Security checklist for Domain Renewal, Lock & Contacts

This article is part of the Spark Rack Domains knowledgebase and covers Domain Renewal, Lock & Contacts. This security checklist focuses on identity, authorization, credential handling, change evidence, recovery readiness, and safe communication with Spark Rack support.

The relevant customer area is Domains > Domain Details. It is used to manage domain renewal, registrar lock, and contact settings, including expiration, auto-renew, due dates, contacts, privacy, DNS options, forwarding options, and EPP authorization. Controls can differ by product, lifecycle status, account permission, domain state, payment method, or service configuration. When an action is not shown, confirm eligibility and permission instead of following an unrelated workaround.

Before you begin

• Confirm the exact domain spelling
• Have access to the registrant email and current registrar
• Know the expiration date and transfer status
• Protect the owner and registrant email accounts
• Understand whether the task is registration, transfer, DNS change, or hosting only
• Identify the exact item associated with domain renewal, registrar lock, and contact settings and confirm its current status.
• Write down the expected result and the current value before changing anything.
• Plan a rollback or recovery path for any action that can affect access, billing, data, routing, delivery, or availability.

Security control checklist

• Use a unique password stored in a reputable password manager and enable two-factor authentication for every account user who can access it.
• Give each person an individual account user instead of sharing the owner login. Remove access promptly when responsibilities change.
• Do not send passwords, two-factor recovery codes, full payment-card data, private keys, API secrets, or unredacted identity documents in a normal support reply.
• Review unexpected sign-in notices, permission changes, domain changes, payment changes, and credential resets as possible security events.
• After an access-related incident, rotate affected credentials, review delegated users and contacts, verify domains and DNS, and document the recovery actions.
• Confirm the exact authorization boundary for domain renewal, registrar lock, and contact settings; the ability to view an item does not always imply permission to change every setting.
• Treat values related to expiration, auto-renew, due dates, contacts, privacy, DNS options, forwarding options, and EPP authorization according to their sensitivity and operational impact.
• Use a clean, updated browser and verify the Spark Rack domain before signing in or entering payment or credential information.
• Preserve evidence of unauthorized or unexpected activity before deleting messages, resetting everything, or making broad changes.
• Maintain a tested recovery route that does not rely exclusively on the device, mailbox, domain, or credential currently at risk.

Response to suspected compromise

1. Use a known-clean device and network to secure the primary email account and password manager first.
2. Change the Spark Rack password and two-factor settings, and save new recovery information securely.
3. Review account users, contacts, payment methods, services, domains, DNS, mailboxes, credentials, and recent support conversations.
4. Revoke unknown access and rotate every secret that may have been viewed or reused.
5. Contact Spark Rack with the timeline and affected objects, without placing active secrets in the request.
6. Monitor the account and customer-facing services for recurrence.

Detailed operating procedure

Use this sequence as the baseline workflow for Domain Renewal, Lock & Contacts. Some steps may be informational when the selected product does not expose that exact control, but the verification and recordkeeping principles still apply.

1. Choose registration, transfer, or existing-domain use correctly
2. Enter registrant and administrative contact information accurately
3. For transfer, unlock the domain and obtain a fresh authorization code
4. Keep nameserver changes separate from registrar-transfer decisions
5. Review expiration, due date, auto-renew, lock, privacy, and supported domain options
6. Keep the registrar lock enabled except during a planned transfer
7. Monitor approval messages and re-lock the domain after completion or cancellation
8. Confirm that dependent settings still point to the intended destination and that no older value is overriding the new one.
9. Observe the result long enough to catch delayed processing, caching, queued work, or an intermittent failure.
10. Update internal documentation with the final value, date, owner, result, and any scheduled follow-up.

Verification checklist

• Domain spelling is exact
• Registrant email is reachable
• Auto-renew and payment arrangements agree
• Registrar lock is enabled during normal operation
• Nameservers and DNS remain intentionally configured
• The selected account item, identifier, domain, invoice, user, or service matches the original request.
• The portal no longer shows a pending or failed action unless delayed processing is expected and documented.
• An independent customer-side test produces the expected result.
• Related billing, security, notification, routing, and renewal settings remain correct.
• The previous value and rollback information are retained until the change is proven stable.

Common failure patterns

Use the symptom to narrow the investigation. Do not apply every possible fix at once.

• Hosting due date is confused with domain expiration
• Auto-renew is assumed to guarantee payment
• A domain is left unlocked indefinitely
• Contacts are changed immediately before transfer without considering registry restrictions
• An authorization code is shared insecurely
• The correct value was saved on the wrong item, environment, domain, mailbox, record, user, or billing account.
• A dependent setting, external provider, cache, client, or application continues to use an older value.
• The item is pending, suspended, expired, unpaid, cancelled, locked, or otherwise not eligible for the requested action.
• The change completed, but verification reused an authenticated session or cached result that hid the actual behavior.
• A temporary error was treated as permanent and followed by multiple conflicting edits.

Security, privacy, and data handling

• Use a unique password stored in a reputable password manager and enable two-factor authentication for every account user who can access it.
• Give each person an individual account user instead of sharing the owner login. Remove access promptly when responsibilities change.
• Do not send passwords, two-factor recovery codes, full payment-card data, private keys, API secrets, or unredacted identity documents in a normal support reply.
• Review unexpected sign-in notices, permission changes, domain changes, payment changes, and credential resets as possible security events.
• After an access-related incident, rotate affected credentials, review delegated users and contacts, verify domains and DNS, and document the recovery actions.
• Limit access to domain renewal, registrar lock, and contact settings to people who need it and review that access when responsibilities change.
• Before sharing evidence involving expiration, auto-renew, due dates, contacts, privacy, DNS options, forwarding options, and EPP authorization, redact information that is not required to diagnose the issue.

When to contact Spark Rack

Contact Spark Rack when the account shows a failed or inconsistent provider-side action, the required control is missing despite confirmed eligibility and permission, data restoration or protected logs are required, an unauthorized change is suspected, or the problem remains after a controlled rollback and independent verification.

• The account email address and the exact service, domain, invoice, ticket, or other item involved
• The page and section used, including the tab or subtab, without copying session tokens from the address bar
• The expected result and the actual result in separate sentences
• The approximate time of the last successful use and the first failure, including the time zone
• The exact error text, response code, bounce text, or visible status
• The changes made immediately before the issue, including old and new values when known
• The devices, browsers, networks, applications, or external tools used to reproduce the issue
• The troubleshooting steps already completed and the result of each step

Closeout and ongoing care

After Domain Renewal, Lock & Contacts is working, record the final state and remove any temporary access, files, forwarding paths, test records, or broad permissions that were created for the work. Review related expiration dates, renewal settings, payment status, contacts, and alerts so a future administrative event does not recreate the problem.

Keep the support history, change record, and safe verification evidence for as long as they are operationally useful. Periodic review is especially important after staff changes, migrations, major application updates, domain renewals, payment-method changes, or security incidents.