Business domain: renewal, transfer and protection

A domain is the address where customers find your company and the email address that receives inquiries. If you lose it, your website, your email and years of work on visibility in Google disappear. This happens more often than you might think, because nobody remembers one date a year.

In this guide I write about who should own the domain, how to set up renewal, what happens after it expires, how to transfer it to another registrar and how to recognize fake invoices. At the end there is a checklist you can print. As of 8 November 2026.

Who should be the domain registrant

The registrant (in the .pl system, “abonent”) is the person or company entered at the registrar as the user of the domain. The registrant decides about the domain, not whoever set it up technically. The registrant should be your company, not the website contractor, not an agency and not a friend who once helped out.

If the domain is registered to the contractor, you risk several things:

• when the cooperation ends, you may have trouble getting the address back,
• the contractor may close their business or stop responding to messages,
• invoices and renewal reminders go to them, not to you.

When ordering a website, put it in the contract that the domain is registered with your company’s details. I write more about website access and keys in the guide how to regain access to your website from an agency.

The registrar account: who has access

A separate matter is the account in the registrar’s panel. Set it up on a company email address, preferably a shared one (e.g., office@ or admin@), not the private address of one employee. Turn on two-factor authentication and store the password in a password manager.

It’s worth having at least two people with access: you and someone you trust in the company. If one of them falls ill or leaves, the other can still get into the panel.

Automatic renewal and an up-to-date email

The simplest protection against losing a domain comes down to two things: automatic renewal turned on and an up-to-date email address in the contact details. The registrar usually sends expiry reminders to exactly this address. If the address entered is on a domain that has itself stopped working, you won’t receive any message.

Check in the registrar’s panel:

1. The domain’s expiry date.
2. Whether automatic renewal is turned on.
3. Whether a working card is linked or you have funds in your account.
4. Which email address is entered as the contact address and whether it is on the same domain.
5. What the renewal price is. A domain that is cheap in the first year can be several times more expensive on renewal.

Payment cards expire too. Set yourself a calendar reminder a month before the domain and the card expire.

What happens after a .pl domain expires

When a domain is not renewed, the website and email stop working first. Then the domain goes through stages defined by the .pl domain registry, NASK (Naukowa i Akademicka Sieć Komputerowa). In the end it may be released and registered by someone else.

According to NASK (dns.pl), an unpaid .pl domain goes into the BLOCKED state for 30 days. During that time it doesn’t work, but you can still renew it with your registrar. Without renewal, the contract is terminated and the name returns to the pool of available domains. One thing matters: the faster you react after expiry, the easier it is to get the domain back. If someone takes it over, you will lose the address, and old links, your Google Business Profile and listings in directories will lead nowhere.

A taken-over domain is also sometimes used for fraud, for example to impersonate your company. It happens that someone buys an expired domain precisely to take advantage of its former reputation.

Transferring a domain to another registrar

Want to change registrars because yours is expensive or works poorly? Transferring a domain is usually simple, but it’s worth planning. First, make a list of things to secure.

Before the transfer

• Save the DNS records: A, AAAA, CNAME, MX, TXT (SPF, DKIM, DMARC). Take screenshots or export them.
• Check that the domain isn’t locked for transfer and that the registrant details are correct.
• Don’t transfer the domain on the day it expires. Leave some time to spare.
• Warn the person who handles your email so that an interruption doesn’t catch you by surprise.

The AuthInfo code step by step

To transfer a domain you need an authorization code called AuthInfo. This code confirms that the request comes from the owner.

1. In your current registrar’s panel, find the option to issue an AuthInfo code (sometimes called a “transfer code”).
2. Copy the code and don’t send it to anyone except the new registrar.
3. At the new registrar, place a transfer order and paste the code.
4. Confirm the transfer by following the instructions in the email that, for a .pl domain, the registrant receives.
5. After the transfer, check the website, email and DNS records.

Under NASK’s rules, the registrar must issue the AuthInfo code promptly at your request and cannot make this conditional on an additional fee. If it refuses or demands unclear fees, write to it officially and keep the correspondence. It will come in handy for a written complaint to NASK.

Technical details (processing time, effect on the expiry date, any fees) vary from registrar to registrar, so check them in your registrar’s terms of service.

Fake invoices and payment demands for a domain

Business owners receive emails and letters that look like domain invoices or “demands for payment for an entry in a register”. The sender often threatens loss of the domain, and the fee is higher than at your registrar. Sometimes it’s also a service that nobody in the company ordered.

What to look out for:

Swapping the bank account number on a genuine invoice works in a similar way. I describe how to protect yourself against it in the guide on a swapped bank account number on an invoice. If you doubt whether a demand is genuine, don’t pay and ask your registrar. Also report the suspicious message to CERT Polska (Poland’s national computer security incident response team).

Email and SSL certificate: separate dates

A domain is not just a website address. Your business email and SSL certificate depend on it. If the domain expires, all three stop working. Hosting and the SSL certificate have their own expiry dates, so write them down together with the domain.

After transferring the domain, check that emails reach you and that your messages don’t land in spam. I describe how to configure SPF, DKIM and DMARC in the guide on business emails going to spam.

Checklist

Print it and go through it once a quarter:

• [ ] The domain registrant is my company (the name and NIP, the Polish tax ID, match).
• [ ] I know my registrar and have a login for it.
• [ ] The account is on a company email, with two-factor login turned on.
• [ ] At least one person besides me has access.
• [ ] Automatic renewal is turned on.
• [ ] The card in the panel doesn’t expire this year.
• [ ] The contact address works and isn’t on the same domain.
• [ ] I know the expiry dates of the domain, hosting and SSL certificate.
• [ ] I have the DNS records saved (especially MX, SPF, DKIM).
• [ ] I know that my registrar issues the AuthInfo code, and I give it only to the new registrar.
• [ ] I check domain invoices in the panel, not via links in emails.

Summary

The domain should belong to the company and have automatic renewal and an up-to-date email address. A transfer with an AuthInfo code is simple if you save the DNS records beforehand. Check suspicious invoices in the registrar’s panel, not in the email.

If you would rather not have to think about it, I will take care of the domain, server and email for your company, from PLN 390 net a year. You can also add technical maintenance with monitoring. Write to me, I reply within 24 hours.