Lock these five things on your business domain and email: put the domain in your own name, turn on two-step sign-in for the domain account and your email, keep the transfer lock on, turn on auto-renew with a contact email that reaches a real person, and publish SPF, DKIM and DMARC records for your email. Each takes minutes, and below is what the official ICANN, Google and Microsoft pages say about each one, so you know what you are switching on and why.
I am writing this for business owners: the salon, the clinic, the cafe, the plumber, the consultant. Your domain is the address of your website and the part after the @ in your email. If someone else controls it, or it lapses, you lose both at once. None of this makes an account unhackable. It closes the common ways in, and it is what the official guides ask for.
All the facts about ICANN, Google and Microsoft below were read on their own pages and checked on 2 November 2026.
The five locks at a glance
| # | Lock | Where you do it | Time | What it stops |
|---|---|---|---|---|
| 1 | Your name as owner, one account you control | Registrar account, contact details | 10 min | A freelancer or ex-employee holding your domain |
| 2 | Two-step sign-in | Registrar account and email accounts | 5 min each | A stolen password taking over the domain or inbox |
| 3 | Transfer lock on | Registrar domain settings | 2 min | The domain being moved away without you |
| 4 | Auto-renew and a contact email that gets read | Registrar billing and contact details | 5 min | The domain expiring and the website and email going dark |
| 5 | SPF, DKIM, DMARC | DNS records, or your email provider's setup page | 20 min | Someone sending mail as you, and your real mail landing in spam |
1. Own the domain in your name, and know who holds the account
The registrant is the person or business named as the owner of the domain, and the registrar is the company you pay to register it. Two common problems are a domain registered in a web designer's name, and a domain account tied to the email address of someone who left.
Fix it while nothing is broken, because ICANN's rules make fixing it later slower. ICANN's Transfer Policy says that when the registrant name, organization or email address changes, registrars must impose a 60-day lock that stops a transfer to another registrar. Registrars may let you opt out, but only before you make the change, and they do not have to offer that. ICANN's own advice is to request a transfer first, then change the details, or to ask the registrar about opting out before you change anything.
What to check today:
- Registrant name and organization are your business, not a person who may leave and not an agency (unless you chose that).
- The login email for the registrar account is a mailbox you control and that more than one trusted person can reach, ideally not an address on the same domain, because if the domain breaks you could not receive the reset email.
- Who has the password. One owner login, not a shared password in a chat.
2. Turn on two-step sign-in where the domain and email live
A password is the one thing that gets guessed, reused and phished. Google calls 2-Step Verification an extra layer in case your password is stolen, and lists the options: a prompt on a signed-in phone, a passkey or security key, an authenticator app, or a text or voice code. Google says passkeys and security keys help protect against phishing. It also tells you to print or download a set of 8-digit backup codes and keep them somewhere safe, for the day you lose your phone.
Turn it on in three places:
- Your registrar account. Every registrar names the setting differently. Look under Security, Two-factor or Two-step in your account settings.
- Your email accounts. In a Google account, go to Security and sign-in, then 2-Step Verification.
- The admin account of your email service, first. The admin can reset everyone else.
If your email runs on Microsoft 365, check security defaults. Microsoft's page says they require all users to register for multifactor authentication and that administrators must use it every time they sign in. New tenants may have them on already. They also block legacy sign-in protocols, so an old scanner or app that sends mail over a basic IMAP, SMTP or POP3 login can stop working. Find those first.
3. Keep the transfer lock on
The transfer lock is the registrar's setting that tells the registry to reject any request to move the domain to another registrar. ICANN's page on domain status codes names it clientTransferProhibited and says it helps prevent unauthorized transfers. To move the domain yourself, you first ask the registrar to remove the lock, or switch it off in the registrar's settings.
Three more facts from ICANN's Transfer Policy and registrant FAQs:
- The transfer code (also called the authorization or EPP code) is created by the registrar. If you cannot generate it yourself, the registrar must give it to you within five calendar days of your request and remove the lock.
- Registrars must give you a reasonable, easily accessible way to remove the lock. If you cannot find the switch, you are entitled to ask.
- Newly registered or just-transferred domains can be refused a transfer for 60 days. The policy text says a registrar may deny one, so some do and some do not.
