How a domain registrar can kill your business

I recall a time when a company I had association with lost their main domains due to a failed renewal. In this case it was a long-term employee who left the company that had loads of company bills going to his card. He cancelled the card sometime after he left and the domains were not renewed. I’m not sure where the renewal failure emails were going but probably some unmonitored admin email box.<p>These were very important domains. Without them, this $1 billion+ company immediately lost all of its ability to generate revenue. It was quite shocking.<p>The problem was discovered when users started getting the registrar’s landing pages rather than the company website pages. It was fixed relatively quickly once identified but do to DNS propagation took about 48 hours for complete resolution. During the window unrecoverable revenue well into the hundreds of thousands was lost.<p>It seems to me that a domain renewal is always a risk, even with a highly reliable registrar. A good defense is to limit the renewals for important domains by registering them for as long as possible (10 years). Even then you have a weak spot because your credit card will be expired by then so you should back that up with a calendar reminder a few months prior to renewal to make sure everything is set.

The timing of this is an amazing coincidence — I recently “lost” my domain in the same way. I bought it originally on Namecheap but have since transferred all my domains into a singular Google Domains account. My main domain, where I have my personal site and all my important emails, disappeared without notice on Wednesday the 9th last week. No expiration notice sent, no information as to what had happened.<p>I contacted Google as soon as I noticed and hey have been alright to deal with. Fortunately I am a Gsuite customer. I had to pay a fee to renew and another fee to restore, which was over $100. It’s been in “restoration” mode, ie offline, for days now and I am unable to even touch the DNS records until it’s back. I’ve already lost a week of uptime with zero recourse. FWIW I use a .co domain, and my site was throwing (for 24hrs or so) a splash page saying the domain was suspended.<p>Eagerly awaiting for it to come back but I’m totally in the dark as to timing.

That&#x27;s a horrible situation, and one I&#x27;d encourage everyone to try to avoid - register production critical domains with a company that provides live phone support and stick with tried and true TLDs.<p>Yeah, it may cost more, but this story just illustrates that you&#x27;re staking your entire company on a $15&#x2F;yr service, and you get what you pay for.<p>Even if you want to run your marketing&#x2F;landing page&#x2F;etc off a .io or other fancy tld, run your production stuff off a .com or country-level equivalent so your customers aren&#x27;t left in the lurch if something like this happens.<p>- <i>edit - punctuation</i>

I had some fun with NameCheap and the xyz tlds. Turns out, CentralNic (who actually runs the zones) was not doing proper validation on the glue records, and not removing old ones. NameCheap was sending CentralNic cached records, and managed to foobar my domain glues.<p>I bypassed NameCheap, because I knew they weren&#x27;t the ones actually maintaining the records (registrars are just middle-men.) Using the DNS contact in the SOA, I got a response within 12 hours, and it was fully resolved within 24 hours (minus propagation.)<p>CentralNic contacted NameCheap, as did I, and they got their system fixed within the week.<p>--Edit--<p>CentralNic, not Nic. The roots were to nic.xyz.

Never heard of domain.com. If anyone wants a recommendation I use namecheap and have never had a problem. They are supporters of the EFF and Net Neutrality.<p>Edit: If you are going to downvote, state why. Namecheap is a good service for a good price and supports Internet freedom. When even GoDaddy was supporting SOPA Namecheap took a stand against SOPA.

My registrar suspended my domain because an abusive user was using a subdomain for phishing. They told me they can&#x27;t inform me first of abuse so I can deal with it; they&#x27;ll suspend the domain immediately.<p>Who&#x27;s a good registrar that will contact me first if they get an abuse report?

I work for a domain registrar, albeit not the one mentioned in the article.<p>Obviously, we see a lot of expired domains on a daily basis, mainly because customer&#x27;s forget to renew despite us reminding them repeatedly during the three months before the domains expire.<p>General advice: 1) Make sure there is more than one single contact person for invoicing. All too often, the problem is that a single employee is unavailable for some reason and that the rest of the business have no idea that the domain needs to be renewed.<p>2) Keep the contact details valid and up-to-date. This should be a no-brainer but a surprisingly large amount of businesses have domains registered to single employees, or with invalid contact emails.<p>3) Don&#x27;t wait until the domains expire; renew the domains for at least one additional year. It will give you a whole year to fix stuff if you forget a reminder. EDIT: Or if the registrar screws up like in this case.<p>4) Automatic renewals is your friend. It&#x27;s a last line of defense if all else fails.<p>5) Make sure you have a process for handling all of the above, even if you&#x27;re a one-man business. Domain names are often critical for the business, and it&#x27;s ridiculous to let the entire business rely upon a reminder sent 90 days before expiry.

