Expired Domains and Brand Protection: Buying Back a Name You Let Go

The riskiest thing you can do with a domain is stop paying for it. A domain you let go keeps receiving mail addressed to it, keeps carrying every link and citation ever aimed at it, and becomes registrable by anybody once it drops. The new owner inherits all of that by default, without doing anything clever.

Which produces two pieces of advice that pull in the same direction. If a domain of yours has already lapsed and somebody could pass themselves off as you with it, buying it back is usually worth more than any SEO use of the same money. And if you are retiring a domain, do not retire it by letting it expire. Keep it and turn it off properly, which costs a renewal fee a year and four DNS records.

What can somebody do with a domain you abandoned?

Australia's domain administrator, auDA, states the two main risks plainly in its guidance on letting unused domain names expire:

A new registrant of your abandoned name could potentially use that domain name to pose as your company, aiming to defraud your customers and putting your reputation at serious risk.

and

The registrant of that domain name can intercept information sent to email accounts attached to that old domain name, potentially giving them access to extremely sensitive information.

The email one surprises people, so it is worth being concrete about the mechanism. Mail routing follows the MX records of whoever controls the domain now. Every invoice, every password reset, every mailing list, every notification still addressed to an old address at that domain is delivered to the new owner's mail server. Nothing is hacked. The mail simply arrives.

Beyond mail there are three quieter versions of the same problem:

• Residual trust in accounts. Old addresses often still sit on account recovery, mailing lists and vendor portals long after anyone remembers they exist.
• Dangling DNS records. A record still pointing at a service you no longer control is a known takeover route, studied since at least "All Your DNS Records Point to Us" by Liu, Hao and Wang at ACM CCS 2016, and again in "Cloud Strife" at NDSS 2018, which showed stale records could be used to obtain a valid certificate for a domain the attacker did not legitimately control.
• Machine traffic. Devices, apps and integrations keep calling home to a hostname long after the company behind it is gone.

Has this actually happened?

Repeatedly, and the clearest write-ups come from researchers who did it deliberately and reported what arrived.

Gabor Szathmari re-registered domains belonging to Australian law firms that had merged or dissolved, and stood up a mail server on them. CSO Online's account of the work, published 5 June 2020, describes what came in as "a steady stream of confidential information, including bank correspondence, invoices from other law firms, sensitive legal documents from clients, and updates from LinkedIn." He worked to return the domains to their original owners.

The machine-traffic version is newer. Krebs on Security reported on 30 July 2026 that Bitsight researcher Pedro Falé registered an expired domain and found it "was previously used for telemetry, periodically collecting full hardware information and the entire list of installed apps from tens of thousands of H96 streaming sticks plugged into television sets around the globe." One expired domain, tens of thousands of devices still reporting to it.

Neither researcher did anything sophisticated. They paid a registration fee.

Is buying back a lapsed domain worth it?

Worth it when:

• It was yours and it carried mail. Any domain that ever had mailboxes on it is the strong case, for the reason above.
• Customers still type it or follow links to it. Old business cards, printed material, partner sites, citations in articles. Every one of those is a person who will land on whatever the new owner puts there.
• It is close enough to your brand to be mistaken for it. A former product name, a former trading name, a common misspelling you once owned.
• It has links pointing at it that you can genuinely serve. A secondary benefit, not a reason on its own. If the links are the only argument, this is an SEO decision and redirecting it is the relevant guide.

Not worth it when the name is generic, nobody associates it with you, and there is no mail history. Defensive registration has no natural stopping point, and a policy of buying every near-miss variant of your brand is a subscription with no end. Buy the ones a customer could plausibly confuse with you, and stop.

If someone else has already registered it and is using it in bad faith, that is a dispute rather than a purchase, and ICANN's Uniform Domain-Name Dispute-Resolution Policy is the route. It is slow and it needs a trademark argument, which is why holding the domain is so much cheaper than recovering it.

