A domain portfolio audit gives you one reliable view of ownership, renewal dates, DNS configuration, security controls, and access permissions. Use this checklist quarterly—and after team, registrar, hosting, or infrastructure changes—to reduce the chance of an expired domain, broken email, or unmanaged account becoming an incident.
Overview
Managing multiple domains is less about registration and more about maintaining accurate operational records. A domain may point to a production website, redirect to another property, handle business email, support an application, protect a brand, or sit unused for future work. Each use creates different renewal, DNS, security, and ownership requirements.
The central record for your portfolio should answer five questions for every domain:
- Who legally or organizationally owns it?
- Which registrar account controls it?
- When must it be renewed, and how is renewal paid?
- What services depend on its DNS records?
- Who can change, transfer, or recover it?
A spreadsheet, database, or asset-management system is sufficient if it is kept current and access is controlled. Do not treat a domain list as a one-time inventory. It is a recurring control that should be reviewed before renewal planning, during quarterly maintenance, and whenever responsibility changes.
For background on preventing expiration-related outages, see the domain renewal and expiration guide. If you are beginning with a new website, the website launch checklist provides a broader setup sequence.
What to track
Create one row or record per domain. Record the information below, and distinguish confirmed facts from items that still need verification.
Ownership and registration
- Domain name: Include the exact spelling and extension.
- Business owner: Identify the company, legal entity, or individual responsible for the asset.
- Registrant contact: Record the responsible contact or department, while following applicable privacy and data-handling requirements.
- Registrar: Note the provider and the specific account or organization that manages the domain.
- Registration and expiration dates: Record both dates and the date on which your team intends to begin renewal review.
- Transfer status: Note whether a transfer lock is enabled, whether an authorization code may be required, and where transfer instructions are documented.
- Privacy setting: Record whether domain privacy protection is enabled, unavailable, or intentionally disabled for a documented reason.
Registrar interfaces and domain policies vary by extension and provider. Use the registrar account as the source of truth for current status, then update your internal record rather than relying on an old screenshot or email receipt.
Renewal and payment controls
Record whether automatic renewal is enabled, which payment method supports it, and who receives renewal notices. Automatic renewal is useful but is not a substitute for monitoring: payment cards expire, billing permissions change, and notifications may go to a former employee.
For critical domains, define an internal renewal window well before the registrar's final expiration or redemption stages. The exact timelines and recovery options can vary, so verify them with the registrar and the relevant domain registry. Never assume that an expired domain can be restored under the same terms or without service disruption.
DNS purpose and dependencies
Document the authoritative nameservers and the purpose of important DNS records. At minimum, identify:
- A or AAAA records: Website or server destinations.
- CNAME records: Aliases or hosted services.
- MX records: Business email routing.
- TXT records: Email authentication, service verification, and other published text policies.
- CAA records: Certificate-authority restrictions, if used.
- Redirects and subdomains: Campaigns, applications, staging systems, dashboards, or third-party platforms.
For each record, note its owner and why it exists. An unexplained record is not automatically malicious, but it is a review item. Avoid deleting records simply because they look unfamiliar; first check application documentation, hosting configuration, email administration, and recent change history. The DNS records guide can help identify common record types.
Security and access
List every person, team, or integration with registrar access. Confirm that former staff, temporary contractors, shared credentials, and unused API tokens have been removed. Prefer individual accounts with the strongest available multi-factor authentication, role-based permissions, and an auditable recovery process.
Track the following controls:
- Multi-factor authentication on registrar and DNS accounts.
- Separate billing, technical, and administrative permissions where supported.
- Registrar transfer lock status and the process for changing it.
- Recovery email addresses and telephone numbers.
- DNS change logging or notification alerts.
- Documented emergency contacts and break-glass access.
- Backup copies of critical DNS configuration and relevant zone documentation.
Also record the domain's relationship to SSL certificates, hosting, monitoring, and backups. DNS changes can affect HTTPS and email even when the website files are untouched. For related troubleshooting, review SSL certificate errors and connecting a domain to web hosting.
Cadence and checkpoints
A practical cadence separates quick monitoring from deeper portfolio decisions.
Monthly: monitor exceptions
- Review domains approaching their internal renewal window.
- Check failed payments, bounced notifications, and registrar security alerts.
- Review recent DNS changes for production and email domains.
- Confirm that critical websites, redirects, and email services resolve as expected.
Quarterly: perform the full audit
- Compare the portfolio inventory with registrar exports or account views.
- Verify ownership, contacts, nameservers, renewal settings, and payment responsibility.
- Resolve unknown DNS records and document legitimate exceptions.
- Review access permissions, multi-factor authentication, and recovery details.
- Identify unused, duplicate, defensive, or abandoned domains for a business decision.
- Check that hosting, email, SSL, monitoring, and backups still match the domain's documented purpose.
Before a change: capture a baseline
Before changing registrars, nameservers, hosting, email providers, or DNS records, export or document the current configuration. Record the planned change, owner, rollback approach, expected propagation effects, and validation tests. This makes it easier to distinguish a configuration error from normal DNS caching or propagation behavior. Use the DNS propagation troubleshooting guide when testing changes across networks.
How to interpret changes
Not every change requires the same response. Classify findings by business impact and urgency.
Critical: An expiration is near, ownership is unclear, registrar access is unavailable, unauthorized DNS changes are suspected, or production email or web traffic is failing. Assign an owner immediately, preserve relevant evidence, and avoid making additional changes until the current state is understood.
High priority: Automatic renewal lacks a verified payment method, multi-factor authentication is missing, a former team member retains access, or a critical domain has undocumented nameservers. Correct these issues during the current review cycle.
Routine: A domain is unused, a redirect has no current owner, documentation is incomplete, or several accounts could be consolidated. Schedule cleanup rather than making an unreviewed deletion.
Pay special attention to ownership changes. Moving a domain between registrars is not the same as moving a website between hosts. A registrar transfer affects domain control, while a hosting migration affects files, databases, server configuration, DNS, and SSL. If both changes are needed, plan them separately where possible and validate each stage. The guide to transferring a domain without downtime covers the main migration checkpoints.
Likewise, a domain that appears unused may still support email, verification records, redirects, or brand protection. Confirm dependencies with the relevant stakeholders and inspect DNS history or service documentation before retiring it.
When to revisit
Use the following checklist as a recurring operating routine:
- Now: Build the inventory and mark every unknown owner, expiration date, registrar account, and nameserver.
- Monthly: Review upcoming renewals, payment status, alerts, and critical DNS or service changes.
- Quarterly: Complete the full ownership, DNS, security, access, and unused-domain review.
- Before renewal: Confirm that the domain is still needed, the registrant information is appropriate, and the payment and notification paths work.
- After a team change: Remove departing users, update contacts, rotate shared secrets where necessary, and confirm recovery access.
- After a registrar or host change: Compare the documented baseline with the new configuration and test website, email, HTTPS, redirects, and key subdomains.
- Annually: Review this checklist against current registrar terminology, extension requirements, privacy options, renewal and redemption procedures, and your organization's security policy.
Finish each review with three outputs: a verified inventory, a short list of assigned remediation tasks, and a dated record of what was checked. That habit turns domain portfolio management from an emergency reaction into a predictable maintenance process.