Don&#x27;t use *.io anyway. The domains are being sold under a very morally dubious arrangement, given the UK kicked all the people off the island of Chagos and gave the domain registration to a private entity.<p><a href="https:&#x2F;&#x2F;gigaom.com&#x2F;2014&#x2F;06&#x2F;30&#x2F;the-dark-side-of-io-how-the-u-k-is-making-web-domain-profits-from-a-shady-cold-war-land-deal&#x2F;" rel="nofollow">https:&#x2F;&#x2F;gigaom.com&#x2F;2014&#x2F;06&#x2F;30&#x2F;the-dark-side-of-io-how-the-u-...</a><p>The UK government&#x27;s view of the Chagossians at the time they gave the island to the USA for a military base was apalling:<p>“Unfortunately along with the birds go some few Tarzans or Man Fridays whose origins are obscure and who are hopefully being wished on to Mauritius.”

Related - <a href="https:&#x2F;&#x2F;medium.com&#x2F;@alexandernst&#x2F;from-successful-to-zero-thanks-to-namecheap-d392c76b2ffd" rel="nofollow">https:&#x2F;&#x2F;medium.com&#x2F;@alexandernst&#x2F;from-successful-to-zero-tha...</a>

Something that scares me regarding domain names is their variable cost. I purchased a .sexy domain for a joke website and its price got raised by +70% less than one year after that, making the joke a lot less appealing. There’s no guarantee that when you purchase a domain name it reasonably stays around that price for years.<p>Build a business on a domain -&gt; the name increase by XX% -&gt; you’re screwed and must pay.

Do not rely on other people to resolve time-sensitive issues when you can easily avoid it.<p>In this particular case as soon as it&#x27;s clear the domain hasn&#x27;t renewed despite being billed then manually renew it using the usual user interface, pay the extra $10 and then contact support after to get one of the charges refunded now the time-sensitivity is gone.<p>The stress alone isn&#x27;t worth being out of pocket $10 let alone only for a week or two.

This is one of the potential drawbacks of using ccTLDs like .io - individual nations are afforded much more control in the administration and dispute resolution process than gTLDs. Unfortunately some are run more poorly than others, which is why in this case the support agent states:<p>&quot;Unlike common domain names [gTLDs] like .com or .nets. .IO&#x27;s are managed by a specific organization, that manages only .IO domain names...&quot;<p>.IO of course being the ccTLD for the British Indian Ocean Territory, run by these chaps: <a href="http:&#x2F;&#x2F;www.icb.co.uk&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.icb.co.uk&#x2F;</a><p>At any rate, it&#x27;s worth bearing in mind that ccTLDs are not administered the same way as a gTLD, and weird issues like this that are a pain to resolve can happen.

I create websites for small businesses. I&#x27;ve seen almost every conceivable domain renewal failure in my 20 years of experience. No matter how many times we remind clients to get this aspect of their business documented we still have sites go down every year. We charge a fee to &quot;manage&quot; domains for those who opt-in, solely for this reason (and it&#x27;s worth it).<p>The most common reasons:<p>Bad contact email<p>Auto renew off<p>Expired CC<p>Lost password<p>The more obscure:<p>Bought domain through a reseller who is now out of business (more common than you think)<p>&quot;Branded&quot; contact email which post expiration, no longer works.<p>Disgruntled &quot;losing&quot; webmaster who registered domain under his&#x2F;her account and is now holding it hostage.

It is sad that often, a slightly less appealing .com domain is a better choice than a slick domain on an unreliable tld.