You can check the current status of any domain with a WHOIS lookup (ICANN points to InterNIC's lookup and to your registrar's own website). You are looking for the status clientTransferProhibited. If it is missing, switch the lock on in your registrar.
4. Turn on auto-renew, and make the contact email one that gets read
An expired domain takes the website and the email down together. ICANN's guide for registrants says registrars must send at least two renewal reminders, about one month and about one week before expiry, and that every notice goes to the registrant email address in the domain's contact information.
What happens after expiry, from ICANN's pages:
- A registrar may offer an auto-renew grace period of 1 to 45 days to renew, which may carry a fee. In that time the domain can become available to others, depending on the registrar's terms.
- If the registrar deletes the name, it enters a 30-day Redemption Grace Period, during which it can be restored, usually for a redemption fee. After that it sits in PendingDelete for 5 days and is then released to anyone, first come, first served.
- ICANN suggests you consider auto-renewal and keep your payment details current.
Under the Whois Data Reminder Policy, registrars must also present your registration details to you at least once a year and remind you that false details can be grounds for cancelling the registration. So treat that email as an annual task, not spam: open it, fix anything out of date, and save the receipt.
Today: turn on auto-renew, check the card on file does not expire this year, and set the registrant email to a shared mailbox such as domains@ so a holiday or a departure does not hide the reminder.
5. Publish SPF, DKIM and DMARC so your email is trusted
These are three DNS records that tell the world which servers may send mail as your domain, and what to do with mail that is not from them. Without them, anyone can send a message that looks like it came from you, and mail you genuinely send is more likely to be rejected or filed as spam.
| Record | What it does | Google and Microsoft say |
|---|---|---|
| SPF | Lists the servers allowed to send for your domain | Every domain, and each subdomain, needs its own SPF record. Google says changes can take up to 48 hours. Microsoft suggests starting with soft fail (~all) and moving to hard fail (-all) once you know every service that sends your mail |
| DKIM | Signs each message so receivers can tell it was not altered | Google recommends a 2048-bit key if your provider supports it, and says it can take up to 48 hours to start working |
| DMARC | Tells receivers what to do with mail that fails SPF and DKIM, and sends you reports | Google: start with p=none, then move to quarantine and later reject; wait 48 hours after SPF and DKIM before adding it |
Microsoft's own page says these standards are interdependent building blocks, and that anything less than all of them gives weaker protection against spoofing. Google's Gmail rules show why it matters even for a small sender:
- Every sender to Gmail needs SPF or DKIM for its sending domain.
- Bulk senders (more than 5,000 messages a day to Gmail) need SPF, DKIM and DMARC, with the From domain aligned to the one that passes.
- Mail that fails may be delivered unexpectedly, marked as spam, or rejected with error 5.7.26.
A safe order: SPF and DKIM first, wait two days, then publish DMARC with p=none and an address for the reports (Google suggests a dedicated mailbox or group, since reports can be frequent). Read a week of reports. If all your real senders pass, tighten the policy. Do not jump straight to reject: a forgotten invoicing tool or newsletter service will start bouncing.
What you can check in LotsBusiness
LotsBusiness is the website, Google profile and business email for a local business, one subscription per business. It covers parts of these locks, so here is exactly where.
- A domain bought in LotsBusiness is registered in the owner's name, with free privacy protection where the domain ending allows it and a transfer lock. First-year and renewal prices are shown before you pay. LotsBusiness shows each bought domain's renewal date and price, and the renewal checkout opens 60 days before it is due. To move it out, ask for a transfer: our team emails you the transfer code and the steps.
- A domain you already own stays at your registrar. LotsBusiness reads its records, you confirm each one, and you switch the nameservers. Every record is then listed in plain words with the product that uses it. Records the website and email depend on are protected from removal, and an SPF record can gain senders but keeps the ones email needs. Every change keeps a snapshot, so Undo returns you to an earlier copy.
- Business email (powered by LotsMail) runs on your own domain, with unlimited mailboxes. When LotsBusiness runs the domain's DNS, it adds the mail records, verifies the domain and turns on receiving. On a domain it does not run, it gives you the ownership record to add and shows what is still missing. Setup steps are in How to Get a Business Email at Your Own Domain.
