Defensive registrations
The .net, the .co, the hyphenated version, the common misspelling. Bought in one session years ago on whatever card was to hand, and never thought about since.
Domain portfolio management
You cannot monitor a domain you do not know you own.
Nobody sets out to run a domain portfolio. It accumulates: a defensive registration, a campaign name, an acquired company, a domain a salesperson bought on a personal card. This page is how to find all of them, what to write down about each, and how to make the ones you are not using safe to ignore.
A free account holds as many domains as you want to put in it. The report needs the account first, and there is no card.
Where they come from
Five ways a portfolio happens to you.
Campaign and product names
A landing page for a promotion that ended in 2022. It still resolves, it still has DNS, and it still accepts mail unless somebody told it not to.
Acquisitions and rebrands
The old company name, kept as a redirect. Usually still registered in the old owner's account, at a registrar nobody in the current business has a login for.
Somebody bought it themselves
A salesperson, a contractor, an agency. On a personal card, under a personal email, with auto-renew tied to a payment method the business cannot see. This is the one that expires.
Vendor-provisioned names
A booking system, a support portal, an email platform that registered something on your behalf. It exists in someone else's account and shows up in your DNS as a CNAME nobody can explain.
Building the list
Five passes, and only one of them is technical.
Do all five. Each one finds a category the others cannot, and the last one finds the domains that cause the outages.
Registrar account exports
Log in to each registrar you know about and export the domain list. Every registrar offers this, and it is the only complete list of the names it holds.
Finds: Everything at that registrar, including names you forgot were there.
The card statements
Search two years of business card and bank statements for registrar names. Then search personal reimbursements for the same.
Finds: Registrars you did not know you had an account with. This is usually where the surprises are.
Certificate Transparency logs
Search a public CT log index such as crt.sh for your company name. Because publicly trusted certificates must be logged to be trusted by browsers, anything that ever had HTTPS is in there.
Finds: Subdomains and adjacent names that got a certificate — staging sites, vendor-hosted portals, and old campaign domains.
Your own DNS zones
Export the zone file for each domain you do know about and read every CNAME, MX and SPF include.
Finds: The third-party services in the chain, each of which is a place another name might be registered on your behalf.
Ask, once, in writing
Send one message to the whole company asking whether anyone has ever bought a domain for work. Say plainly that nobody is in trouble.
Finds: The ones no technical method will ever reach, because they are in a personal account with a personal email.
What to record
Nine fields per domain, and why each one earns its place.
Registrar and the account it sits in
You cannot renew a domain you cannot log in to, and finding out which account holds it during an outage is the expensive way.
Who pays, and on what card
The payment method has its own expiry date. It is a second clock, and it does not send reminders.
Expiry date, from the registry
The registry record is authoritative. A registrar dashboard is a cached view of it.
Auto-renew state, per domain
It is a per-domain toggle, not an account setting, and the odd one out is invisible in a list of forty.
Registrar lock state
clientTransferProhibited blocks the transfer-out half of a hijack. It is free and it shows in the RDAP status codes, so it is checkable from outside.
Nameservers
Where DNS is actually served. Frequently not where anyone assumes, especially on names that moved during a rebrand.
Does it send mail?
Decides whether the domain needs a real SPF and DKIM setup or the parked-domain records further down this page.
Does it serve a site, or redirect?
A redirect still needs a valid certificate. An expired certificate on a redirect domain produces a browser warning on a name your customers were told to type.
Who to call
One named person per domain. A list with no owner column is a list that describes the problem rather than solving it.
The names you are not using
Parked-domain hygiene, in five records.
An unused domain is not neutral. It is a name your customers half-recognize, with no owner watching it, which is exactly what someone spoofing your business wants.
Publish SPF -all and DMARC p=reject
A domain that sends no mail should say so in DNS. v=spf1 -all and a DMARC policy of reject tell every receiving server that any mail claiming to be from that name is forged. There is no rollout risk because there is no legitimate mail to break.
Publish a null MX
A single MX record with priority 0 pointing at a dot, defined in RFC 7505, means this domain accepts no mail at all. It stops backscatter and makes the intent unambiguous to senders as well as receivers.
Do not leave a wildcard A record
A wildcard on a parked domain means every name anyone invents under it resolves to your server. That is a free subdomain for anybody who can point a CNAME at it.
Keep the certificate valid, or stop serving HTTPS
A redirect domain with an expired certificate is worse than one that does not answer at all, because the browser interstitial is the last thing a customer sees before deciding your business is not real.
Turn the registrar lock on and leave it on
Parked domains are the ones nobody watches, which makes them the ones worth stealing. The lock costs nothing.
How DomainGuard handles a portfolio
Unlimited domains on every plan, including the free one.
Adding one is never refused
No plan caps how many domains an account holds. Put the whole list in on day one, including the parked ones, because the list is the thing you were missing.
What a plan buys is attention
How many domains are re-checked without being asked. A free account does none of that on a schedule; it scans when you press the button. Starter watches 25, Pro 100, Enterprise unlimited. Domains over that line still scan on demand and still accept edits, and the oldest ones keep the automation.
One view, any registrar
Every check reads the registry, public DNS and the public certificate logs, so it does not matter where a name is registered or who hosts it. Nothing is installed and no registrar credentials are asked for.
Questions people actually ask
How do I find domains nobody remembers buying?
Three passes. Export the domain list from every registrar you have an account with. Search two years of card statements for registrar charges, including personal reimbursements. Then search a public Certificate Transparency index such as crt.sh for your company name, which surfaces anything that ever had an HTTPS certificate. Finish by asking the whole company in writing, because the ones held in a personal account will not appear any other way.
Should I consolidate everything at one registrar?
Usually yes, for the same reason you keep one list: a registrar can only tell you about names it holds, so a split portfolio has no complete view anywhere. Transfers are free of drama but not instant, and a name cannot be transferred within 60 days of a previous transfer or, at most registrars, within 60 days of registration. Move them a few at a time, well before renewal dates.
What should a parked domain look like?
SPF of v=spf1 -all, DMARC of p=reject, a null MX record, no wildcard A record, registrar lock on, and either a valid certificate or no HTTPS listener at all. That combination means the name cannot be used to send mail as you and cannot quietly host something you did not put there.
Does DomainGuard charge per domain?
No. Every plan, including the free one, holds unlimited domains and will check any of them on demand. What a plan buys is how many are watched without being asked: none on free, 25 on Starter at $6.99 a month, 100 on Pro, unlimited on Enterprise. A free account still gets dark-web breach checks and alerts when a vulnerability is published for software found on your sites; everything else waits for you to press scan.
Can I separate client domains from my own?
Not yet in the way an agency would want. Today an account holds one list, and people managing domains for other businesses generally run a second account per client so the alerts land with the right person. Grouping inside a single account is something we are working on, and the product is young enough that telling us what you need is worth doing.
Keep reading
Expiration monitoring
The expiry clock stage by stage, and the five ways auto-renew fails.
DMARC monitoring
Reading an aggregate report, and locking down domains that send no mail.
Domain impersonation
How a lookalike registration shows up, and what to do about it.
What domain monitoring is
The five layers a domain is made of, and how each one fails.
DNS change monitoring
Catching a record edit before somebody tells you email stopped.
The MCP server
Ask Claude about your own portfolio, connected to your account.