Security finding
The domain registration expires soon, or DNSSEC is off
Security Error Severity: High
Part of the audit Domain and DNS. Finding id: security.domainRegistration.
What it costs you
When a registration lapses, the website and all mail stop. After the grace period anyone can register the name and receive your visitors and your mail, password resets included.
What to do
Renew now and turn on automatic renewal. Check that the registrar has a working payment method and a contact address someone reads.
What it checks
- Domain name expires soon
- Domain lookups are not digitally signed
How to fix it
Renew and make renewal automatic
- Log in at [registrar] and renew the domain for at least a year.
- Turn on automatic renewal and check the payment method has not expired.
- Make sure the registrar's reminders go to a shared mailbox, not to one person.
How to check: An RDAP or whois lookup of the domain shows the new expiry date.
Turn on DNSSEC
- Switch on signing at the DNS host.
- Then add the DS record it gives you at the registrar. Do it in that order.
How to check: dig +short DS example.com returns a record (use your own domain).
Thresholds
| Name | Default | Meaning |
|---|---|---|
domain_expiry_warning_days | 45 | Report a domain that expires within this many days. Adjustable default; not taken from a standard. |