Your domain is the one asset you can't reissue: the expiry & hijack checklist

Your domain is the one asset you can't reissue. Servers restore in an afternoon; email providers swap before lunch. Lose the name itself and the website, the mail (every invoice, every password reset) and a dozen SaaS integrations stop at once — and getting it back is a legal dispute, not a restore job.

The full checklist just went up on ops-notes (canonical link below). The short version:

The five ways businesses lose a domain

1. The expired card — auto-renew fails on a reissued card, alarms go to a dead mailbox, and a resale farm buys the name within minutes of drop.
2. The phished transfer — a fake "registrar validation" email harvests your EPP/auth code.
3. The account takeover — reused password + SMS 2FA beats the registrar without ever touching the registrar.
4. The inside change — attacker flips nameservers, mail and checkout redirect to their clone. No transfer, nothing you're watching for.
5. The frozen founder — the domain sits in one person's personal Gmail and the business never actually owned its name.

The controls (about an hour of setup)

• Multi-year registration, auto-renew ON, calendar alarms at 60/30/7 days with the renewal card's last-4 in the note.
• Transfer lock ON. Treat the EPP code like a password reset link: generated only from your logged-in session, never handed out on request.
• Nameserver-change emails are incidents, not notifications — that's the flip that takes your mail.
• The circular trap: recovery email must NOT live on the domain it protects. One independent domain or external mailbox breaks the lockout class.
• Registrant = the business entity, role mailbox (domains@), MFA by app or key, two people can log in.
• Ten-minute quarterly drill: RDAP lookup → expiry >90 days, clientTransferProhibited, nameservers match the record → log in, test recovery mail → audit tab → renewal card still right.

If it moves anyway (first hour): don't tip the hijacker; if you still hold the account, revert nameservers first, then rotate credentials; if a transfer completed, call the losing registrar's fraud team — a domain within 60 days of transfer can't move again, which contains the damage. And warn finance the same week: "your mail is bouncing" is the setup for a payment-change request, and the callback rule is the only thing between a DNS incident and a wire incident.

Full page with the one-page domain record template and the quarterly drill: Domain Expiry & Hijack Protection Checklist

If you want the fill-in-the-blanks version for the next 2AM page: Ops Starter Kit — Incident Response for Small Teams ($14) · Automation Starter Pack · all kits — code HIVE-LAUNCH30 takes 30% off.