Most small businesses only think about their domain when something breaks: the website shows a certificate warning, invoices start landing in spam, or the domain quietly expires because the renewal card was cancelled. None of these failures is hard to prevent. They just need someone to look at the right things on a schedule.
This is the checklist I'd hand to anyone running a business domain without a dedicated IT person. It's in order of how much damage each item does when it goes wrong.
1. Registration: the one that takes everything down
If the domain expires, the website, email and every service tied to it stop at once. Check:
Expiry date and auto-renew. Auto-renew should be on, with a payment card that won't expire before the renewal date. For the domain your business depends on, renewing several years at a time costs little and removes a whole class of accident.
Registrant and account email. Reminder emails go here. If that address is on the same domain, a lapsed domain can't receive its own renewal warnings. Use an address on a different domain.
Registrar account security. Turn on two-factor authentication. Whoever controls the registrar account can change your nameservers, and with them your website and email.
Transfer lock. The status should include clientTransferProhibited. It stops the domain being moved to another registrar without you unlocking it first. Most registrars enable it by default, but check.
Who actually owns it. If a web designer or former employee registered the domain in their own name or account, fix that now while relationships are friendly.
Nameservers. You should have at least two, and they should all answer with the same records. A DNS lookup will show you what's being served.
Records you no longer need. Delete records pointing at services you've cancelled. A CNAME pointing to a deleted cloud resource, such as an old app hosting slot or storage bucket, is a known route for subdomain takeover: someone else claims the resource and serves content on your subdomain.
Who can edit DNS. Know which account and which person can change it. Keep a copy of your zone somewhere safe, so you can rebuild it if you move providers.
TTLs before changes. If you're planning a migration, lower the TTL on the affected records a day or two beforehand, so the change takes effect quickly and a mistake can be reversed quickly too.
3. TLS certificate and HTTPS
Certificate expiry. Certificate lifetimes are getting shorter. Under the CA/Browser Forum's schedule, publicly trusted certificates issued since 15 March 2026 can be valid for at most 200 days, dropping to 100 days from March 2027 and 47 days from March 2029. Manual renewal once a year is no longer an option. Make sure renewal is automatic, and then check that the automation actually works.
Name coverage. The certificate must cover every name visitors use, usually both example.com and www.example.com.
Redirects.http:// should redirect to https://, and one of the bare domain and www should redirect to the other. Check all four combinations.
You can check the certificate, its expiry and the chain with our SSL checker, and the redirect behaviour with the HTTP header checker. From a terminal:
The first shows the status and where plain HTTP redirects to. The second prints the certificate's expiry date.
4. Email: authentication and reputation
If your domain sends mail, even just from a normal mailbox provider, check:
MX records point at your current email provider and nothing old.
SPF exists, there's only one record, it lists every service that sends as you, and it stays under the ten-lookup limit. If a checker reports "too many DNS lookups", our post on fixing SPF PermError covers it.
DKIM is turned on for every service that sends as you, not just the main mailbox.
DMARC is published with a reporting address. Gmail already requires DMARC from anyone sending more than 5,000 messages a day to personal Gmail accounts. Start at p=none, read the reports, then move towards quarantine or reject once you know every legitimate sender passes.
Blacklists. Check your sending IPs and domain aren't listed. A listing usually means something is actually wrong, such as a compromised account sending spam.
If your domain doesn't send email at all, protect it anyway. Publish v=spf1 -all and a DMARC record with p=reject, so nobody can convincingly send mail pretending to be you.
5. Monitoring: find out before customers do
Uptime. Something external should check your website regularly and alert you when it's down. An uptime monitor is the cheap version.
Renewal alerts. Put the domain expiry date and certificate expiry in a shared calendar, not one person's head.
After any change. Whenever you switch web host, email provider or DNS provider, re-run the whole checklist. Migrations are when records get lost.
How often to run it
Here's a sensible rhythm for a small business:
Monthly: a quick automated report. Our domain health check covers domain expiry, TLS, DNS, HTTPS, SPF, DMARC, MX and blacklist status in one pass, so it takes a minute.
Quarterly: the manual parts. Review who has registrar and DNS access, delete stale records, and confirm the payment card on the registrar account.
Annually: check the domain is registered to the business, not a person, and that contact details are current.
Keep a one-page note of where everything lives: registrar, DNS host, email provider, certificate source, and which login controls each. That page is what saves you when the person who set it all up has left.
Frequently Asked Questions
What's the single most important item on this list?
Registration. An expired domain takes down your website and email together, and if it drops, someone else can register it. Auto-renew and a current payment card prevent most of it.
Do I need DMARC if I'm a small business?
Yes, if you send email. It helps receivers trust your legitimate mail and makes it harder to spoof your domain. If you send fewer than 5,000 messages a day, Gmail's bulk sender rules don't require it, but it's cheap to add and p=none changes nothing about delivery while you learn.
My certificate renews automatically. Do I still need to check it?
Yes. Automatic renewal can fail silently: DNS changes break validation, a server migration loses the renewal job, or the certificate renews but the server keeps serving the old one. Check the served certificate's expiry date, not just the renewal settings.
How do I know if my domain is set up for subdomain takeover?
Look for CNAME records pointing at third-party services you no longer use. If the target returns an error saying the resource doesn't exist, delete the record straight away.
0 comments
No comments yet. Be the first.