Before paying any domain renewal, compare the sender with the registrar named in a WHOIS lookup and on last year's charge. Turn on auto-renew there, keep the card current, and ignore letters from anyone else.

An envelope that looks like a bill

An envelope arrives addressed to the business. Inside is what looks like an invoice: your domain name in bold, an expiry date a few months away, prices for one, two or five years, and a payment slip.

It is not from the company your domain is registered with. It is from another company, offering to take over the registration, usually at a much higher price than you pay now.

The explanation is usually there, in the small print. The letter works because it lands on the desk of whoever pays the bills, looking like one more bill to pay.

Emails do the same job, in far greater numbers.

What paying it actually does

Paying is usually treated as agreement to move the domain to the sender.

A follow-up then asks for the steps that make a transfer possible: switching off the lock at your current registrar and passing on a transfer code.

Done in good faith by somebody who thinks they are renewing, those steps move the domain. It then renews at the sender's price, through an account the business never knowingly opened.

The website and email usually keep working throughout, which is why it can go unnoticed for a year.

The versions to recognise

The last is the one that does the damage. The others cost money; that one hands over the domain, because the code is what a registrar requires before letting a domain leave.

Why hidden WHOIS makes it worse

Since the GDPR took effect last May, most registrars have hidden the owner's name, address and email in the public WHOIS record, the lookup that shows who holds each domain.

Many owners took that to mean their details are now private. So a letter that arrives with the domain, the business name and the right mailing address seems to come from somebody they already deal with.

It does not. Those mailing lists were built years ago, from WHOIS records when they were public and from business directories, and an address that was right in 2015 is usually still right.

The privacy is real but recent, and it did nothing to the lists already made. If anything, it made the letters more believable.

Finding your actual registrar

A WHOIS lookup still shows one thing clearly: the registrar's name. It is listed even when the owner's details are hidden, on any registrar's lookup page or on CIRA's for a .ca address.

Last year's renewal charge on the business card or bank statement names the company too, and the two should match.

Whoever looks after your website should be able to say in one line. Once you know the name, a notice from any other company can be dealt with in seconds.

A worked example

An electrical contractor's office manager opened a letter in late 2017 that looked like the domain renewal. It had the company's domain, its address and an expiry date, so she paid it with the month's invoices.

A few weeks later an email explained how to finish the renewal: log in to the current registrar, switch off the lock, and send the code shown there. She followed it, since it looked like part of the same job.

The domain moved. The website and email kept working, so nobody noticed until last autumn, when a renewal arrived from an unfamiliar company at several times the old price.

The web company then found the domain sitting in an account nobody at the business could log in to. Getting the code and moving it back to a registrar account in the business's name took weeks.

The office manager now keeps the registrar's name pinned above her desk. Any other name on a renewal notice is not a bill.

Auto-renew, and the card behind it

Most registrars offer automatic renewal. With it on, the domain renews itself before expiry, and any letter claiming a renewal is due can be ignored with confidence.

Auto-renew fails quietly when the card on file expires. Update it whenever the business card is replaced, and point the account's contact email at an address somebody reads.

Renewing for several years at once also cuts the number of renewal moments, which is the number of chances for confusion.

The lock and the code

Registrars can lock a domain against transfer. While the lock is on, no transfer can begin, whatever anybody pays or signs.

Check that it is on, and treat the transfer code like a password. Nobody else needs it unless you have decided to move the domain yourself.

An email asking you to switch off the lock, when you have not chosen to move, is the clearest warning sign there is.

If you have already paid

Contact your actual registrar first, confirm the domain is still there, and make sure the lock is on. Send no codes, and follow no instructions from the other company.

Then talk to your bank or card company about the payment, and keep the letter and any emails. If the domain has already moved, whoever maintains your site can bring it back; it takes time, but it is routine.

The counter-case

Not every renewal notice from an unfamiliar name is a trick.

A web company that registered the domain for you may invoice the renewal in its own name, and a reseller may appear on the statement under a name other than the registrar's.

That is why the check is against your own records rather than a list of known senders. If the name matches what you pay each year, the notice is genuine.

Everything else goes in the recycling, after one look at the registrar's name.

Before the next letter arrives

  1. Look up your domain's registrar by name.
  2. Compare it with last year's renewal charge.
  3. Turn on auto-renew at that registrar.
  4. Update the card and the contact email.
  5. Confirm the transfer lock is on.
  6. Tell whoever opens the mail.
  7. Never send a transfer code unless moving deliberately.

Step six is the one that actually stops the letter working. The owner may know the registrar's name, but the person who pays the invoices is the one who needs to.

The registrar is one of the accounts covered in every login your website depends on.

Frequently asked questions

Is the domain renewal letter a real invoice?

Usually not. It is typically an offer from another company to take over the registration at its own price, with the explanation in the small print.

What happens if we pay it?

Paying is usually treated as agreement to transfer the domain. A follow-up then asks you to switch off the lock and send a code, which completes the move.

How do I find our actual registrar?

A WHOIS lookup still shows the registrar's name even when owner details are hidden. Last year's renewal charge on your statement should name the same company.

Why does hidden WHOIS make these letters convincing?

Owners assume their details are now private, so a letter with the right address seems to come from somebody they deal with. The mailing lists were built years earlier.

What does the transfer lock do?

While it is on, no transfer can begin. Keep it on, and treat the transfer code like a password, used only when you have chosen to move.

What if we already paid one?

Contact your actual registrar, confirm the domain is locked, send no codes, and talk to your bank about the payment. Keep the letter and any emails.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Letter asking you to renew your domain?

Do not pay it yet. Send us the domain and we will confirm who your registrar actually is.

Start a Conversation