A long-time Namecheap customer says his account was locked after he missed a single ID-verification email, and every domain in it stopped working, including the domains his account email ran on. His post on r/sysadmin reached the Hacker News front page with more than six hundred points. If you keep domains at Namecheap, or at any registrar, the useful part of this story is the dependency it exposes: the account that can lock your domains is often reachable only through those same domains.
TL;DR
- A customer of twelve years says Namecheap's email gave him 72 hours to complete ID verification. He was away, missed it, and came back to dead servers. The quoted email calls it a "routine account information accuracy check-up" and says the account "has been locked pending your response".
- His account's contact email lived on the domains that were disabled, so the lock also cut the channel Namecheap uses to reach him.
- Namecheap's own registration agreement mentions five business days for answering inquiries about your information. ICANN's registrar contract uses fifteen days. Namecheap has not said publicly which process it applied here.
- The agreement also lets Namecheap suspend every service in an account when it has grounds to suspend one domain or service. That clause is the blast radius.
- Practical step for everyone: put your registrar login email on a domain that registrar does not hold.
What happened to the Namecheap account
Everything in this section is the customer's account, posted by u/pinchitony on October 17. I could not see the original email, and the post does not name his domains or business.
He says he has been a Namecheap customer for twelve years, that all of his domains are renewals, and that the most controversial site among them is a forum that has shown only a placeholder screen for almost fourteen years. After a few days away he found his servers down. In his words: "Apparently I received an email from Namecheap that expected for me to comply with ID verification within 72 hours and I didn't reply on time." The post title calls it "a single email with a 72 hours termination notice".
He quotes the email's reason as follows:
...your account has been flagged to be a part of our routine account information accuracy check-up to establish whether your account information is currently accurate, complete, and up to date. As a result, your account has been locked pending your response to the requests for documentation below.
That is the whole stated reason. No abuse report, no payment problem and no legal order is mentioned in what he shared.
He then sent the documents. A day later he still had, as he put it, "no ETA, no reason, nothing, just 'thank you for your cooperation'". Live chat kept deferring to "the Risk management team" and told him that team does not do chat and works only through email.
Two details from the post are worth keeping because they show the process from the inside:
- The email change. He says it took about four hours in chat to get a backup email address added to the account, and that "they never requested ANY information to make sure it was indeed me, the account's owner, yet they still added my email." He has 2FA and had not logged in for about twenty days.
- The two addresses. Namecheap's website told him to write to the security address. He says the replies came from a separate compliance address, about twelve hours later.
When I checked on October 19, the post had no update saying the account was restored, and I found no public reply from Namecheap in the Reddit thread or the Hacker News discussion. So this is one customer's side of a story Namecheap has not addressed in public. Treat the specifics accordingly.
Why one locked registrar account takes down everything
Here is the chain, drawn the way it worked for him:
| Layer | What it depends on |
|---|---|
| Namecheap account | Login, 2FA, and a contact email for notices |
| Domains in the account | The account being in good standing |
| Websites and APIs | DNS for those domains |
| Business email | MX records on those domains |
| The account's contact email | One of those same domains |
The last row closes the loop. When the account was locked, his domains were disabled, his servers went down, his mail broke, and the inbox Namecheap writes to for account matters was one of the casualties. He told the thread: "My account's email relies on the domains they disabled, so I had to pay another host to set it up". He is also considering renaming hostnames so some clients stay online while he waits.
This setup is extremely common. Plenty of us register example.com, host mail on it, and then use me@example.com as the registrar login because it is the address we read every day. It works for years. It fails exactly when the registrar needs to reach you urgently.
How long does a registrar have to give you?
The customer says his email gave 72 hours. Two documents give other numbers, and they answer slightly different questions.
ICANN's baseline. The 2013 Registrar Accreditation Agreement, the contract every ICANN-accredited registrar signs, says in section 3.7.7.2 that a registrant's "failure to respond for over fifteen (15) days to inquiries by Registrar concerning the accuracy of contact details" is a material breach and "a basis for suspension and/or cancellation". Its WHOIS Accuracy Program Specification describes verifying an email address or phone number with a returned code. For the account holder, as distinct from the domain's registrant, it says the registrar "shall verify the applicable contact information manually, but is not required to suspend any registration."
Namecheap's own terms. The Namecheap Registration Agreement says in section 14: "Failure by you, for whatever reason, to respond within five (5) business days to any inquiries made by Namecheap to determine the validity of information provided by you, shall also be considered to be a material breach of this agreement." The same agreement asks you to monitor the account email, because you "may lose your rights to the domain name(s)" if you do not respond appropriately.