I recommend using easydns.com as the registrar and DNS service. Their email helpdesk is fast: &lt;30 minutes. They answer the phone immediately and they are knowledgeable. Phone support is during business hours, but the more expensive packages have 24hour support.<p>And yeah, you need to have a lot of faith to use .io or other new TLDs which are serviced by new companies.

We spend lot of time thinking about making our services resilient against failure at the infrastructure level yet the domain registrar is often overlooked.<p>Not only do you have to worry about them making a technical mistake there is also the risk of a phishing attack.<p>A while back I did a bit of research about what was the most reliable registrar and the only one that i could find was Markmonitor. Most of the big sites (google.com facebook.com etc) use them. They offer lots of cool features that i had never heard of like registrar level locking and custom &#x27;protocols&#x27; (like a phonecall from X no. of authorised people) to validate a change. Plus some others that seemed less interesting (to me) such as the brand protection.<p>They do of course charge a pretty penny. From memory there was a minimum cost of $30k per year which allowed you pretty much as many domains as you might want and the promise of being able to get ahold of a human if something goes wrong.

Algolia implemented a retry strategy on a different domain, TLD, and provider in their API clients. See step 14 of this article: <a href="http:&#x2F;&#x2F;highscalability.com&#x2F;blog&#x2F;2015&#x2F;7&#x2F;27&#x2F;algolias-fury-road-to-a-worldwide-api-part-3.html" rel="nofollow">http:&#x2F;&#x2F;highscalability.com&#x2F;blog&#x2F;2015&#x2F;7&#x2F;27&#x2F;algolias-fury-road...</a><p>Complicated to apply to a website, but it gives some thoughts.

Yes well. Don&#x27;t use .io domains for anything serious.<p>I had one of the 20 largest .io domains for a time, until they shut us down because they received one complaint in 3 years. It took them 2 days after we resolved the matter to put the domain back online as well.<p>By that time I had already migrated to .org - which is run by a considerably more professional non-profit organization.

For those who want the short version: Never EVER use domain.com as your domain registrar. Yikes!<p>i really feel bad for those guys at uptimechecker.io

I had a related issue where a previous registrar — who we had moved away from months before — managed to accidentally &quot;claw back&quot; and disable our domain due to a misconfigured billing script. The fragility of the whole ecosystem is pretty scary.<p>Wrote it up on Medium @ <a href="https:&#x2F;&#x2F;medium.com&#x2F;thisiscala&#x2F;the-duct-tape-holding-the-internet-together-12118be60ff1" rel="nofollow">https:&#x2F;&#x2F;medium.com&#x2F;thisiscala&#x2F;the-duct-tape-holding-the-inte...</a>

I worked at a domain registrar for over ten years. Every day I would have to deal with a call from some irate customer who&#x27;s business was down because they forgot to renew the domain. This was after we would send them emails, starting a month before the renewal was due and then more frequently the closer they got to the renewal date. Many times they wouldn&#x27;t even notice until the domain had passed the grace period, fully expired and been snatched up by some scalper and replaced with adverts.<p>Then they would be on the phone claiming to be losing thousands of pounds for every minute the website was offline and how it needed to be resolved right now or they would be sending in their lawyers.<p>If your business resolves around having a functional website, make sure you have a solid domain renewal plan in place and are hosting with a trustworthy registrar.

Just to be fair, this person waited until 3 days before expiration to verify that everything was ok with his registrar.<p>They should have done this 90 days ago.<p>Create and implement a business policy to have IT come up with a procedure to check this quarterly. There&#x27;s no really any excuse for a tech company to have this happen.

Domain registrar and DNS for a company are too critical and fragile to go cheap on.<p>For personal, hobby, one-off marketing domains; sure go cheap.<p>But for something you earn money from? Go with highy recommended providers. Registrars with a secure administration, good track record of customer service, high reliability, etc.<p>Also spread the risk around. Don&#x27;t have domain, DNS, and services with one provider. E.g. register domain with Gandhi, Hover etc, use DNS from Cloudflare, Route56, etc, and host with GCP, Heroku etc (for example).<p>And use several providers if you have multiple domains in case one implodes. That way not all of your domains disappears overnight.<p>And as many have mentioned already on this topic: Have well documented, well practised renewal processes, and renew for multiple years if possible.

