There are few parts of the internet that have been around as long as the humble domain name.
Long before cloud computing, SaaS, smartphones, social media or AI, businesses were registering their names on the internet and pointing them towards a website. For more than three decades, domains have remained one of the basic building blocks of how organisations establish their identity online.
And yet, for something so fundamental, domains are surprisingly easy to overlook.
Most businesses will have a good handle on their principal domain. Beyond that, things can become rather less clear. There may be domains registered for previous brands, old campaigns, products that no longer exist, overseas operations, acquisitions or simply because someone thought it would be a good idea at the time. Some will be actively used, some redirected, some parked and others may have been forgotten altogether.
That might sound like an administrative nuisance rather than a cybersecurity issue. Increasingly, however, it is becoming difficult to separate the two.
The domain we stopped seeing
The problem is partly one of familiarity. Domains have become so fundamental to using the internet that we tend not to think about them. They are simply there, quietly directing people and systems towards the services they need.
But a domain is rarely just a name.
Behind it sits DNS, which determines where that domain and its subdomains point. There may be websites, applications, email services, cloud platforms, APIs and other third-party services connected to it. Certificates may rely on the domain and its DNS configuration to prove ownership and maintain secure connections. In other words, a domain can be the visible tip of a much larger piece of digital infrastructure.
The difficulty is that this infrastructure often evolves without anyone maintaining a complete picture of what has been created. Marketing launches a campaign and registers a domain. Developers create a subdomain for a new application. A cloud service is deployed and a DNS record is added. A project ends, the application disappears and the people involved move on.
The domain and its associated records may remain. That is where the problem begins.
A growing collection of warnings
Several developments over the past few weeks have provided timely reminders of just how much can sit behind something as apparently simple as a domain name.
AWS, for example, has been moving customers towards DNS-based validation for its public certificates. DNS validation allows AWS Certificate Manager to automatically renew certificates, provided the required DNS records remain in place.
On the surface, this is a technical change to certificate management. At a broader level, however, it illustrates just how deeply DNS has become embedded in the operation of modern digital services. Something that many organisations still regard as a relatively mundane administrative layer can determine whether a certificate is successfully validated and renewed, and therefore whether a service continues to operate securely.
At the other end of the spectrum is the threat posed by what happens when nobody is paying attention.
A recent CircleID analysis highlighted the problem of “dangling DNS” records: entries that continue to point towards cloud resources or other services after those resources have been deleted or abandoned. If an attacker can subsequently claim the abandoned resource, the organisation may unknowingly have a trusted domain or subdomain pointing towards infrastructure it no longer controls.
The potential consequences are obvious enough: phishing, malware, credential theft and brand impersonation. What makes the problem particularly uncomfortable is that there may be nothing obviously wrong with the domain itself. It is still registered to the legitimate organisation. The weakness sits somewhere behind it.
And automation is making these weaknesses easier to find.
What happens when a domain expires?
There is another assumption worth challenging: that a domain ceases to matter when a business stops using it. It doesn’t necessarily work that way.
Research from Infoblox, reported by ITPro, found that around 65,000 expired domains are being re-registered every day. Cybercriminal groups are actively acquiring these domains because they can inherit something that a newly registered domain does not have: history. That can include backlinks, traffic, search visibility and a degree of credibility associated with the domain’s previous life.
The scale of the activity is striking. One threat actor identified in the research is reported to have spent more than $7 million acquiring over 10,000 expired domains. The lesson isn’t that every business domain that reaches its expiry date is about to become a weapon. It is that a domain can retain value long after its original owner has stopped considering it valuable.
That changes the way we should think about domain portfolios.
An old domain isn’t necessarily an obsolete asset. It may still carry reputation, links, traffic or recognition. It may also be connected to old DNS records, certificates, email configurations or third-party services. Simply allowing it to expire without understanding those relationships can create consequences that aren’t immediately obvious.
The forgotten infrastructure problem
This is where domain management starts to look much more like governance than administration. Businesses have become accustomed to applying controls and ownership to critical infrastructure. We know who manages our servers, our cloud environments, our networks and our security systems. We monitor them, document them and increasingly subject them to formal policies.
Domains don’t always receive the same treatment. Responsibility can be spread across marketing, IT, security, development teams and external agencies. A domain may have been registered by an employee who left years ago, managed through an account nobody else knows about, or sitting alongside dozens of other registrations that no one has reviewed for years.
None of this is particularly unusual. In fact, it is probably the norm.
The problem is that attackers don’t necessarily distinguish between what an organisation considers important and what it has simply forgotten. They look for opportunities, and an unmanaged domain, DNS record or abandoned cloud resource may provide one.
Cloudflare’s latest DDoS reporting is another reminder that DNS itself is very much part of the modern attack landscape. The company’s H1 2026 reporting identified a significant increase in hyper-volumetric DDoS attacks, with DNS and CLDAP reflection among the major vectors involved.
The point isn’t that domain registration somehow causes DDoS attacks. It is that the infrastructure surrounding domains and DNS is no longer a passive part of the internet. It is infrastructure that attackers understand and actively target.
The domain blind spot
Perhaps the biggest issue is therefore not technical at all. It is visibility. Do you know exactly how many domains your organisation owns? Do you know why each one exists and whether it is still required? Do you know which registrar holds them and who has access to those accounts?
More importantly, do you know what sits behind them? Which domains have DNS records pointing towards old cloud environments? Which subdomains were created for projects that ended years ago? Which certificates depend on particular DNS configurations? Which domains are associated with brands or businesses that have since changed hands? And what happens to all of this when a project, employee, agency relationship or acquisition comes to an end?
These aren’t questions that necessarily have complicated answers. They are questions that require somebody to have responsibility for finding the answers in the first place.
That is the governance gap.
Taking control back
None of this means organisations need to become obsessive about their domain portfolios or retain every domain they have ever registered. In many cases, the right answer may be to rationalise them.
But rationalisation requires visibility.
A sensible approach starts with establishing a complete inventory and understanding the purpose of every domain. From there, organisations can identify unnecessary registrations, secure registrar accounts, review access permissions, check DNS records and confirm that the services to which those records point are still legitimate and under their control.
It also means treating retirement as carefully as creation. When a domain, application or campaign is no longer required, the decision should be deliberate. Simply allowing something to disappear from view can leave behind DNS records, certificates, links, references or reputation that continue to exist long after the original project has ended.
The humble domain has been part of the internet for so long that it is easy to regard it as background infrastructure. Perhaps that is precisely why it deserves another look.
The recent stories around expired domains, abandoned DNS, certificate validation and attacks against DNS are not isolated warnings. Together, they point towards a broader issue: organisations cannot protect what they don’t know they own, don’t understand or have stopped looking at.
Your domain portfolio may not be the most exciting part of your technology estate. But it is part of your digital identity, part of your infrastructure and, increasingly, part of your security perimeter.
It might be time to stop taking it for granted.
Let’s Talk About Your Domains
Know what you own. Know where it points. Know who controls it. vXtream can help you manage and protect your entire domain portfolio. Contact us now and start the conversation.
Image by skylarvision from Pixabay