Domain and DNS Hygiene for Law Firms: The Asset Nobody Owns

Every email the firm sends and every visit to its website depends on one small asset: the domain name. If it lapses, the website goes dark and email stops arriving. If someone else gains control of it, they can intercept inbound mail, impersonate the firm, and redirect the website wherever they like.

Despite that, the domain is often the least managed asset a small firm has. It was registered years ago by a web designer, a former office manager, or a partner's personal account, and nobody has looked at it since. Here is a practical hygiene routine.

Renewals and expiration

Domain expiration is one of the most avoidable outages there is, and it still happens. Renewal notices go to an email address nobody monitors, the credit card on file expires, and the grace period passes quietly. Turn on auto-renew, register for multiple years where practical, keep a current payment method on the account, and make sure renewal notices go to a role address, such as a shared admin mailbox, rather than one person. Put the expiration date on the firm's calendar anyway, a month ahead, as a backstop.

Who owns the domain

The registrant of record should be the firm, not the web vendor, not the marketing agency, and not an individual employee. Log in to the registrar account and confirm the registrant organization, the contact email, and who holds the credentials. Vendors can be given delegated access to manage DNS without owning the domain.

This matters most when a relationship ends. A vendor dispute, a retiring partner, or a departed staff member who controlled the registrar account can leave the firm unable to change its own DNS, or worse, unable to renew. Fixing ownership while relationships are good is far easier than recovering a domain afterward.

Lock the account and the domain

Enable two-factor authentication on the registrar account, using an authenticator app or security key rather than text messages if the registrar supports it, and limit who has logins. Turn on registrar lock, often called transfer lock, which blocks unauthorized transfers to another registrar. Some registrars and registries also offer stronger registry-level locks that require additional manual verification before critical changes. For a firm whose email depends on its domain, that extra friction is often worth it.

Inventory your DNS records

Export the full DNS zone and go through it line by line. For each record, someone should be able to say what it does and whether it is still needed. Typical findings include records pointing at a former website host, verification records for services the firm canceled, mail records for a provider it left years ago, and subdomains aimed at cloud resources that no longer exist. That last category is a real risk: a dangling record pointing at a deprovisioned service can sometimes be claimed by someone else, who can then host content on the firm's subdomain.

Keep the inventory as a short document that records each record's purpose and owner, and update it whenever a vendor is added or removed. It also makes email authentication work (SPF, DKIM, and DMARC) much easier, since the same inventory tells you which services send mail as the firm.

DNSSEC basics

DNS Security Extensions add digital signatures to DNS data so that resolvers can confirm the answers they receive came from the domain's authoritative source and were not forged or altered along the way. Many registrars and DNS hosts now support it with a single setting, but enabling it takes care: the signing at the DNS host and the corresponding record at the registrar must match, and a later move to a new DNS provider has to be planned so validation does not break and take the domain offline. If your providers support it cleanly, it is a reasonable step. It should not come ahead of ownership, locks, and two-factor authentication.

Old domains are still live

Firms accumulate domains: a former firm name, a merged practice, a practice area site, common misspellings. Each one is either an asset or a liability. If an old domain still receives mail, someone has to monitor it, because clients and opposing counsel may still use addresses they saved years ago. If it sends no mail, publish records stating so (an SPF record that authorizes no senders and a DMARC reject policy), so criminals cannot spoof it.

Legacy web domains should redirect permanently to the current site rather than serving a stale copy or a parked page full of ads. And think carefully before letting an old domain expire. Once released, it can be registered by anyone, who may then receive email still being sent to it.

Next step

Domain ownership, registrar security, and DNS inventory are part of the LexAIAdvisors website risk baseline. If you are not certain who controls your firm's domains today, that alone is a good reason to request an audit at /audit.