If this service was some run of the mill e-commerce or SaaS I wouldn&#x27;t have this reaction, but being a critical monitoring service that was down for days, this reflects very poorly on them. My reaction is that I&#x27;d never use uptimechecker.io. Quite honestly I am baffled why they&#x27;d even want to write this post for others unaware of their company and the outage to discover. It does not reflect well on them, despite spinning it and rightly blaming domain.com.<p>Just use a respected and well known registrar such as Amazon Route 53 domains. This could have all been avoided. I know the blame &quot;should&quot; fall on domain.com, but ultimately startups are responsible for their service.

They might have completely shut you out with the silent treatment because they think you might sue. So maybe you should.

For a very long time, DNS simply has not been an identified risk for most corporations. In the risk analysis they make, DNS is not on the map at all, even though it may be a single point of complete collapse for them. Thus we see extremely large corporations depending on a single DNS provider, using a registrar that are more interested in profit rather than resilience against attacks, no DNSSEC. Etc etc. This is slowly changing. What is. Not changing fast enough is the ability to run more than one DNS provider, giving you yet another spof.

The whole domain registration system is a very complex and messy area to work with, both from a development as an enduser perspective. I speak from experience working at a hosting company implementing domain registrations directly with the registry systems.<p>It&#x27;s a incomprehensible mishmash of tld&#x27;s implementing different methods of registering, renewing, restoring, domains. Some require ID verification before registrations, some have a quarantine of 1 week, other of 4 weeks, some no quarantine. Some domains need to be renewed before expiry, some can still be used 2 weeks after expiry, some domains allow transfers and trades, others don&#x27;t or do under strict circumstances. Some require transfer codes, others don&#x27;t. Some transfer codes are valid for 1 week, some are valid for longer.<p>There is no decent standarization on the technical level when it comes to managing domain registrations. There is the EPP protocol but almost none of the registries implement a standardized way of registering domains each implementing a mess of extensions to suit their bureaucratic needs.<p>ICANN introducing over 1.2k new gTLD&#x27;s some time ago also didn&#x27;t help along with the introcution of domains containing non standard latin characters and the puny-code implementation there (eg: café.com is actually listed as xn--caf-dma.com)<p>I&#x27;m not trying to defend domain.com who obviously failed to deliver on the basics of decent support, but things like this (issues between domain vendor and registry) happen more than most of us like to admit.

This is an interesting discussion, as I’ve recently run into problems with transferring a domain from domain.com to google domains.<p>I’ve heard good things about google domains in the past and the price seemed right (never had a problem with domain.com, but they charge separately for domain privacy) and now I’m stuck in Vonnegut-like situation. They locked my account because apparently the record that was transferred in doesn’t exactly match my uploaded govt ID. I can’t&#x2F;won’t change my legal name, and the account is locked so I can’t fix the record. The phone support was sympathetic but said I had to go through email, which I’m pretty sure is an AI. This has been going on for a month now, and I’m pretty sure I’m never going to get this resolved.<p>I haven’t seen any discussion or experiences people have with AWS route 53. Is that a valid option? Seems reasonable and has privacy included.

Pardon my ignorance, but this is something I&#x27;ve always wondered.<p>You can setup fail over DNS servers, just list different DNS servers, possibly from different companies, with your registrar.<p>Is the registrar a unavoidable single-point of failure? Your multiple name servers are listed with your one-and-only-one registrar, no matter what?

I used a free domain coupon from domain.com a few years ago, and was spammed with both snail mail and robocalls (advertising services for the domain) for months afterwards. I don&#x27;t know whether they&#x27;re selling customer data or what, but it left me with a very negative image of their company.

On my previous job we had to manage thousands of customer domains, including annual renewal. This was very tedious task, so I wrote a Perl script, scraping WHOIS and DNS data for all domains listed on our DNS servers. Based on this data every domain was assigned a status, such as &quot;Ok&quot;, &quot;misconfigured&quot;, &quot;about to expire&quot;, &quot;points to foreign DNS server&quot; or &quot;points to foreign Web server&quot;. This script was scheduled to run every other day and sent CSV report (full and diff from previous run) to a person responsible for domain renewal. Needless to say, our support specialists were very happy with this improvement.

