Domain Portfolio Audit Checklist: Renewals, Security, DNS, and Ownership Checks

Overview

Managing one domain is usually straightforward. Managing several domains across different registrars, projects, hosting accounts, and team members is different. Important details become scattered: one domain may renew through a company card, another may use a personal email address, and a third may still point to an old server. A portfolio audit brings those details together in a single record.

Create a spreadsheet or database with one row per domain. At minimum, record the domain name, registrar, registrant or owning organization, expiration date, renewal setting, nameservers, current purpose, and person responsible for access. Add a date for the last review and a column for follow-up actions. The goal is not to collect every possible technical value; it is to make ownership, renewal, security, and operational dependencies easy to verify.

For registration details that are visible publicly, use an appropriate WHOIS or RDAP lookup, while remembering that privacy services and registry rules can limit what is displayed. The WHOIS and RDAP lookup guide explains how to interpret common registration data without treating a public record as a complete ownership audit.

Review the portfolio in two passes. First, check every domain at the registration and account level. Second, inspect the DNS and website configuration of domains that are active, redirecting, used for email, or reserved for a future project.

Checklist by scenario

For every registered domain

• Identify the registrar: Confirm where the domain is registered and which account controls it. Do not rely only on a browser bookmark or a billing email.
• Record key dates: Note the expiration date, registration date if useful, and any internal renewal deadline. Treat the registrar dashboard as the operational source of truth.
• Check renewal settings: Confirm whether auto-renewal is enabled, which payment method is used, and whether renewal notifications go to a monitored mailbox.
• Verify the owner: Make sure the registrant details identify the correct person or organization, using information that can be maintained if staff or contractors change.
• Review account access: Remove former users, confirm current administrators, and use individual accounts where the registrar supports them instead of sharing one password.
• Check the transfer lock: Confirm whether a registrar lock or equivalent transfer-protection setting is enabled when a transfer is not in progress.
• Review privacy settings: Confirm whether registration privacy is appropriate for the domain and understand which contact or verification messages still need to reach you.
• Record the purpose: Label each domain as a primary website, email domain, redirect, campaign, defensive registration, development asset, or unused name.

For active websites and applications

• Confirm nameservers: Compare the nameservers at the registrar with the DNS provider you intend to use. Unexpected nameservers deserve investigation before any record is changed.
• Inventory DNS records: Record A and AAAA records, CNAMEs, MX records, TXT records, and relevant verification entries. Note the service or system that depends on each record.
• Check the primary hostnames: Test the root domain and common subdomains such as www, app, admin, staging, and API endpoints where applicable.
• Review certificates: Confirm that HTTPS certificates cover the hostnames visitors actually use and that certificate renewal is assigned to a monitored system or person.
• Test redirects: Verify HTTP-to-HTTPS behavior, www and non-www routing, old campaign URLs, and redirects from alternate domains. Check that redirects reach the intended destination rather than a retired page.
• Document dependencies: Note email providers, hosting platforms, content delivery services, analytics systems, payment tools, and verification services that rely on DNS records.

For domains used for email

• Confirm that MX records point to the intended mail service.
• Review SPF, DKIM, and DMARC records with the person responsible for email administration. Do not delete or combine records simply because they look unfamiliar.
• Check that forgotten subdomains or old services are not still authorized to send mail.
• Verify that renewal notices and registrar security alerts go to a mailbox that does not depend on the domain being audited, when possible.

For unused, parked, or reserved domains

• Decide whether the domain has a defined future purpose or is being retained out of habit.
• Check for active mail, forwarding, DNS, or verification records before changing nameservers or letting the registration lapse.
• Remove unnecessary payment methods and access permissions while preserving the account owner’s control.
• Compare the annual renewal cost and business value before keeping defensive or speculative registrations. For budgeting context, use the domain and hosting cost calculator.

What to double-check

Expiration dates are important, but they are only one part of renewal protection. Check the exact renewal behavior for each domain, including whether auto-renewal can fail because of an expired card, spending limit, account restriction, or unverified contact. Set an internal reminder well before the registrar’s final renewal date. If a domain has already expired or is approaching expiration, review the recovery steps in What Happens When a Domain Expires? rather than assuming every extension follows the same timeline.

Ownership deserves a separate review. A domain registered through an employee’s personal account, a former contractor’s email, or an unmonitored shared inbox may be difficult to recover even when the business paid for it. Confirm that the organization can access the registrar account, receive verification messages, and prove its relationship to the domain if support is needed.

DNS changes require context. A record that appears old may support email, a subdomain, a software integration, or a certificate-validation process. Before deleting anything, identify its purpose, check recent service documentation, and record the original value. Make one controlled change at a time, reduce the DNS time to live only when there is a clear reason, and allow for caching after a change. A DNS propagation checker can help compare what different resolvers are returning, but it cannot confirm that the new configuration is correct.

Security controls should be reviewed at both the registrar and DNS-provider levels. Use multi-factor authentication where available, keep recovery codes in an approved secure location, and check for unfamiliar users, API tokens, delegated access, and recent account activity. Registrar lock, DNS change controls, and domain transfer procedures should be documented so that an emergency does not depend on one person’s memory.

Common mistakes

• Tracking only the expiration date: A domain can be renewed correctly and still point to the wrong DNS provider, expired hosting account, or inactive application.
• Assuming auto-renewal is enough: Auto-renewal does not guarantee a valid payment method, a reachable notification address, or continued access to the registrar account.
• Deleting unfamiliar DNS records: Verification, email, security, and third-party service records often look unnecessary until a dependent service stops working.
• Using one shared login: Shared credentials make access reviews, accountability, and offboarding harder. Use named users and least-privilege access when supported.
• Changing nameservers during a transfer without a plan: A registrar transfer and a DNS migration are separate tasks. Plan them independently to reduce the risk of downtime. See how to transfer a domain without downtime.
• Keeping every domain indefinitely: Unused registrations consume budget and expand the number of accounts, DNS zones, and renewal events that need protection.
• Confusing privacy with anonymity: Registration privacy can reduce public exposure, but it does not remove the need for accurate account ownership, valid contact channels, and secure access.

When to revisit

Run a complete portfolio audit at least annually, and consider a shorter quarterly review for domains that support revenue, email, customer accounts, or production systems. Schedule the review before seasonal planning cycles, budget approvals, or periods when key staff may be unavailable. A quarterly review can focus on upcoming expirations, payment methods, account access, and changes to active DNS records; the annual review should cover every item in this checklist.

Start an additional review after a registrar transfer, DNS-provider change, hosting migration, company acquisition, rebrand, staff departure, security incident, or website launch. Recheck the portfolio whenever a new domain is purchased so that it enters the same ownership and renewal process as existing assets. The domain and hosting setup checklist can help standardize intake for new registrations.

Finish each audit with three actions: mark each domain as verified, assigned, or requiring follow-up; give every unresolved item an owner and due date; and store the updated record in a location the responsible team can access. If a domain is no longer needed, confirm its DNS, email, redirect, and legal dependencies before cancelling it. If you are consolidating registrars, document the transfer plan and compare renewal and transfer costs before moving domains. A portfolio that is reviewed consistently is easier to secure, budget, and hand over when tools or people change.