Put on one axis, that is fifteen days for ICANN's accuracy inquiries, five business days (about a calendar week) in Namecheap's general clause, and 72 hours in the customer's description of his email. ICANN's numbers are a floor for one kind of inquiry; a registrar can run additional risk or fraud processes under its own terms. Namecheap has not said which rule or process triggered this lock, so I cannot tell you that it broke any of them. I can tell you that a 72-hour window is short for someone who checks email once on a long weekend.
The contract sentence that explains the blast radius
The registration agreement has a clause under "Namecheap Rights" that matters more than the deadlines:
If we have grounds to terminate or suspend Service(s) with respect to one domain name or in relation to other Service(s) provided through your account, we may terminate or suspend all Service(s) provided through your account, including Service(s) to other domain names maintained by you with us.
Read plainly: a problem with one domain or one service can justify suspending every domain and service in the account. In this case the trigger was an account-level check, so all of his domains were in scope from the start. Again, Namecheap has not said it relied on this clause. It is simply what the contract allows, and you agreed to it when you registered.
The practical question is how many domains you are willing to put behind one account and one inbox.
What to change in your own registrar setup
This is my editorial advice, not Namecheap guidance, and none of it would have prevented an ID check. It shortens the time between a notice and your answer.
- Move the registrar login email off the registrar's domains. Use an address on a domain registered somewhere else, or a mailbox provider address you control independently. If every domain at the registrar goes dark, that inbox still works.
- Keep a current phone number on the account. ICANN's verification process can use phone as well as email, and support may need a second channel.
- Treat compliance and verification emails like an outage page. Filter them to something that notifies you, and know your registrar's actual compliance contact before you need it.
- Consider splitting critical domains across accounts or registrars. The account-wide suspension clause is the reason. One account per business-critical domain group limits what a single lock can reach.
Also in this episode: Let's Encrypt adds two remote perspectives
Registrars are one party that decides whether a domain is yours; certificate authorities are another. Let's Encrypt announced on October 15 that "we will make seven total validation requests, one from the primary datacenter and six from remote perspectives (previously four)." For validation to succeed, "the primary server and a quorum of remote perspectives must receive the correct challenge response."
The point is to make BGP route hijacks less useful: an attacker who briefly hijacks the route to your server might fool a check from one place, but fooling most of several distant vantage points at once is much harder. The change follows the CA/Browser Forum Baseline Requirements, which require at least five remote network perspectives from December 15, 2026. Staging starts Tuesday, October 27 and production Tuesday, November 10. Let's Encrypt says it expects "little to no impact to users". If your firewall blocks whole regions, validation failures are where you would notice.
Also in this episode: a .com price lawsuit names Verisign and ICANN
Last month I stamped Verisign's deletion of paid-up .name domains a REVERT. Now a class action, Kessler v. VeriSign (C.D. Cal., filed September 4), reached the front page of Hacker News. The plaintiffs' lawyers say Verisign's wholesale price for a .com went from $7.85 to $10.26 since 2021, that running a .com costs Verisign about $3, and that prices are projected to reach about $13.44 by 2030. They also note that every registrar pays the same wholesale fee, so it sits inside your renewal at Namecheap, Cloudflare or anywhere else. These are allegations; nothing has been proven in court.
Verdict: REVERT
If his version holds up, a 72-hour lock that also kills the inbox you need to answer it is broken design. Registrars have real verification duties. They should still leave customers a working way to reply, and a lock that disables every domain at once should come with a clear reason and a timeline.
FAQ
Why would Namecheap lock an account for ID verification?
The email the customer quoted calls it a routine account information accuracy check. Namecheap's agreement requires accurate account and WHOIS information and lets it treat unanswered inquiries as a breach. Namecheap has not explained this specific case publicly.
Can a registrar suspend all my domains because of one problem?
Namecheap's registration agreement says that if it has grounds to suspend one domain or service, it may suspend all services in your account, including other domains.
How long does ICANN give registrants to answer accuracy inquiries?
The 2013 Registrar Accreditation Agreement treats failure to respond for over fifteen days as a basis for suspension or cancellation. Registrars can apply their own additional processes.
Sources
- Customer's post, r/sysadmin (u/pinchitony)
- Hacker News discussion 50142866
- Namecheap Registration Agreement
- ICANN 2013 Registrar Accreditation Agreement
- Let's Encrypt: two additional remote perspectives
- Hacker News discussion 50150809
- Kessler v. VeriSign case page, Hagens Berman
- Hacker News discussion 50148441
This article expands on an episode of **The Daily Diff, a five-minute daily video on what shipped and what broke in tech.
Watch the episode · Subscribe on YouTube · the written diff lands in your inbox every morning at thedailydiff.dev.
Top comments (0)