- Managing records is free. Linking the domain to your website or email needs a paid business: Starter covers 1 business for $120 a year ($10 a month) or $19 monthly, and pay as you go is $20 per business a month. Checked on 2 November 2026 on the pricing page.
LotsBusiness does not replace steps 2 and 4 at a registrar you use elsewhere: two-step sign-in and auto-renew are settings on that registrar's own account. For who owns what once a site is live, read Is LotsBusiness Safe? Who Owns the Site, Domain and Google Profile.
If you run client domains and email: your own checklist
Agencies and freelancers hold the keys to many businesses at once, so the same five locks apply with one more rule: the client should be the owner of record.
- Register in the client's name, or move it there. If a domain sits in your registrar account, a change of registrant triggers the 60-day transfer lock above unless the registrar lets you opt out first. Do it at the start of the project, not on hand-over day.
- Keep your own accounts locked. One compromised agency login with two-step sign-in off can expose every client domain you hold.
- Make hand-over a checklist. In LotsBusiness, hand-over moves the business, its website and its connected domains to the client's own account and plan; the part at an outside registrar stays with you to do. Steps are in How Agencies Get Client Sign-Off and Hand Over a Website, Domain and Google Profile.
- Agency price per client: Pro covers 5 businesses for $390 a year and Business covers 25 for $1,290 a year, which is $4.30 per business a month. Checked on 2 November 2026 on the pricing page.
If you already use ChatGPT or Claude
You do not need ChatGPT or any assistant for any of this: everything works in the dashboard. If you already use an assistant, you can connect it once through the LotsBusiness setup page and ask it to list a domain's records, show the domain status or check the email setup, with nothing changed until you confirm. It works with the AI agent you already use.
Your five-minute audit
- Open your registrar account. Is the registrant your business, and does the login email reach a person?
- Is two-step sign-in on for the registrar and every admin email account?
- Is the domain's status clientTransferProhibited?
- Is auto-renew on, and does the registrant email get read?
- Do SPF and DKIM exist, and is DMARC at least
p=nonewith reports going somewhere?
Save a note of where each setting lives. The day something breaks is the wrong day to find out.
FAQ
What is a domain transfer lock, and should I keep it on?
It is a setting at your registrar that tells the registry to reject requests to move the domain to another registrar. ICANN says it helps prevent unauthorized transfers. Keep it on, and switch it off only when you are moving the domain yourself.
What happens if my business domain expires?
Your website and email stop working. ICANN says registrars must send reminders about a month and a week before expiry. A registrar may offer a 1 to 45 day window to renew, and a deleted name has a 30-day Redemption Grace Period, then 5 days in PendingDelete before anyone can register it. Fees vary by registrar.
Do I need SPF, DKIM and DMARC if I only send a few emails?
Yes. Gmail asks every sender for SPF or DKIM, and senders of more than 5,000 messages a day to Gmail need all three. Mail that fails may be marked as spam or rejected. Microsoft says the three work together.
Which DMARC policy should I start with?
Start with p=none, which delivers everything and sends you reports. Google recommends this first, then moving to quarantine and later reject once your real senders all pass. Wait 48 hours after setting up SPF and DKIM before adding DMARC.
Who should own the registrar account, me or my web designer?
You, the business owner. The registrant should be your business and the login email should reach you. Changing the registrant later triggers a 60-day transfer lock unless the registrar lets you opt out first, so fix it early.
Can LotsBusiness handle the DNS records for my domain?
Yes, for a domain bought in LotsBusiness or one you already own and let LotsBusiness manage by switching its nameservers. It adds the website and email records, protects the ones those depend on and keeps a snapshot for Undo. Linking a domain to the website or email needs a paid business, from $10 a month billed yearly on Starter.
Sources, checked on 2 November 2026
- ICANN, Transfer Policy and FAQs for Registrants: Transferring Your Domain Name
- ICANN, About Change of Registrant
- ICANN, EPP Status Codes
- ICANN, 5 Things every Domain Name Registrant should know about the ERRP and FAQs for Registrants: Domain Name Renewals and Expiration
- ICANN, Whois Data Reminder Policy
- Google, Turn on 2-Step Verification, Set up SPF, Set up DKIM, Set up DMARC and Email sender guidelines
- Microsoft, How email authentication works in Microsoft 365 and Security defaults in Microsoft Entra ID