The Annual Domain Portfolio Audit Checklist
Domain portfolios rot silently. Contact emails go stale, expiry dates drift from your notes, locks get left off after a transfer, renewal prices creep — and none of it announces itself until something breaks. An annual audit is the cheapest insurance in domain investing: a few hours that catch problems while they're still free to fix.
Block a morning, work the checklist top to bottom, and fix issues as you find them rather than listing them for later.
Ownership and account integrity
- •Confirm every registrar account email is an address you actively read — stale contact email is the top cause of silently lost domains.
- •Verify registrant contact details on the domains themselves are current; registrars are required to be able to reach you.
- •Check the payment card on file at every registrar, including the ones you rarely log into.
- •Confirm 2FA is enabled on every registrar account and the recovery methods are current.
- •List anyone else with account access and remove people and API keys that no longer need it.
Registry truth: dates, statuses, locks
- •Pull the registry expiry date for every domain via RDAP and diff against your records — investigate every mismatch.
- •Check status codes: everything ordinary should show clientTransferProhibited; anything showing clientHold, serverHold, or redemption-track statuses is an emergency.
- •Confirm transfer lock is ON for every name you're not actively transferring.
- •Confirm auto-renew settings match your renew/drop intentions — both directions matter.
- •This step is the strongest case for tooling: a tracker with live RDAP enrichment, like Sourdough, effectively runs this diff continuously instead of once a year.
Track your whole domain portfolio in one place
Sourdough is the system of record for domain investors: every domain, renewal date, cost, and sale across all your registrars. 7 days free, then $10/mo. $0 due today.
Money: renewal prices and cost basis
- •Record the current renewal price for every domain and flag anything that moved since last year.
- •Recompute cost basis per domain — acquisition plus cumulative renewals — and note names whose basis now exceeds any realistic sale price.
- •Total the portfolio's annual renewal drag and sanity-check it against last year's sales.
- •Export billing history from each registrar while you're logged in; some keep invoices visible only for a limited window.
DNS and usage health
- •Verify nameservers on every domain point somewhere intentional — parked, lander, or live site, not a defunct host.
- •Check that names you consider listed actually resolve to their lander or marketplace page.
- •Look for dangling DNS records pointing at services you've cancelled — a hijacking vector as well as a mess.
- •Confirm email routing on any domain that receives mail, especially domains used as registrar account addresses.
The output: a drop list and a fix list
A good audit ends with two artifacts: a fix list of everything broken (and when you fixed it), and a drop list of names that failed the would-you-buy-it-today test while you had their real costs in front of you. The audit is the natural moment for the annual pruning pass — the numbers are already on the table.
Frequently Asked Questions
How often should I audit my domain portfolio?
A full audit annually, plus a lighter quarterly reconciliation of registrar exports against your records. If you use a tracker that re-verifies registry data continuously, the annual pass shifts toward accounts, money, and DNS — the parts registry data can't see.
What status codes should my domains show?
For a normally held name, clientTransferProhibited (the standard transfer lock) is what you want to see. clientHold or serverHold means the domain is suspended and needs immediate attention; redemptionPeriod or pendingDelete means an expiry slipped past you.
What is the most common problem an audit finds?
Stale contact information — a registrar account pointing at an email you no longer read, or an expired card on file. It's invisible until a renewal fails or a warning goes unread, and it's a two-minute fix when caught in an audit.