I bought a domain name — now what?

The short answer

Four things in the first hour, and none of them cost money. Open the confirmation email your registrar (the company you bought the domain from) sent you and click the verification link, because an unverified contact email gets the domain suspended. Turn on registrar lock and two-factor authentication so nobody can move the name out from under you. Decide whether auto-renew stays on. Check whether contact privacy is switched on and free at your registrar — at most it is.

Then, and only then, decide what the domain is for. You do not have to build a website. A domain can sit and do nothing, carry email addresses, redirect to a site you already run, host something you build, or simply be listed for sale. Those are all normal, and the right one depends entirely on why you bought it. This guide walks through the housekeeping first, because it is the part that goes wrong silently, and then through each option in plain terms.

Confirm your contact email, or the domain gets suspended

When you register a domain, your registrar has to collect and verify contact details for the registrant — the legal owner of record. Under ICANN's registrar accreditation rules (ICANN is the non-profit that coordinates the domain name system), that verification is mandatory on new registrations and whenever you change the contact email, and the registrar must suspend the domain if you do not respond. The window is short, commonly fifteen days, and the email itself states it.

The failure mode is boring and common: the message lands in spam, nothing appears wrong for two weeks, and then the site and email stop working. Search your inbox and spam folder now for a message from your registrar with “verify” in it. If there is none, log in and resend it from the contact settings.

While you are there, make sure the address on the account is one you will still be reading in three years. Every warning you will ever get about this domain goes to it, and a stale registrar email is the most common way people lose names they wanted to keep.

Lock the domain, and lock the account

Two separate protections, both free, both usually one click.

Registrar lock. This sets a status on the domain — ICANN's status code documentation calls it clientTransferProhibited — that stops the name being moved to another registrar until you deliberately unlock it. Most registrars enable it by default; check that yours did.

Two-factor authentication on the registrar account. That login is the master key to the domain. Anyone who gets into the account can point the name anywhere, read mail sent to it, or move it away. A password alone is not enough for an asset you cannot easily get back.

One quirk worth knowing early: for about 60 days after a new registration, or after any change to the registrant contact details, most registrars will not let you transfer the domain elsewhere at all. That is normal and temporary.

Decide about auto-renew now, not in eleven months

A domain registration is a renewable term, not a purchase. Miss the renewal and you lose it, and getting it back is expensive.

What happens after expiry is set by policy, not by your registrar's goodwill. Your registrar must send renewal notices roughly a month before, roughly a week before, and again within five days after expiry, under ICANN's Expired Registration Recovery Policy. Then comes an auto-renew grace period of up to 45 days, during which most registrars stop the domain working and park it. Once the registrar asks the registry to delete it, a 30-day Redemption Grace Period begins — the domain is dead, but you can still restore it for a fee. After that, five days of Pending Delete during which nothing can be done, and then the name is released to anyone.

The restore fee is the point: Namecheap publishes $88.48 to restore a .com including the renewal, and $90–$180 plus renewal is typical elsewhere — roughly eight to sixteen times what renewing on time costs. Leave auto-renew on and keep a working card on the account, because a dead card is the same as no auto-renew.

Check what renewal actually costs, too, which is not always what you paid. First-year promotional pricing is normal. A .com renews at $11.08 at the cheap end of the market, a .io at roughly five times that, and a .ai at about seven with a mandatory two-year minimum term.

Privacy: usually free, and it hides you from buyers too

Domain registration details are published in a public directory (historically called WHOIS). Contact privacy replaces your name, address, phone and email with a proxy service's details, which is why registering without it produces a reliable wave of spam calls and fake renewal invoices.

Privacy is free at Spaceship, Cloudflare, Porkbun, Dynadot, Namecheap, NameSilo and Squarespace. GoDaddy charges $9.99 a year, Network Solutions $12.99 and Register.com $9.99, on published 2026 rates. Paying for it is a self-inflicted cost; if your registrar charges, that is a reason to move rather than to pay.

One trade-off to understand rather than ignore: privacy hides you from everyone, including anyone who wants to buy the domain. If you might sell it one day, keep privacy on and give buyers another route in — a for-sale page or a marketplace listing.

Now: what did you buy it for?

Housekeeping done. The rest is honest self-assessment, because the five realistic paths need very different amounts of work.

• Build something on it — most work, most upside if you were going to build the thing anyway.
• Use it for email only — a couple of hours of setup, then nothing.
• Point it at a site you already have — ten minutes.
• Hold it — free apart from the renewal, and correct for a name you have a concrete plan for later.
• Sell it — free to list, but see the honest odds below.