I had similar beef with a .io domain name many years ago: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=1973704" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=1973704</a>

Big domain registrars operates usually on such a low profit margins that a single support ticket cost more than that customer will ever create in revenue. This create a very clear incentive models to focus on growth and keeping support costs down.<p>I work at a smaller registrar and we usually close (resolve) tickets within minutes and as a policy under the hour. We depend on word of mouth and contacts for sale, so we kind of have the opposite incentive model. I may be biased but I recommend avoiding the race to the bottom registrars for business critical domains.

So, how does one prepare for the worst? Let’s brainstorm:<p>0. Register alternative domains in advance with a different registrar.<p>1. Setup mailing list for all registered users and be prepared to blast them with a new domain.<p>2. Make mobile apps check both the main and the alternative domains.<p>3. Make the mobile app notify the user of a new domain name requirement via push notification and the like.<p>4. Setup the phone system so that it can read the new domain before connecting support.<p>5. Setup support on a different domain (e.g. zen desk). If zendesk goes down users will know to call us, if the main site goes down they may remember to check zendesk.<p>6...?

This sorta reminds me of when Regions Bank forgot to renew its domain name.. for everything a smart business can do to acquire customers, developing groundbreaking software, etc - sometimes the things that break are the most obvious and mundane.. <a href="https:&#x2F;&#x2F;www.billhartzer.com&#x2F;pages&#x2F;regions-bank-fails-to-renew-domain-name-web-site-goes-down&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.billhartzer.com&#x2F;pages&#x2F;regions-bank-fails-to-rene...</a>

There are 100 year domains renewals&#x2F;registrations if anyone wonders. So if they really wanted to safeguard it, they could of done it. <a href="https:&#x2F;&#x2F;www.networksolutions.com&#x2F;domain-name-registration&#x2F;popup-100-yr-term.jsp" rel="nofollow">https:&#x2F;&#x2F;www.networksolutions.com&#x2F;domain-name-registration&#x2F;po...</a> <a href="https:&#x2F;&#x2F;www.tonic.to&#x2F;faq.htm#12" rel="nofollow">https:&#x2F;&#x2F;www.tonic.to&#x2F;faq.htm#12</a>

Yep.<p>&quot;“Sunkenness” refers to the fact that intangible assets tend to have little or no market value, unlike, say, land or a factory.<p><i>They have value as part of their owner’s business, but not to anybody else.</i><p>This means that investment in intangible assets is risky.&quot;<p><a href="https:&#x2F;&#x2F;www.ft.com&#x2F;content&#x2F;a01e7262-d35a-11e7-a303-9060cb1e5f44" rel="nofollow">https:&#x2F;&#x2F;www.ft.com&#x2F;content&#x2F;a01e7262-d35a-11e7-a303-9060cb1e5...</a>

I recall UnitedDomains (German provider) who wanted me in 2016 to fax the request to update the contact information. Fax it.<p>Times are mature for the equivalent of Letsencrypt for registering domains, something like Letsregistrar. We need to have this inefficient industry wiped away since it&#x27;s really too much manual and too much in the way.<p>If somebody wants to found a noprofit to create a free registrar, I&#x27;m 100% in.

I transferred two domains from Ghandi to Lunarpages over a decade ago. Somehow, Ghandi&#x27;s anonymization service was still enabled, and as a result, my domains were blocked a few months ago.<p>Took about a week for Lunarpages to straighten out.<p>(BTW, the spam calls started immediately after Lunarpages fixed the problem. It&#x27;s a great thing that the EU finally twisted ICANN&#x27;s arm over this issue.)

A lot of domain registrars seem to go for the &quot;pile it high, sell it cheap&quot; business model. I think as with any other commodity that a tech business (or any business!) needs to run, you pick your suppliers carefully.<p>In the UK, I wouldn&#x27;t touch 123Reg with a stick because I know their support is terrible. I would however use Gandi or AWS as I know their support is decent.

I don&#x27;t know if this is a culture thing or personal style, but the author keeps emphasizing that the story is true. To me, that reduces credibility since I&#x27;ve often heard false stories whose narrators reiterated their truthfulness unexpectedly when I wasn&#x27;t doubting them. Not very reliable logic, I know, but it&#x27;s a small warning bell.

