Your Domain Is the Front Door: A 30-Minute Hygiene Check for Small UK Teams

Ask someone in a small UK charity or a five-person accountancy what their domain is for and you will get 'it's our website'. Fair enough — but that is like saying a doorbell is for holding the number. The domain is the thing that makes your email trustworthy, your invoices believable and your brand yours. When it goes wrong, it goes wrong loudly.

A quick story from the wild: a small firm's domain lapsed for eleven days because the renewal invoice went to a former employee's inbox. In that window, someone registered the abandoned domain and started sending polite payment-chase emails to the firm's clients from an address that looked exactly right. Nobody had done anything wrong technically. The door was simply unlocked.

The good news is that domain hygiene is one of the few areas of security where half an hour of effort genuinely closes most of the risk. Here is what matters and how to check it.

The three things that actually break

Account takeover at the registrar. Someone gets into your domain account and changes where the domain points — or transfers it out. This is the nightmare scenario because everything else follows from it.

Domain expiry. Boring, entirely preventable, and still one of the most common causes of small-business email outages and impersonation.

Impersonation without ever touching your domain. Attackers do not need your account. They register yourfirm.co.uk next door, or yourfirm-invoices.com, and send mail that a busy client reads on a phone.

Part one: lock the front door (10 minutes)

Start at your registrar — the place you pay for the domain, whether that is a big name or a small UK host. Log in and do four things.

1. Turn on two-factor authentication for every account that can touch the domain. Use an authenticator app or a hardware key, not SMS if you can avoid it.
2. Check the registrant email address. Is it a shared mailbox, a personal address of someone who left in 2023, or a role account nobody reads? Move it to a monitored role address like domains@.
3. Switch on the transfer lock. In theory this is on by default; in practice, check. You are looking for the status clientTransferProhibited in the domain's settings or WHOIS record.
4. Turn off auto-renew at your peril — then check the payment card. Better: leave auto-renew on, but put a calendar reminder two weeks before expiry with the card expiry date noted. Cards expire. Domains do not care.

While you are there, note the renewal cost. A .co.uk should be somewhere around £8–£15 a year. If you are paying £45 because it is bundled into a hosting package, that is a conversation for another day.

Part two: make sure you would notice a change (5 minutes)

Most registrars and DNS hosts can email you when records change. Switch those notifications on and send them to a mailbox more than one person can read. A silent change to your MX records — the ones that decide where your email goes — is exactly the kind of thing you want a boring alert about.

If your DNS is managed by a web developer or an agency, ask them in writing: who has access, what happens when our contract ends, and will you notify us of record changes? Get the answer in an email you can find again.

Part three: email authentication, in plain English (10 minutes)

Three acronyms, three jobs.

• SPF says which servers are allowed to send email as your domain.
• DKIM puts a cryptographic signature on your outgoing mail so it can be checked in transit.
• DMARC tells the receiving world what to do when a message fails those checks, and sends you reports.

You do not need to understand the mechanics to check yours. Use NCSC's free Email Security Check — you type in your domain and it tells you what is missing. It also flags things like whether your domain is set to reject spoofed mail.

A few practical points people get wrong:

• You can only have one SPF record per domain. Two records equals no record, as far as most receivers are concerned.
• Move DMARC through the stages: start at p=none to collect reports, then p=quarantine, then p=reject. Do not jump straight to reject if you have any third-party senders — newsletters, CRM, invoicing tools — that you have not accounted for.
• Set up a mailbox for the DMARC reports (rua=), even if you only skim them monthly. Free services exist to summarise them if the raw XML makes your eyes bleed.
• DKIM selectors are set up by whoever sends your mail. Ask your mail provider for the exact records rather than guessing.

Part four: lookalikes (5 minutes)

Run a free check with a tool like dnstwist against your domain. It generates the obvious variants — swapped letters, added hyphens, different endings — and tells you which are already registered. Most will be nothing. Occasionally you will find one sitting there with a mail server attached, which is worth knowing about.

If you find something being used to impersonate you, report it: forward the evidence to NCSC's Suspicious Email Reporting Service at [email protected], and use the hosting provider's abuse address. If a lookalike is hosting a fake login page, the NCSC takedown route is genuinely effective.

For high-value domains, registering the closest variant for a tenner a year is not paranoia — it is cheaper than a single confused client.

The 30-minute audit, as a checklist

• Two-factor authentication on the registrar account (all admins)
• Registrant email is a monitored role mailbox
• Transfer lock confirmed
• Expiry date in a calendar, card expiry noted
• DNS change notifications switched on
• One SPF record, correct syntax
• DKIM signing confirmed with your mail provider
• DMARC published, with a path to p=reject
• Email Security Check run and results saved
• dnstwist run, findings noted
• Access list for DNS documented, including any agency

Print it, work through it with a coffee, and stick the completed version in your evidence folder. It will not make an exciting slide, but it is the closest thing to a lock on the front door — and unlike most security shopping, it costs almost nothing.