If you bought the domain secondhand rather than registering it new, run one check first. A previously used name can carry history you did not create: email blocklist entries, a poor sending reputation, or a search penalty predating you. Look it up in the Wayback Machine to see what it used to be, and verify it in Google Search Console to check for a manual action. If the history is bad, picking a different name is usually cheaper than fighting it.

If you want to build something on it

Two moving parts, and the words are less frightening than they sound. Nameservers are the servers that answer “where does this domain live?” — your web host gives you two or three addresses and you paste them into your registrar's control panel. DNS records are the individual instructions those servers hand out: an A record points the website at a server, MX records point mail at a mail provider. Changing nameservers moves everything at once; editing records changes one thing at a time.

You do not need a big site to start. One page saying what the thing is and how to reach you is a legitimate destination, takes an afternoon on any hosted site builder, and makes the domain resolve — a domain that returns a browser error looks broken to everyone who tries it.

One thing not to believe, because it is repeated constantly and the evidence does not support it: building a website on a domain does not make the domain sell for more. No public dataset compares developed and undeveloped sale prices with name quality controlled for. Several well-regarded investors argue the opposite — that a developed site tells a would-be buyer the name is in use, so they never ask. Brad Mugford puts it plainly: “development can hinder sales.” Build because you want the thing being built.

If you only want email on it

You can have you@yourname.com working with no website at all. Web and email are delivered by completely separate DNS records, so a domain can receive mail and show nothing in a browser. This is normal and fully supported.

Four records do the work. MX records tell the internet which servers accept mail for your domain, and are the only ones strictly required to receive it. SPF lists which servers may send mail claiming to be from you. DKIM adds a signature so receivers can confirm a message really came from you. DMARC tells receivers what to do when those checks fail. Your provider supplies the exact values; treat all four as mandatory in practice, not just the first.

On published 2026 pricing, the cheap credible options are Zoho Mail's free tier (five users, one custom domain, webmail only — no IMAP or POP) and Migadu at $19 a year, billed flat per account with unlimited mailboxes rather than per user. Google Workspace Business Starter runs $7 per user per month on an annual commitment; Microsoft 365 Business Basic moves to $7 per user per month from 1 July 2026. Free forwarding at Cloudflare, Porkbun or Namecheap gets mail to an inbox you already have, but you cannot properly reply from the address.

One caution: do not start cold outreach from a brand-new domain. Receiving systems treat domains with no sending history cautiously, and a new name suddenly emitting volume looks exactly like a throwaway spam domain.

If you want it to point at a site you already have

This is called forwarding or redirecting, it is built into nearly every registrar's control panel, and it takes minutes. You own yourbrand.net and want visitors to land on yourbrand.com: set a forward, and anyone typing the first ends up at the second.

Pick permanent (301) if the move is for good, which it almost always is. Google's documentation states that the 301 and 308 codes mean a page “has permanently moved to a new location” and recommends a permanent server-side redirect whenever possible. Use temporary (302) only if you intend to point it back.

Do not use masked or frame forwarding — the option that keeps your domain in the address bar while showing someone else's page inside it. Search engines get nothing to follow, users cannot see what site they are on, many sites refuse to load in a frame at all, and showing users and search engines different things is what Google's spam policies call cloaking.

Two practical notes. Forwarding and email coexist happily, but some one-click registrar forwarding features overwrite your MX records — check them afterwards if you have mail set up. And a redirect from an unrelated domain does not move that domain's value into your site; consolidating a name you actually ran is the legitimate use.

If you bought it hoping to resell it

Then list it, because listing is free and takes ten minutes — and go in with realistic expectations, because the odds are not what the headlines suggest.

Basic listings on Afternic, Sedo, Spaceship SellerHub and Atom Standard carry no listing fee and no exclusivity, so the same name can sit on all of them at once and you pay only if it sells. Two mechanics matter from the start: set a fixed Buy It Now price rather than “make offer”, because only fixed prices appear in checkout flows at other registrars, and point the domain's nameservers at whichever marketplace you list on — Afternic charges 15% on its own aftermarket nameservers against 25% parked elsewhere.

The realism: experienced investors describe a 1–2% annual sell-through rate as a good result, and a 50-name portfolio going a year with no sales as completely normal. Most listed domains never sell. If you registered a name last week because it sounded valuable, the honest base rate says it probably is not, and the renewal only makes sense if you genuinely believe it would fetch four figures. Listing raises your odds from near-zero to low. It is not a plan for making money.

Frequently asked questions