I always wonder how people care about &quot;good prices&quot; if they choose a registrar. Quite often the domain name is the most valuable asset of your company. As long as you are not a domain squatter you shouldn&#x27;t care about if you pay $10 or $1000 per year. And if possible register the name for the next 10 years in advance.

I&#x27;m not sure the domain registrar is completely at fault here. If your website going down will &quot;kill your business&quot; then it&#x27;s a good idea to use a reputable one and not the cheapest you can find.<p>And looking at domain.com just now, they don&#x27;t seem to offer .io domains, so I wonder how he even got the domain there?

None of the .ly domain registrars have auto-renew. They have an option to send you a yearly invoice and a link to login, which they call &quot;auto-renew&quot;, but it doesn&#x27;t actually take the all-important step of renewing. Lost a great domain because of that.

You&#x27;d have a fantastic case for a lawsuit against them. Good job keeping a paper trail.

I had similar experience with domain.com<p>Their support team is from India, and they took a week to solve the issue.<p>I am looking for good domain service provider to transfer all of my domains 30+<p>Any recommendations? We use Digitalocean as the hosting service provider

Yes I&#x27;ve heard of domain.com . In fact, we even used it for one of our products. We tried to purchase wildcard ssl via their control panel - the result was a delay from our go live schedule by as much as more than a week. It was the most horrible control panel I&#x27;ve ever used honestly. Feels like bug from the alpha release candidate V1 bugs list. there&#x27;s this weird bug when it suddenly delete all our mailboxes for no reason. The moment we saw that bug we immediately stop using it.<p>The support? The first guy that tends to you will always be the most stupidest one. You almost always had to insist to get&#x2F; be forwarded to a senior level support with actual brain.<p>tl;dr Stay 100 miles away from domain.com . By the way it wasn&#x27;t me that chose domain.com . I would never buy from any website that looks like this.

thought this would be another idiotic story but it’s actually valuable.<p>still, some blame falls in their shoulders, cutting it so close.<p>anyway: use mark monitor. don’t know if they do .io though.

ICANN should make it mandatory for the domain registrars to send reminders at least 1 month before expiry.

Here&#x27;s my plug for NameSilo. Try them and you will not regret it.

If you can, just transfer your domains to Google Domains and never worry about shady registrars again.<p>(We also use Dynadot [good], Hexonet [good], Uniregistry [... okay].)

TL;DR .io

Back in the late 90&#x27;s before it was Verisign (I can&#x27;t recall the name), my domain registration could only be changed with an email from my domain. Of course I didn&#x27;t have my domain up since I switched ISP and had to move my DNS and mail server. Catch 22; what a cluster fuck. Weeks of phone calls with no resolutions.<p>I was going to Virginia anyway, so I physically showed up at Verisign (I wanted to bring a baseball bat), and explained it to the lady at the front desk. She came back with an engineer who fixed it in 5 minutes.<p>As a side note, had to do something similar with Garmin. They kept sending me GPS units with horizontal LCD polarization, when vertical is the standard for sun glasses. Showed up and told the clerk to put on my sunglasses and turn her head sideways to her LCD monitor. &quot;Oh yeah, I see&quot;. She fetched an engineer, and 1 week later had a GPS with correct polarization.<p>Sometimes it takes a physical presence; baseball bat optional.

Mistakes and glitches happen. Op should have noticed their domain did not renew a month before it expired, not just before.<p>DNS and domain propagation are slow turning ships. If a problem occurs, you sometimes need days to straighten out the problems.<p>&gt; I tried to set nameservers to correct values, but Control panel returned error: uptimechekcer.io is not managed here!<p>They misspelled their own domain in this article. It seems their problem is a lack of attention to detail.<p>The complaint about charging for domain registration is nonsense. Domain registrations are non-refundable. If a registrar ever registered domains for customers before payment, they’d quickly find themselves out of business. Payment is always up front across the industry.

nearlyfreespeech.net provide great service, notifications and overall highly recommended. been customer with several domains transferred or registered with them over the past tears

Who on earth uses .io for production critical domains?