12 Things to Do After You Buy a Domain
The hour after checkout is the cheapest time to prevent every common way a domain is lost. Twelve steps, most of them free, most of them under a minute.
September 21, 20266 min readBeginners · Security · DNS
The short answer. Turn on auto-renew, turn on the transfer lock, put two-factor authentication on the registrar account and use an email address that will still exist in five years. Those four take about ten minutes and prevent almost every way a domain is actually lost.
You have bought the domain. The registrar is now showing you upsells. Before any of that, there are twelve things worth doing, and most are free.
Secure the account first
1. Enable two-factor authentication
The registrar account is the asset. Someone with access to it controls every domain in it, and no configuration elsewhere protects against that. Do this before anything else.
2. Use a contact email that will outlive the project
Not a personal address, not one on the domain you just bought. If the domain breaks, an email address at that domain breaks with it, and you will be locked out at the exact moment you need in. A role address on a separate, established domain is the right answer.
3. Check the card on file
An expired payment card is the single most common cause of domain loss. Confirm the card does not expire before the domain does.
Lock the domain
4. Turn on the transfer lock
Set clientTransferProhibited. ICANN's EPP status code reference describes it as protecting against unauthorized transfers from hijacking or fraud. It is normally free and frequently off by default.
While you are there, clientDeleteProhibited and clientUpdateProhibited cost nothing either.
5. Turn on auto-renew
Then verify it is actually on, because some registrars reset it after a plan change. Auto-renew plus a valid card removes the largest category of loss entirely.
6. Confirm WHOIS privacy is active
Every major registrar now includes it free. It replaces your personal details in public registration data with a proxy. Without it, your name, address and phone number are published and scraped within hours.
Configure DNS and email
7. Point the nameservers deliberately
Decide whether DNS lives at your registrar, your host or a dedicated provider, and set it once. Splitting DNS across places you do not remember is how outages become mysteries.
8. Set up SPF, DKIM and DMARC
Even if the domain will never send email. Especially if it will never send email. A domain with no email authentication can be spoofed freely, and because you send no legitimate mail, nothing will alert you when someone does.
A minimal DMARC record on a non-sending domain is a two-minute job that closes an open door permanently.
9. Add a CAA record
A CAA record states which certificate authorities may issue certificates for your domain. It is one DNS record, and it stops anyone else obtaining a valid certificate from a different CA.
Set up the long game
10. Decide about DNSSEC
If your DNS provider offers one-click DNSSEC, turn it on. If it requires manually copying DS records between systems, think carefully, because a misconfigured DNSSEC setup makes your domain unreachable from validating resolvers. We covered the trade-off in DNSSEC Explained.
11. Put the expiry date somewhere you will see it
Auto-renew handles the normal case. The calendar entry handles the case where auto-renew silently fails, which is the only case that matters. Set it 90 days out, not 30, so a billing problem has room to be solved.
12. Register the obvious defensive variants, or decide not to
The common misspelling and the matching .com if you bought something else. This is a budget decision rather than a rule, but make it deliberately rather than discovering later that someone else made it for you. Lookalike domains explains what people do with the ones you skip.
What not to do
Do not buy the SSL certificate the registrar is offering. Let's Encrypt is free, automated and trusted by every browser. Paid certificates make sense for specific organisational validation needs and almost nothing else.
Do not buy hosting you do not need yet. A domain and hosting are separate purchases, as we covered in Domain vs Hosting.
Do not accept the default privacy upsell if privacy is already included. It usually is.
Common questions
What should I do immediately after registering a domain?
Enable two-factor authentication on the registrar account, turn on auto-renew and the transfer lock, and set the contact email to an address that is not on the new domain.
Do I need to do anything if I am not building a site yet?
Yes. Auto-renew, locks and email authentication all matter on a parked domain. An unused domain with no SPF or DMARC is the easiest kind to spoof.
How long does a new domain take to work?
The registration is immediate. DNS changes propagate according to record TTLs, usually minutes to a few hours. A newly registered domain also carries a 60-day transfer lock under ICANN's Transfer Policy, so you cannot move it to another registrar during that period.
Should I buy misspellings of my domain?
For a business with customers, the common typo and the matching .com are usually worth the renewal fee. Beyond the obvious two or three, defensive registration becomes an unbounded expense with diminishing returns.
Is WHOIS privacy necessary?
It is included free at every major registrar and prevents your personal contact details being published in registration data. There is no good reason to decline it for a personal registration.
What is the transfer lock and should it be on?
It is a registry status code that blocks transfers to another registrar. It should be on for any domain you intend to keep, and takes a minute to remove when you genuinely want to transfer.
Put the research to work.
Check your shortlist across the extensions that matter, then save the strongest names to a project.
Check a domain