What is a domain portfolio and how to manage one?

Sajjad
Domain
26 Oct, 2026

A domain portfolio is the full collection of domain names owned by one person or organisation, whether that's three domains for a small business or thousands held by an investor. Some portfolios exist to protect a brand, some support many websites and products, and some are held as investments to resell. Managing one well means keeping an accurate inventory, consolidating registrars, automating renewals, securing account access, keeping DNS consistent and regularly reviewing which domains are still worth paying for. Without that discipline, domains quietly expire, get hijacked or cost far more than they're worth.

Most organisations end up with a portfolio by accident: a product launch here, a campaign domain there, a few defensive registrations and some names bought by staff who have since left. This article explains the different kinds of domain portfolio, the problems that unmanaged portfolios cause, and a practical system for managing one, including an inventory template, a script to check expiry dates and locks across all your domains, and guidance on what to keep and what to let go.

Types of Domain Portfolio

Portfolios differ mainly in why the domains are held, which shapes how you manage them.

Brand and Business Portfolios

A company's portfolio usually includes:

Primary domains for its main websites and email.
Defensive registrations: alternative extensions, country codes and typos. See should you register multiple domain extensions.
Product and campaign domains for launches, events and adverts.
Legacy domains from old brand names, acquisitions or migrations that still redirect traffic.
Technical domains used for infrastructure, such as CDN host names, internal tools, email sending or test environments.

The value here is operational. Losing one of these can take a website or email system offline, or hand a lookalike domain to a phisher.

Investment Portfolios

Domain investors, sometimes called domainers, buy names they expect to sell at a profit or earn from. Their portfolios typically include:

Short, brandable or keyword-rich names.
Expired domains with existing traffic or backlinks.
Names in new TLDs that may grow in value.

They earn money through sales, leasing and sometimes advertising. Investors care about acquisition cost, renewal cost and sell-through rate, much like any other inventory business. What is a premium domain, what is domain parking and what is a domain backorder cover the main tools of that trade.

Agency and Client Portfolios

Web agencies and IT providers often manage domains on behalf of clients. The legal registrant should be the client, but the agency handles renewals, DNS and technical changes. Clear records of who owns what are essential here, especially when a client relationship ends.

Why Portfolios Need Active Management

An unmanaged portfolio fails in predictable ways:

Expired domains: A card on file expires, a renewal email goes to a former employee, and the domain lapses. Someone else may register it once the grace and redemption periods end. See what are the domain redemption and grace periods.
Hijacking: Old accounts with weak passwords, no two-factor authentication or unlocked domains are easy targets. How to protect your domain from hijacking covers the risks.
Dangling DNS: Records that still point at deleted cloud resources can be claimed by attackers. This is how subdomain takeover happens.
Wasted money: Domains nobody uses renew automatically year after year.
Lost ownership: Domains registered in a staff member's or agency's name are hard to recover when that person leaves.
Inconsistent security: Some domains have DNSSEC, email authentication and locks, while others have nothing.

How to Manage a Domain Portfolio

1. Build a Complete Inventory

You can't manage what you don't know about. Gather domains from:

Every registrar account you know of, including ones opened by former staff or agencies.
Finance records, by searching card statements and invoices for registrar names.
Your DNS providers, which list every hosted zone.
SSL/TLS certificate records, such as Certificate Transparency logs, which reveal host names your organisation has used.
Email systems, which show domains configured for sending.

Record each domain in a central register. A spreadsheet is fine for small portfolios. Larger ones may justify a dedicated portfolio tool or a register held in a database or Git repository.

A useful register includes:

Field	Example
Domain	`example.com`
Purpose	Primary website and email
Category	Primary, defensive, product, legacy, investment
Registrant	Example Ltd
Registrar and account	Example Registrar, account `ops@`
DNS provider	Cloudflare
Expiry date	2027-08-13
Auto-renew	Yes
Transfer lock	Yes
Where it points	Main site, or redirect target
Owner (internal)	Marketing team
Review decision	Keep, review next year, drop

The internal owner field matters more than it looks. Every domain should have a team or person responsible for deciding whether it's still needed.

2. Consolidate Registrars

Domains spread across many registrars and accounts are hard to track and harder to secure. Moving them to one or two registrars gives you:

One place to see expiry dates and statuses.
Consistent security settings, such as two-factor authentication and locks.
Simpler billing and often better pricing at volume.

Choose a registrar with good bulk management, an API, role-based access for teams and strong security options. What is a domain registrar explains what to look for. Some ccTLDs can only be registered through certain registrars, so complete consolidation isn't always possible.

When moving domains, follow the steps in how to transfer a domain to another registrar. Transfers of gTLDs usually add a year to the registration, so consolidation often costs little more than a normal renewal.

