A domain portfolio audit gives you a reliable record of what you own, who can control it, how each domain is used, and when action is required. This checklist walks through inventory, registrar security, DNS delegation, privacy, renewal settings, risk ratings, and a repeatable quarterly review process.
Overview
Managing one domain is relatively simple. Managing several domains across different registrars, teams, hosting accounts, and email systems is not. Over time, domains may be purchased for product ideas, redirected after a rebrand, left unused after a project closes, or registered by a former employee or contractor. Without a current inventory, an overlooked renewal or unverified account permission can become an avoidable operational risk.
A domain portfolio audit is a structured review of every domain connected to your business or projects. The goal is not to change everything. It is to establish an accurate baseline, identify urgent exceptions, and remove unnecessary exposure. A useful audit answers five questions:
- Which domains do we own or manage?
- Who is the legal registrant and who has operational access?
- When does each domain renew, and how is renewal handled?
- Where do the domain's nameservers and DNS records point?
- Is the domain still needed, secure, and correctly configured?
Keep the inventory in a controlled document or asset-management system rather than relying on memory. Restrict edit access, record the date of the last verification, and avoid storing registrar passwords in a spreadsheet. Use an approved password manager for credentials and recovery information.
What to track
1. Build a complete domain inventory
Start by collecting domain names from registrar accounts, billing records, hosting dashboards, DNS providers, certificate tools, email platforms, and application configuration. Search for both active and inactive domains. Include alternate spellings, defensive registrations, country-code domains, development domains, and domains that only redirect.
For each domain, record:
- Full domain name and top-level domain
- Registrar and, if different, DNS hosting provider
- Registrant organization or owner of record
- Business purpose, associated brand, or project
- Primary website, redirect target, or stated “unused” status
- Registration date and expiration or renewal date
- Auto-renewal status and payment method owner
- Nameservers and the person or team responsible for DNS
- Domain privacy status, where the registrar and TLD support it
- Registrar account owner, administrators, and recovery contacts
- Notes about email, SSL certificates, hosting, redirects, or legal restrictions
A simple inventory template can use these columns: Domain, Purpose, Registrar, Owner of record, Renewal date, Auto-renew, Nameservers, DNS owner, Privacy, Risk, Next action, and Last checked.
2. Verify ownership and registrar access
Confirm that the registrant details identify the correct business, individual, or legal entity. A domain may be operationally important even when its registration contact is outdated. Correct ownership records through the registrar's supported process, and document any verification or transfer restrictions before making changes.
Review every account with access to the registrar. Remove inactive users, shared logins, and permissions that exceed a person's role. Confirm that administrators use unique credentials and multi-factor authentication where available. Check recovery email addresses, phone numbers, security keys, and billing contacts as well. A former team member may no longer have direct access but could still control a recovery channel.
3. Review renewal and payment controls
Expiration is one of the most visible portfolio risks. Compare the recorded renewal date with the registrar dashboard, then verify whether auto-renewal is enabled. Auto-renewal is useful only when the payment method, billing contact, and account access remain current. For high-value domains, assign an owner who receives renewal notices and maintain a secondary internal reminder.
Do not assume that an expiration date tells the whole story. Renewal, grace, redemption, and transfer rules can vary by registrar and domain extension. For a detailed operational review, see What Happens When a Domain Expires? Record the registrar's current instructions in your internal procedure rather than copying assumptions from an old audit.
4. Inspect nameservers and DNS delegation
Nameservers determine which DNS provider is authoritative for a domain. Compare the nameservers in the registrar account with your documented DNS provider and expected infrastructure. An unexplained nameserver change deserves prompt investigation because it can redirect web traffic, email, verification records, or other services.
At the DNS provider, review the records that support the domain: A and AAAA records for hosts, CNAME records for aliases, MX records for email, and TXT records for verification and email authentication. Note stale records, duplicate records, unknown subdomains, and records pointing to retired services. Use DNS Records Explained as a reference when documenting unfamiliar entries.
