Let a domain expire and someone else gets your email
Old company domains still receive password resets, invoices and client email. Don’t let them lapse.
A company rebrands, moves to a new domain, and lets the old one expire a year or two later. Someone buys it for ten dollars, sets up a catch-all mailbox, and starts receiving what was meant for you: password reset links for accounts registered with the old address, invoices, messages from clients who never updated their contacts.
Researchers have shown this again and again. It works on cloud accounts, SaaS tools and even old domain admin accounts.
- Keep old domains renewed for many years after a change. It’s cheap insurance.
- Turn on auto-renew and registrar lock on every domain, with a payment card that won’t expire unnoticed.
- Move every account still using the old address to the new one.
- Publish DMARC reject and an empty SPF on domains you no longer send from.
A domain isn’t just a website address. It’s an identity.