3. Standardise Registrant Details and Access

Registrant: Use the organisation's legal name and a shared role mailbox, such as domains@example.org, on a domain different from the one being registered where possible. See how to change registrant contact details.
Account access: Use team or role-based access rather than shared passwords, and remove people promptly when they leave.
Two-factor authentication: Required on every registrar and DNS account, preferably with an authenticator app or security key.

4. Automate Renewals and Monitor Expiry

Turn on auto-renew for every domain you intend to keep. See how to set up domain auto-renewal.
Keep at least two valid payment methods, or an account balance, so a single expired card doesn't cause a lapse.
Renew critical domains for several years at a time.
Align expiry dates where your registrar supports it, so renewals happen in predictable batches.
Don't rely only on the registrar's reminders. Run your own check.

This Python script reads a list of domains, looks each one up through RDAP, and reports expiry dates, registrars and whether a transfer lock is set. It uses the IANA bootstrap file to find the right RDAP server for each TLD:

import json
import sys
import urllib.error
import urllib.request
from datetime import datetime, timezone

BOOTSTRAP = "https://data.iana.org/rdap/dns.json"
HEADERS = {"Accept": "application/rdap+json", "User-Agent": "portfolio-check/1.0"}


def get_json(url: str) -> dict:
    req = urllib.request.Request(url, headers=HEADERS)
    with urllib.request.urlopen(req, timeout=20) as resp:
        return json.load(resp)


def rdap_servers() -> dict[str, str]:
    data = get_json(BOOTSTRAP)
    return {tld: urls[0].rstrip("/") + "/" for tlds, urls in data["services"] for tld in tlds}


def lookup(domain: str, servers: dict[str, str]) -> dict:
    base = servers.get(domain.rsplit(".", 1)[-1])
    if not base:
        return {"domain": domain, "error": "no RDAP for this TLD"}
    try:
        data = get_json(base + "domain/" + domain)
    except urllib.error.HTTPError as err:
        return {"domain": domain, "error": f"HTTP {err.code}"}
    except urllib.error.URLError as err:
        return {"domain": domain, "error": str(err.reason)}

    events = {e["eventAction"]: e["eventDate"] for e in data.get("events", [])}
    registrar = next(
        (
            item[3]
            for ent in data.get("entities", [])
            if "registrar" in ent.get("roles", [])
            for item in ent.get("vcardArray", [None, []])[1]
            if item[0] == "fn"
        ),
        "unknown",
    )
    expiry = events.get("expiration")
    days = None
    if expiry:
        exp = datetime.fromisoformat(expiry.replace("Z", "+00:00"))
        days = (exp - datetime.now(timezone.utc)).days
    return {
        "domain": domain,
        "registrar": registrar,
        "expires": expiry[:10] if expiry else "n/a",
        "days_left": days,
        "status": ", ".join(data.get("status", [])),
    }


if __name__ == "__main__":
    with open(sys.argv[1]) as f:
        domains = [line.strip().lower() for line in f if line.strip() and not line.startswith("#")]

    servers = rdap_servers()
    results = [lookup(d, servers) for d in domains]
    results.sort(key=lambda r: r.get("days_left") if r.get("days_left") is not None else 10**6)

    for r in results:
        if "error" in r:
            print(f"{r['domain']:<24} ERROR  {r['error']}")
            continue
        days = r["days_left"]
        flag = "RENEW" if days is not None and days < 60 else "ok"
        days_text = f"{days:>5} days" if days is not None else "    ? days"
        print(f"{r['domain']:<24} {r['expires']:<10}  {days_text}  {flag:<5}  {r['registrar']}")
        if "transfer prohibited" not in r["status"]:
            print(f"{'':<24} warning: transfer lock not set ({r['status']})")

Save your domains in a text file, one per line, then run:

python3 portfolio_check.py domains.txt

example-campaign.com     2026-11-30     35 days  RENEW  Example Registrar, LLC
example.dev              2027-02-12    109 days  ok     Example Registrar, LLC
example.com              2027-08-13    290 days  ok     Example Registrar, LLC
example.org              2028-10-09    714 days  ok     Another Registrar Inc.
                         warning: transfer lock not set (active)
example.co.uk            2029-04-02    888 days  ok     Example Registrar, LLC
example.io               ERROR  no RDAP for this TLD

Run it on a schedule, for example weekly with cron, and send the output to a shared channel or mailbox:

0 8 * * 1 /usr/bin/python3 /opt/domains/portfolio_check.py /opt/domains/domains.txt | mail -s "Domain portfolio report" domains@example.org

Some ccTLDs don't offer RDAP, so the script flags them for manual checking or a lookup with your registrar's tools. What is RDAP explains how the lookups work.

