Domain Registration, Renewal, DNS Delegation and Transfer

At a glance#

• Purpose: Standard procedures for registering, renewing, delegating and transferring domain names.
• Applies to: gTLDs (.com, .net, .org) and ccTLDs including .com.np and .np.
• Risk: High — an expired or mis-delegated domain takes email and websites offline instantly.
• Time: Registration 30 minutes; transfers 5–7 days.

Overview#

Domains are the one part of the estate where a missed calendar entry causes a complete outage that no amount of server work can fix. A lapsed domain stops mail and web simultaneously, and recovery can involve redemption fees running to hundreds of dollars.

This article covers the four operations we perform: registration, renewal, delegation changes, and registrar transfers.

Warning: Never let a production domain rely on a single person's email address for renewal notices. Use a shared mailbox that the team monitors. Domains have been lost because renewal reminders went to someone who had left.

Domain lifecycle#

Understanding the stages explains why urgency changes so sharply near expiry:

Warning: Services frequently stop working the day a domain expires, well before it is actually lost. Do not treat "we are still in the grace period" as safe.

Part 1 — Registering a domain#

1. Confirm availability#

whois example.com | grep -iE "No match|Domain Name:"

For .np domains, availability must be checked through the Mercantile registry portal — whois coverage is unreliable for that ccTLD.

2. Register with correct contact details#

Register through the approved registrar with:

• Registrant: the legal company name, not an individual.
• Admin and technical contacts: shared team mailboxes.
• Auto-renew: enabled.
• Registrar lock: enabled.

Note: .com.np and .np domains are administered by Mercantile Communications and require documentary evidence — a company registration certificate for organisational domains. Allow several working days for manual approval, unlike gTLDs which register instantly.

3. Record it in the domain register#

Every domain must be recorded centrally with:

Set a calendar reminder 60 days before expiry, with a second at 30 days.

Part 2 — Renewing a domain#

1. Check expiry across all domains#

for d in example.com example.net example.org; do
  printf "%-25s " "$d"
  whois "$d" 2>/dev/null | grep -iE "Registry Expiry Date|Expiration Date" | head -1
done

For a scripted early-warning check:

#!/bin/bash
# warn if any domain expires within 60 days
for d in $(cat /etc/domains.list); do
  exp=$(whois "$d" | grep -iE "Registry Expiry Date|Expiration Date" | head -1 | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2}')
  [ -z "$exp" ] && { echo "$d: could not determine expiry"; continue; }
  days=$(( ( $(date -d "$exp" +%s) - $(date +%s) ) / 86400 ))
  [ "$days" -lt 60 ] && echo "WARNING: $d expires in $days days ($exp)"
done

2. Renew#

Renew through the registrar control panel. Renewing early does not lose time — the new period is added to the existing expiry date.

3. Confirm the renewal took effect#

whois example.com | grep -i "Expiry Date"

Do not rely on the confirmation email alone. Confirm in whois, and update the domain register.

Part 3 — Changing DNS delegation#

Delegation is which nameservers the parent zone points at. Getting this wrong causes intermittent, hard-to-diagnose failures.

1. Prepare the new nameservers first#

Before touching the registrar, confirm the new servers already serve the zone correctly:

dig SOA example.com @ns1.newprovider.com
dig A example.com @ns1.newprovider.com
dig NS example.com @ns1.newprovider.com

All must answer authoritatively with the correct data.

Warning: Changing delegation to servers that do not yet hold the zone takes the domain offline immediately, and the fault will persist in caches after you correct it.

2. Lower TTLs in advance#

At least 24 hours before the change, reduce record TTLs to 300 seconds on the current nameservers.

3. Update nameservers at the registrar#

In the registrar control panel, replace the nameserver entries. This updates the parent zone, typically within 15 minutes to a few hours depending on the TLD.

4. Verify the delegation#

# what the parent zone now publishes
dig NS example.com @a.gtld-servers.net +norecurse

# what the new servers say
dig NS example.com @ns1.newprovider.com

These must match.

5. Keep the old servers running#

Leave the old nameservers serving the zone for at least 7 days. Resolvers holding cached NS records will keep querying them, and switching them off early causes failures for a subset of users.

Part 4 — Transferring to another registrar#

Prerequisites#

A transfer will be rejected unless all of these are true:

• The domain is more than 60 days old and has not been transferred in the last 60 days.
• Registrar lock is disabled.
• The domain is not within 60 days of a recent registrant change.
• The admin contact email is reachable — the approval goes there.
• The domain is not expired or in redemption.

1. Prepare at the losing registrar#

1. Disable registrar lock (also called clientTransferProhibited).
2. Disable WHOIS privacy — it hides the admin email the approval is sent to.
3. Confirm the admin contact address is one you can access.
4. Request the authorisation code (EPP code / auth code / transfer key).

whois example.com | grep -i "status"

clientTransferProhibited present means the lock is still on.

2. Record the current DNS configuration#

Warning: Transfers frequently reset nameservers to the gaining registrar's defaults, which takes the domain offline. Export the full zone before starting.

dig AXFR example.com @ns1.example.com > /root/example.com-zone-backup.txt

If AXFR is refused, record each record type manually:

for t in SOA NS A AAAA MX TXT CNAME SRV CAA; do
  echo "--- $t ---"
  dig $t example.com @ns1.example.com +noall +answer
done

3. Initiate at the gaining registrar#

Submit the transfer request with the auth code and pay the transfer fee. This normally adds one year to the registration.

4. Approve#

An approval email goes to the admin contact. Approve it. Without approval most gTLD transfers still complete automatically after 5 days, but explicit approval is faster.

5. Confirm and restore configuration#

whois example.com | grep -iE "Registrar:|Expiry"
dig NS example.com +short

Check the nameservers immediately. If the transfer reset them, restore from the backup taken in step 2.

6. Re-secure the domain#

• Re-enable registrar lock.
• Re-enable WHOIS privacy if it is your policy.
• Enable auto-renew at the new registrar — it does not carry over.
• Update the domain register.

Verification#

After any of the above:

# registration state and expiry
whois example.com | grep -iE "Registrar:|Expiry Date|Status"

# delegation consistent
dig NS example.com +short

# services actually resolving
dig A example.com +short
dig MX example.com +short

# site responding
curl -sI https://example.com | head -1

Confirm mail flow separately by sending a test message in and out — MX problems are silent until someone reports missing email.

Rollback#

Troubleshooting#

Related#

• DNS Troubleshooting: dig, Propagation and Common Failures
• BIND9 / NAMED DNS Server – Complete Administration Guide
• Change Primary IP of cPanel