The Account Nobody Can Open: A Renewal Drill for Domains, DNS and Certificates

There is a particular category of invoice that rarely troubles a finance team: twelve pounds, perhaps twenty-five, billed annually to a card that belongs to somebody who left the company eighteen months ago. It sits beneath the threshold that triggers a query, it renews quietly, and it is frequently the single point of failure for the company's entire public presence. The domain name resolves to the website, the website carries the shop, the shop takes the orders, and the whole arrangement depends on a payment card that expired in March.

This article sets out a structured exercise that a UK small or medium business can complete in roughly an hour. It is not a security audit and it is not a procurement review. It is a continuity drill, and its purpose is to answer a narrow question: if the person who set this up were unreachable tomorrow, could somebody else keep the lights on?

Three assets wearing one coat

It is common to speak of "the domain" as though it were a single object. In practice three distinct things are in play, each with its own supplier, its own account and its own failure mode.

The registration is the right to use the name, held through a registrar and, for .uk names, recorded at Nominet. The DNS zone is the set of records that tell the internet where to send mail and traffic; it may be hosted by the registrar, by a web host, by a CDN, or by a specialist provider. The TLS certificate is what makes the padlock appear and what stops browsers from warning visitors away.

An organisation can quite easily control one of these and have no practical access to the other two. A web agency may hold the registrar account; a former contractor may hold the DNS; the certificate may renew automatically from a server that nobody has logged into since the last migration. Each is individually robust and collectively fragile.

Before the hour begins

Three things need to be on the table. First, a list of every domain name the business uses, drawn from invoices, marketing material, email signatures and the finance ledger rather than from memory. Second, access to twenty-four months of card and bank statements, which will surface recurring charges that never reached the IT team. Third, at least one person who can log into the relevant accounts, and one more who cannot — the second is there to observe whether the instructions are followable by someone with no prior context.

Pass one: the inventory, first twenty minutes

Work through the estate in four sweeps, and do not attempt to fix anything yet.

List the domains. Include the obvious primary name, the .uk and .co.uk pair if both are held, legacy trading names, campaign names, redirect-only names and defensive registrations. Include anything used for a single integration, such as a sending domain for transactional email.

For each domain, record the registrar, the expiry date, whether auto-renew is enabled, the payment instrument, and the email address on the account. That last field is the one that exposes the problem most often: a personal Gmail address, an address at a former employer, or a shared inbox that nobody has opened since the last restructure.

Then record where the DNS zone lives. Running dig NS against each name will show the authoritative nameservers, which in turn identify the provider. Alongside that, capture the records that would be painful to reconstruct: mail exchange records, SPF, DKIM and DMARC entries, verification TXT records for third-party services, and any CAA records that restrict which certificate authorities may issue for the name. Losing a zone is disruptive; losing the email authentication records inside it can damage sending reputation for weeks.

Finally, list the certificates. Note where TLS terminates, how issuance works — automated via ACME or renewed by hand — and when each expires. Interrogate the live endpoint if there is any doubt.

Pass two: moving ownership into the organisation

The objective here is that no account is held in a personal capacity. Registrars generally allow the registrant contact to be an organisation rather than an individual, and for .uk names the registrant details held at Nominet can be transferred. Both should reflect the company, with a role-based contact address such as a monitored shared mailbox rather than one person's inbox.

Where a registrar or DNS provider supports it, enable multi-factor authentication for every administrator and issue credentials through the company password manager rather than by message. Nominate at least two named administrators, and record who they are in the register. A single administrator is a single point of failure wearing a different hat.

If a supplier refuses to add a second administrator, or requires the account to remain in an individual's name, that is a finding worth writing down and raising at renewal.

Pass three: the terms worth changing

With access established, adjust the settings that determine what happens when nobody is paying attention. Enable auto-renew on every domain the business intends to keep. Extend registrations to multiple years where the registrar prices it sensibly; the reduction in annual touchpoints is worth more than the discount. Apply the registrar lock and, where offered, registry lock, so that a compromised credential alone cannot transfer the name away.

Set expiry alerts at sixty, thirty and seven days, and route them to a monitored mailbox rather than to an individual. Move billing onto a company card and record that card's expiry date in the register, because an expiring card silently disables automatic renewal across every supplier at once.

Pass four: the rehearsal

This is the part that most organisations skip, and the part that supplies the actual assurance. Choose one low-risk domain and walk through three scenarios aloud, with the observer taking notes.

The DNS provider is unavailable. Where would the nameservers be repointed, and can anyone reach that control panel without going through the DNS provider's own login? Is there an exported copy of the zone? Lowering the time-to-live on key records in advance of any planned change, and restoring it afterwards, is a step worth writing down rather than remembering.

The registrar fails or the account is locked. The registry of last resort exists for exactly this purpose, and its records are only useful if the registrant details are current — which loops back to pass two.

The certificate expires unexpectedly. Renew one by hand, end to end, to prove the process does not rely on the individual who originally configured it. If the answer is that only one person knows how, that is the headline finding of the drill.

What completion looks like

A finished exercise produces one register, held in a shared location, containing every domain, its registrar, its DNS host, its certificate arrangement, its renewal date, its account owner and its payment instrument. It produces two people who can execute each step unaided. And it produces a calendar entry for a quarterly review, because suppliers change, staff leave and cards expire.

The twelve-pound invoice will still arrive. The difference is that it will arrive to an account the business controls, on a card the business owns, with somebody watching the renewal date — and that is a considerably better position than hoping the person who set it up is still answering their phone.