Your account recovery email is the last way back into almost every account. If it sits on your own domain, all those accounts depend on that domain. If it expires, or someone takes over your registrar account, they can receive mail to your addresses and reset your passwords. Auto-renewal, 2FA at the registrar and a second recovery address prevent that.
Running email on your own domain is a good idea. It makes you independent of any one mail provider, you can switch without changing addresses, and with a catch-all you can trace data leaks. The price is a new responsibility that rarely gets mentioned: your domain becomes the master key for account recovery by email.
Why the account recovery email is the weak point
Nearly every service has a “forgot password” link that sends a reset link to your recovery email. Whoever can read that message gets into the account without your password. On services without two-factor sign-in that’s the whole story; on many others too, because 2FA can be reset the same way.
With a webmail address, that route depends on your account with the provider. With your own domain, it depends on three things at once:
| Component | What can go wrong | Consequence |
|---|---|---|
| Domain registration | Expiry, failed renewal payment | Domain becomes available; someone else registers it |
| Registrar account | Takeover via a leaked password | Attacker changes your MX records |
| Mailbox | Takeover via phishing | Attacker reads reset emails |
The first one is the underestimated risk. It needs no attacker choosing you specifically. It only needs an expired credit card and a renewal reminder sent to the very address that has just stopped working.
What happens when a domain expires
For generic TLDs like .com, ICANN’s Expired Registration Recovery Policy sets a minimum. Registrars must send renewal reminders roughly a month and a week before expiry, and another shortly after. Once the domain expires, the registrar often holds it for some weeks. It then enters the registry’s 30-day redemption grace period, during which the previous registrant can still restore it, usually for a fee. After that comes about five days of pending delete, and then anyone can register it.
What happens to your website and email in that window is the registrar’s decision. Some point the domain at a parking page immediately, and from that moment no more email reaches you.
Country-code domains follow their own registry rules. DENIC, which runs .de, keeps deleted domains in a 30-day redemption period during which only the last holder can re-register them. Other registries differ, so check yours.
You can see a domain’s status from the command line:
$ whois -h whois.verisign-grs.com example.com | grep -iE 'expir|status'
Registry Expiry Date: 2027-08-13T04:00:00Z
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibitedIf you see redemptionPeriod or pendingDelete, act today.
Who registers expired domains
Expired domains aren’t re-registered by chance. Drop-catching services watch for expiring names and register them the instant they become free. Domains with backlinks, traffic or an email history are the most attractive. Whoever gets one can set up a catch-all mail server and watch what arrives: newsletters, invoices, password resets. Security researchers have demonstrated this repeatedly in public.
The rule that follows: a domain with logins attached must never reach the deletion stage. Not even if you “don’t really use it any more”. As long as any account still uses an address on that domain, keep paying for it.
Locking down the registrar account
Your registrar account is at least as important as your mailbox. Someone who takes it over can change your MX records and route all mail for your domain to their own server. You’ll find out when the mail stops.
So for the registrar account:
- A unique random password from your password manager, used nowhere else.
- Two-factor sign-in, ideally with a passkey.
- A contact address that isn’t on the domain itself. Otherwise the “your domain is expiring” warning goes to the mailbox that is about to stop working.
- Alerts for DNS changes, if your registrar offers them.
Two recovery routes, not one
A single recovery address is a single point of failure. For the accounts that matter most (Google, Apple, Microsoft, your bank, your password manager), register two routes: the address on your domain and a second one, such as an actively used webmail address or a phone number. Many services also offer recovery codes. Print them.
There’s a trap with the second address: some providers delete webmail accounts after long inactivity. Sign in now and then.
If you lose the domain
If someone else has registered your domain, treat it as an emergency. Change the email address on every account that uses your domain, starting with email, banking and your password manager. The process resembles the response to a leak, covered in email in data breach: what to do. If the domain is still in its redemption period, contact your registrar immediately. Legal routes such as ICANN’s UDRP exist mainly for trademark holders.
If you used per-service addresses as described in catch-all email address, the entries in your password manager now tell you which address belongs to which account.
Prevention is cheap
Measured against the risk, the effort is tiny. A .com with a fixed renewal price costs €14.99 a year at betadomain, with no first-year teaser and no mark-up afterwards. If you’d like to renew several years ahead, the domain price list shows what that means for .co.uk or .net, and DNSSEC can be enabled for your domain in the same account. Check today whether your domain is set to auto-renew, and if you don’t have one yet, find a domain you’ll keep for the long haul.
Step by step
- Turn on auto-renewalEnable automatic renewal at your registrar and keep a payment method on file that won't expire in the coming months.
- Secure the registrar accountGive the registrar account its own random password and turn on two-factor sign-in, ideally a passkey or authenticator app.
- Use an outside contact addressSet the registrar contact email to an address that isn't on the domain itself, so renewal warnings arrive even if the domain stops working.
- Add a second recovery routeGive your most important accounts a second recovery email or phone number, and store their recovery codes offline.
- Inventory your accountsRecord in your password manager which accounts use addresses on your domain, so you know what is affected in an emergency.
- Check DNSSEC and transfer lockEnable DNSSEC for the domain and keep the registrar transfer lock switched on.
Found your domain? You can check and register it directly at register a domain – yearly price from €2.99.
FAQ
How long do I have after my .com domain expires?
Usually several weeks. Registrars often hold an expired gTLD domain for a while, after which the registry's 30-day redemption grace period applies, followed by about five days of pending delete. How long email keeps working during that time depends on the registrar.
Are country-code domains like .co.uk or .de different?
Each registry sets its own rules. DENIC, for example, keeps deleted .de domains in a 30-day redemption grace period during which only the last holder can get them back. Check your registry's policy rather than assuming gTLD rules apply.
Should my recovery address be a free webmail account instead?
As a second address, yes; as the only one, not necessarily. A webmail account you never log into may eventually be deleted for inactivity. The safest setup is your own domain with auto-renewal plus a second address you actually use.
Can someone grab my domain deliberately when it expires?
Yes. Drop-catching services register expiring domains the moment they become available, and domains with traffic or email history are especially attractive. A domain that has logins attached should never reach the deletion stage.