How to retire a domain properly

Keep the registration. Turn off the function. The UK's National Cyber Security Centre publishes the canonical recipe in its guidance on protecting parked domains, and its warning is the reason to bother: "Unprotected, non-email sending domains can just as easily be used for email spoofing and phishing, allowing fraud and thus damaging trust in your organisation."

Four records, on any domain that will never send mail again:

example.com.               TXT   "v=spf1 -all"
example.com.               MX    0 .
_dmarc.example.com.        TXT   "v=DMARC1; p=reject; rua=mailto:dmarc@yourrealdomain.com"
*._domainkey.example.com.  TXT   "v=DKIM1; p="

An SPF record permitting no senders, a null MX saying the domain accepts no mail, a DMARC policy of reject with reports going somewhere you read, and an empty wildcard DKIM key saying nothing here signs mail. The NCSC's point is that these are set once and then need no maintenance.

Then the rest of the checklist:

1. Turn on auto-renew and check the card on file. Most lapses are an expired credit card, not a decision.
2. Audit dangling DNS. Remove records pointing at services you no longer run before somebody else claims the other end.
3. Redirect the web traffic to wherever the content lives now, and keep the redirects running indefinitely.
4. Find every dependency before you switch anything off. Mailboxes, aliases, service accounts, API callbacks, certificates, anything using the domain for identity.
5. Set a calendar reminder to check it annually. A domain you never think about is one you will eventually not renew.

What if it has already dropped?

Move fast, and know which stage you are at. A gTLD that has just expired passes through a grace period and a 30-day redemption period during which only the previous registrant can restore it, usually for a substantial fee, before it enters pending delete and drops to the open market. The full timeline covers both gTLDs and .au.

If it is still in redemption, call your registrar today and pay the restore fee. It is cheaper than every alternative.

If it has dropped and nobody has taken it, register it immediately. Use the expired domain checker to confirm the registry state and the domain report for its current DNS, certificate and blacklist status.

If somebody else has it, you are into either a purchase negotiation or a dispute, and meanwhile you should be hardening what the domain used to protect: rotate any account still using an address at it, remove it from recovery options, and tell customers which addresses are current.

Using the Revised directory for this

Our directory is built for people looking for domains with a link history, but it works as a monitoring surface for a name you care about too, and it is free to search whether or not you are signed in.

Search for the name, or filter Basics to the relevant TLD and use the text search. Listings show the mask at the name's true length, with the first letter, final word and hyphens visible, which is enough to recognise a name you already know. Under History, filter on how recently availability was checked so you are looking at rows swept recently rather than stale ones.

Two honest caveats. We list domains with a link history, so an unremarkable name of yours may never appear. And we cannot reserve anything: a domain can be registered by someone else between our last check and yours, which for a defensive purchase is the whole game. If the name matters, register it now rather than watching it.

What to do with an expired domain covers the other five things you might do with one once it is yours.

FAQ

What happens to email sent to an expired domain? It follows whatever MX records the current owner publishes. If somebody else registers the domain and runs a mail server, mail addressed to your old addresses is delivered to them. Nothing needs to be hacked.

Should I renew domains I no longer use? For anything that ever carried mail or was associated with your brand, yes. Both auDA and, per its guidance, the Australian Cyber Security Centre point toward renewing old domain names indefinitely rather than letting them lapse.

How do I safely park a domain I still own? Publish an SPF record permitting no senders, a null MX record, a DMARC policy of reject and an empty wildcard DKIM key, as the UK's NCSC recommends. Then redirect the web traffic and leave it.

Can I get my domain back after it expires? During the 30-day redemption period, yes, from your registrar, for a restore fee that is typically much higher than a renewal. After it drops, it is first come first served.

Is it worth buying misspellings of my domain? The ones a customer could plausibly type or a phisher could plausibly use. Beyond that the list is infinite and the spend has no ceiling.

Someone registered my old domain and is impersonating us. What now? Preserve evidence, warn your customers, and take advice on a UDRP complaint or the equivalent for your TLD. In parallel, remove the domain from every account recovery path it still touches.