What we check
- Registration: registrar, creation and expiry dates and transfer lock, read from the registry's RDAP service. Expiry within 60 days is a warning, within 14 days a failure.
- DNS: nameservers and their provider, the SOA record, DNSSEC signing and CAA records that restrict which authorities may issue certificates.
- Addresses: A and AAAA records for the bare domain and www, IPv6 reachability on port 443 and whether www and non-www redirect consistently.
- Hosting: the network (ASN) and provider of your server, reverse DNS and CDN detection.
- Reputation: the domain and server IPs against major blocklists.
- Certificate: validity, issuer, hostnames covered, days to expiry and TLS versions.
Why domain health matters
Your domain is a single point of failure for your website, email and often your client portal. An expired registration takes all of them offline at once, and expired domains are quickly picked up by others. A misconfigured nameserver can make the site unreachable for some visitors only, which is hard to diagnose from the office.
Many firms registered their domain years ago through a former web agency or an employee who has since left. Knowing the registrar, the expiry date and who has access is basic resilience.
Good practice
Register the domain in the firm's name, with a shared role address such as it@ for notifications, and enable auto-renewal with a valid payment method. Turn on the registrar lock and two-factor login on the registrar account. Where your DNS provider supports it, enable DNSSEC, and add a CAA record naming the certificate authority you use.
Publish both IPv4 and IPv6 if your host supports it, and make sure www and the bare domain both work and redirect to one canonical version. Review this check once a year and after every hosting change.
Signs that need attention
Act quickly on an expiry date within a few weeks, nameservers that do not answer consistently, a missing www or apex record, or a domain or server IP on a major blocklist. Less urgent but worth planning are missing DNSSEC, absent CAA records and IPv4-only hosting. Each finding in the report names the record involved and the change to make at your registrar or DNS provider.