A domain name audit is a structured check of everything connected to your domains: ownership, renewals, DNS, security controls, brand protection, and how each domain supports your website, email, and wider online presence. Done well, it reduces the risk of downtime, prevents costly renewal surprises, and helps you spot opportunities to simplify and strengthen your digital estate.
When to run a domain name audit
1) On a fixed schedule (at least annually)
A yearly audit is a sensible baseline for most organisations. If you manage multiple domains, run it every six months. Domains are easy to forget because they “just work” until they don’t, and by then the impact can be immediate: website outages, email failure, or reputational damage.
2) Before renewal season or budget planning
Run an audit 60–90 days before key renewal dates. This gives you time to decide which domains to keep, consolidate, or retire, and avoids rushed renewals at premium rates or after-hours emergency fixes.
3) After organisational change
Mergers, acquisitions, rebrands, leadership changes, or a switch in marketing/IT suppliers are prime times for a domain audit. These events often leave behind “orphaned” domains, unclear ownership, or DNS changes that were never documented.
4) When launching something new
Before a new website, product, campaign, or email platform launch, audit the relevant domains to confirm the right DNS records, security controls, and access permissions are in place. It’s far easier to fix issues before a launch than during it.
5) After a security incident or suspicious activity
If you’ve seen phishing attempts, unusual DNS changes, unexpected SSL warnings, or email deliverability problems, audit immediately. Domains are a common target because a single change can redirect traffic, intercept email, or damage trust.
How to run a domain name audit (a practical checklist)
Step 1: create a complete domain inventory
Start by listing every domain your organisation owns or relies on, including:
• primary domains (your main website and email domain)
• variations (common misspellings, hyphenated versions, plural/singular forms)
• ccTLDs and international domains (such as .uk, .co.uk, .com, .eu)
• campaign domains (microsites, short-lived promotions, redirects)
• defensive registrations (brand protection domains that may not resolve anywhere)
• legacy domains from previous brands, products, or agencies
Include where each domain is registered, which services depend on it (website, email, third-party platforms), and who internally is responsible for it.
Step 2: verify ownership, access, and administrative contacts
Confirm that:
• the registrant details are correct and reflect the organisation (not a former employee or agency)
• admin and billing emails are monitored mailboxes (not personal addresses)
• registrar accounts are accessible by more than one trusted person, with documented recovery options
• role-based access is used where possible, and access is removed when staff or suppliers change
This step alone prevents many of the most painful domain problems: being unable to renew, transfer, or update DNS when it matters.
Step 3: check renewals, expiry dates, and auto-renew settings
For each domain, record:
• expiry date and renewal term (one year vs multi-year)
• auto-renew status and payment method validity
• renewal notifications and where they are sent
• grace periods and redemption policies (these vary by TLD)
Where appropriate, consider multi-year registration for critical domains to reduce risk. Even with auto-renew, keep reminders in a shared calendar so you are not relying solely on registrar emails.
Step 4: review DNS configuration and hosting dependencies
DNS is the routing layer for your website and email. A domain audit should confirm that DNS records are accurate, intentional, and documented:
• A/AAAA records point to the correct web server(s)
• CNAME records are used appropriately for services such as www, verification records, or third-party tools
• MX records match your email provider and are prioritised correctly
• TTL values are sensible (not excessively low long-term, not excessively high if you need flexibility)
• unused records are removed to reduce confusion and attack surface
Also map dependencies: which domains are tied to which hosting accounts, website platforms, and external services. This makes future migrations and troubleshooting far safer.
Step 5: audit email authentication and deliverability controls
Email reliability and anti-phishing protection are strongly influenced by domain-level DNS records. Review and maintain:
• SPF to define which servers are allowed to send email for your domain
• DKIM to cryptographically sign outgoing email
• DMARC to instruct receiving servers how to handle unauthenticated mail and to provide reporting
Ensure these records are aligned with every system that sends email on your behalf (Microsoft 365, Google Workspace, CRM platforms, marketing tools, ticketing systems). If you are not using DMARC enforcement yet, plan a staged approach so you can move from monitoring to quarantine/reject without disrupting legitimate mail.
Step 6: confirm web security basics for each live domain
For domains that host websites or redirect traffic, check:
• SSL/TLS certificates are valid, correctly installed, and renewed before expiry
• HTTP to HTTPS redirection is enforced where appropriate
• redirects are intentional, up to date, and not creating loops or sending users to outdated content
• subdomains are accounted for (especially older staging, dev, or forgotten subdomains)
A common issue is an old subdomain still pointing to a retired service, which can become a security risk or brand risk if it’s hijacked or repurposed.
Step 7: apply domain protection and change control
Harden your domains against unauthorised changes:
• enable registrar lock to prevent unauthorised transfers
• use strong authentication (unique passwords and multi-factor authentication on registrar accounts)
• restrict who can edit DNS and keep changes logged
• consider DNSSEC where appropriate to protect against DNS tampering
Even small improvements here can dramatically reduce the likelihood of domain hijacking or accidental outages.
Step 8: assess brand coverage and risk
A domain audit is also a brand protection exercise. Review whether you should register:
• key TLDs relevant to your market (for UK businesses, .uk and .co.uk are often important alongside .com)
• common misspellings and lookalike variants that could be used for phishing
• product or service names that you may want to protect for future campaigns
Not every variant is worth buying, but you should make deliberate decisions based on risk, customer behaviour, and the value of the brand.
Step 9: clean up, consolidate, and document
Finally, turn findings into action:
• retire domains you no longer need (after checking they aren’t tied to email, logins, or backlinks)
• consolidate registrars where it reduces complexity and improves oversight
• standardise DNS and naming so records are easier to understand and maintain
• document everything in a shared, secure location: domain list, renewal dates, registrar logins, DNS notes, and key contacts
Clear documentation is what turns a one-off audit into ongoing resilience.
Common pitfalls to avoid
• relying on one person’s inbox for renewal notices and account recovery
• leaving old agencies as registrants or with full registrar access after a project ends
• forgetting email-sending services when updating SPF/DKIM/DMARC
• keeping unused DNS records “just in case”, which increases confusion and risk
• making DNS changes without a rollback plan or without noting previous settings
Make your next audit count
A domain name audit is one of the highest-impact, lowest-disruption checks you can do for your online presence. It protects your website and email, reduces operational risk, and gives you clarity over what you own and what you actually use.
If you would like expert help reviewing your domains, DNS, email authentication, and security controls, speak to Enbecom. Find out more about our services at https://www.enbecom.net and let’s make sure your domains are secure, well-managed, and ready for what’s next.