5. Lock and Secure Every Domain

Registrar lock on every domain that isn't actively being transferred. See what is domain registrar lock.
Registry lock for the handful of domains that would cause the most damage if hijacked, such as your main website and email domains.
DNSSEC where your registrar and DNS provider support it. See what is DNSSEC.
Privacy protection where personal data would otherwise be shown. Company domains often publish the organisation name anyway.

6. Keep DNS Consistent

Managing DNS for dozens of domains by hand leads to mistakes. Use templates or infrastructure as code so every domain gets the same baseline, and audit them regularly. How to manage DNS for multiple domains covers tools and approaches in detail.

For domains that don't send email, which is most of a defensive or legacy portfolio, publish records that stop spoofing:

$ORIGIN example.net.
@        3600  IN  MX   0 .
@        3600  IN  TXT  "v=spf1 -all"
_dmarc   3600  IN  TXT  "v=DMARC1; p=reject;"

A quick loop confirms each parked or redirected domain has a DMARC policy:

while read -r d; do
  case "$d" in ''|\#*) continue ;; esac
  policy=$(dig +short "_dmarc.$d" TXT | tr -d '"')
  printf '%-24s %s\n' "$d" "${policy:-MISSING}"
done < domains.txt

example.com              v=DMARC1; p=reject; rua=mailto:dmarc@example.com
example.net              v=DMARC1; p=reject;
example-campaign.com     MISSING

7. Decide What Each Domain Is For

Every domain should be doing a job. Typical choices:

Live site: Serves content directly.
Redirect: Forwards to a main site with a 301. See what is domain forwarding.
Parked: Held with a placeholder, common for investment portfolios.
Reserved: Held for a future project, with no content.

Avoid leaving domains pointing at old hosting or default pages. They look abandoned, may serve outdated content and can expose stale DNS records.

Reviewing and Pruning Your Portfolio

Once a year, review every domain against simple criteria:

Is it in use? Check traffic to the domain, including redirects, using server logs or analytics.
Does it protect something important? Primary extensions and close lookalikes of a strong brand usually stay.
Does it have backlinks or history? Legacy domains from migrations should usually be kept, because dropping them breaks redirects. See how to move your website to a new domain without losing SEO.
What does it cost? Premium renewals and expensive ccTLDs need stronger justification.
What's the risk if someone else registers it? If the answer is "they could impersonate us convincingly", keep it.

Letting Domains Go Safely

When you decide to drop a domain:

Remove it from any live services first, such as email sending, verification records, SSO, API callbacks and certificates.
Delete DNS records that point at your infrastructure.
Check that no important links, documents or printed material still use it.
Turn off auto-renew and let it expire, or delete it if your registrar allows.

Remember that dropped domains are watched by backorder services and can be registered quickly by anyone, including people who want to exploit old links or email addresses. If the domain has ever received email for your organisation, think carefully before releasing it.

Managing an Investment Portfolio

Investors face a different balance. The main levers are:

Acquisition discipline: Buy names with a realistic resale market, not just ones that feel clever.
Renewal costs: Annual renewals across hundreds of names are the biggest ongoing expense. Track cost per domain and drop names that haven't attracted interest over several years.
Pricing and listings: Set clear buy-now prices or minimum offers on marketplaces, and keep landing pages consistent.
Sale process: Use escrow for anything beyond small sales. See how to use domain escrow.
Records: Keep purchase prices, renewal history and sale prices for tax and accounting. Rules on how domains are treated for tax differ by country, so get local advice.

FAQ: Domain Portfolios

There's no minimum. Any collection of domains owned by one person or organisation is a portfolio. The management practices become important as soon as you have more than a few domains across different purposes or accounts.

Ideally yes, or as few as possible. It makes renewals, security and access easier to manage. Some ccTLDs are only available through certain registrars, so a second registrar is sometimes unavoidable.

Use your registrar's bulk export or API, or run an RDAP-based script that reads a list of domains and reports expiration dates. Schedule it to run weekly so nothing slips through.

Often, but check first. Remove it from email, verification records and other services, delete DNS records that point to your infrastructure, and consider whether someone else could misuse it once it's re-registered.

They can, but most speculative names never sell, and renewal fees accumulate every year. Successful investors are selective about what they buy and disciplined about dropping names that don't attract interest.

The company itself, using its legal name and a shared role email address. Domains registered in an employee's or agency's name can be difficult to recover later.

Conclusion

A domain portfolio is every domain you own, and whether it's a handful of brand domains or thousands of investment names, it needs the same basic care. Start with a complete inventory that records what each domain is for and who is responsible for it, then consolidate registrars, standardise registrant details and lock down account access.

From there, automate the routine work: auto-renew everything you intend to keep, check expiry dates and locks with your own script, apply consistent DNS and email security records, and review the whole portfolio once a year. Keep the domains that protect your brand or carry history, drop the ones that don't, and release them carefully. A managed portfolio costs less, stays secure and never surprises you with a domain that quietly disappeared.