5. Check related security dependencies
Domain security extends beyond the registrar account. Confirm that active websites have valid SSL certificates, that certificate renewal is owned by a current team, and that email authentication records remain intentional. If the domain sends email, review SPF, DKIM, and DMARC ownership and alignment; the email authentication guide provides a separate checklist.
For each domain, identify dependencies such as hosting, CDN services, website builders, analytics verification, payment systems, application callbacks, and third-party SaaS accounts. An unused website domain may still be used for email or account verification, so do not cancel or delete it until those dependencies are checked.
6. Decide whether unused domains still have a purpose
Classify inactive domains as retain, redirect, review, or release. Retain domains that protect an active brand, support email, preserve a legal or campaign asset, or serve a planned project. Redirect domains only after confirming that the destination is appropriate and that the redirect does not create a confusing user experience. Mark domains for release only after checking email addresses, DNS records, certificates, integrations, and renewal obligations.
Cadence and checkpoints
A quarterly audit works well for most small and midsize portfolios. Larger or more changeable environments may benefit from monthly checks of renewals, access, and DNS alerts, followed by a deeper quarterly review.
Monthly checkpoint
- Review domains expiring within the next 90 days.
- Confirm payment methods and renewal notifications.
- Investigate unexpected registrar, nameserver, or DNS changes.
- Process access changes from staff, vendors, or project closures.
Quarterly audit
- Reconcile the inventory against registrar and billing records.
- Verify registrant, administrative, and recovery contacts.
- Review administrators, multi-factor authentication, and recovery options.
- Compare nameservers and important DNS records with the documented architecture.
- Check SSL, email, hosting, and third-party dependencies.
- Reassess the purpose and risk rating of every domain.
Annual planning
Once a year, review the portfolio as a whole. Identify registrar consolidation opportunities, redundant domains, upcoming brand changes, and domains whose renewal costs or operational value need approval. If you are moving domains or hosting, use a documented website migration checklist and plan for DNS propagation, email continuity, and rollback.
How to interpret changes
Not every difference requires an emergency response, but unexplained differences should not be ignored. Use a simple risk rating to prioritize work:
| Risk | Typical condition | Recommended response |
|---|---|---|
| High | Unknown registrar access, unexpected nameserver change, expired domain, or incorrect owner of record | Assign an owner immediately, preserve evidence, secure access, and correct the control point |
| Medium | Renewal within the planning window, stale recovery contact, unclear DNS ownership, or an unreviewed third-party dependency | Schedule a dated remediation task and verify completion |
| Low | Documented unused domain, confirmed auto-renewal, current contacts, and no unexplained DNS or access changes | Keep in the inventory and review at the next scheduled checkpoint |
Pay particular attention to patterns. Several domains using unknown nameservers may indicate a process or access problem rather than isolated mistakes. A growing number of unused domains may indicate that registration decisions are not being reviewed. Repeated renewal failures may point to outdated billing ownership, even when auto-renewal is technically enabled.
When a domain is transferred to a new registrar, record the old and new accounts, transfer date, authorization steps, DNS provider, and post-transfer verification. Do not change registrar, nameservers, and hosting simultaneously unless you have a tested rollback plan. Separating changes makes it easier to identify the source of an outage.
When to revisit
Run the full audit quarterly and perform a focused review whenever a trigger changes the ownership or technical profile of the portfolio. Important triggers include a rebrand, acquisition, website migration, registrar transfer, hosting change, email-provider change, security incident, new administrator, departure of a key team member, or a domain renewal notice that does not match your records.
At the end of each review, record three things: what changed, what remains unresolved, and who owns the next action. Set a due date rather than leaving notes such as “check later.” Before closing the audit, verify at least one live path for every important domain: the website, email, redirect, or application endpoint. Keep the previous inventory version so you can distinguish an intentional change from an unexplained one.
To begin, export or manually list every domain you can find, mark the registrar and renewal date, and flag any record with an unknown owner, unknown nameserver, or uncertain purpose. Resolve high-risk items first, then work through medium-risk gaps. Once the baseline is accurate, schedule the next monthly checkpoint and quarterly audit. A current inventory turns domain registration from a scattered administrative task into a manageable, repeatable security and renewal process.
