemption has ended. The name will be purged and released |
If you see redemptionPeriod on a domain you intended to keep, stop reading and contact your registrar now. ICANN's guidance is to act "immediately".
The code whose absence matters: if clientTransferProhibited disappears from a domain and nobody on your team removed it, treat that as an incident. It is the step that precedes a transfer away.
Step 5: DNS
Are the nameservers what you expect? Unexpected NS changes are either a migration you forgot or somebody else's migration.
Do MX records match your mail provider? Mail redirection is quiet, damaging and easily missed, because your website keeps working perfectly.
Any dangling records? A CNAME pointing at a cloud service you no longer use can be claimed by whoever registers that service name next. This is a subdomain takeover, and the fix is deleting records you stopped using.
Is DNSSEC consistent? Either properly configured or properly off. A half-configured DNSSEC setup makes your domain unreachable from validating resolvers, which produces the confusing symptom of a site that works for some people and not others.
Step 6: Email authentication
Three records, on every domain, including the ones that do not send mail.
SPF lists who may send as you. DKIM signs your outgoing mail. DMARC tells receivers what to do when the first two fail, and gives you reporting.
Domains that never send email need these most of all. An unused domain with no SPF or DMARC is an open invitation to spoof your brand, and the attack leaves no trace in systems you control.
CSC reports DMARC adoption among the Global 2000 rose from 39% in 2020 to 80% in 2025, pushed partly by the EU's NIS2 Directive. If you operate in the EU, this is drifting from good practice toward expectation.
Step 7: Certificates and cost
Certificate expiry. Automated renewal fails silently more often than people expect. Check the expiry dates you are relying on automation for.
Cost review. Sort the portfolio by renewal price and ask which names still earn their cost. Defensive registrations made for a product launched five years ago are often just a subscription to a decision nobody has revisited.
Compare renewal pricing against what other registrars charge for the same extension. On a portfolio of any size, the difference is substantial: on .ai, the spread between the cheapest and most expensive registrar over five years is $716 per domain.
The cadence
| Frequency | Task |
|---|---|
| Continuously | Nameserver, registrar and status-code change alerts |
| Monthly | Expiry report for the next 90 days |
| Quarterly | Certificate expiry, DNS record review |
| Annually | Full inventory, access review, cost review |
Steps 1, 2 and 7 are genuinely annual. Steps 4 and 5 are the ones that need to be continuous, because a status code changing at 3am is not something a yearly audit will catch in time. That is the case for monitoring rather than auditing.
Common questions
How often should I audit a domain portfolio?
Fully once a year, with continuous alerting on registry and DNS changes in between. An annual audit catches drift and cost; only monitoring catches an incident while you can still act on it.
What is the most common cause of domain loss?
Expired payment cards and outdated contact email addresses on the registrar account. Both are administrative, both are preventable, and together they account for far more lost domains than attacks do.
Should I enable clientTransferProhibited on every domain?
Yes, for anything you intend to keep. It is normally free, it is set by your registrar, and ICANN describes it as protection against unauthorized transfers from hijacking or fraud. Removing it takes minutes when you genuinely want to transfer.
What is the difference between registrar lock and registry lock?
Registrar lock is the client-side status code your registrar sets, free and self-service. Registry lock is applied at the registry and requires out-of-band verification to lift, so it is far stronger and usually a paid enterprise service.
Do unused domains need SPF and DMARC?
Especially unused domains. A parked name with no email authentication can be spoofed freely, and because it sends no legitimate mail you will never notice it happening.
How long do I have to recover an expired domain?
Roughly 75 days in total: up to 45 days of grace period, about 30 days of redemption where recovery carries a fee, then 5 days of pending delete. After that the name is released.
Put the research to work.
Check your shortlist across the extensions that matter, then save the strongest names to a project.
Check a domain