Your charity’s old domain could be serving spam

Domain names are easy to forget. They renew once a year or every few years, often on a card belonging to someone who has since left, with reminders going to an inbox nobody checks. When one lapses, a charity’s website and email stop working within a month, and a few weeks later anyone can register the name. Old charity domains are popular with spammers and gambling sites, because they come with years of trust and links already attached. It’s Trustees’ Week, so here’s what trustees need to know.

What happens when a .uk domain expires

Nominet, which runs the .uk registry, follows a fixed timeline once a domain passes its expiry date:

Notice who those reminders go to: the registrant contact. If that’s a former trustee, a web designer you no longer use, or an email address on the very domain that has just stopped working, nobody sees them. Other endings, such as .org and .com, follow different timelines, but the principle is the same.

Why someone would want your old domain

A charity domain that has been around for years has links pointing to it from councils, partners, funders, news sites and directories. Those links carry trust in search engines, and that trust is what some buyers are paying for. Nominet has said that buyers of lapsed names often choose them based on backlinks and SEO ratings.

Google treats this as spam. Its “expired domain abuse” policy covers domains bought and repurposed mainly to manipulate search rankings, and one of its own examples is products sold “on a site previously used by a non-profit medical charity”. That doesn’t stop it happening: it just means Google may eventually stop ranking the result.

The examples go back years. In 2002 the Poetry Society lost its .org.uk domain after missing a renewal, and it was used for gambling links. In 2020, The Register reported that the Help to Buy scheme’s helptobuy.org.uk domain had been left to expire, re-registered for under £10 and later auctioned for £40,251.

The risks for your charity

• Your supporters land somewhere they should never be. Old links in leaflets, emails, partner websites and search results lead to whatever the new owner puts there, under a name people associate with you.
• Email still arrives. Anyone who controls the domain can receive email sent to it. If your social media, CRM, banking or other accounts were registered with addresses on that domain, the new owner may be able to reset their passwords.
• Your reputation takes the hit. People rarely notice that a domain has changed hands. They see your charity’s name next to a casino or a scam.

How to protect your charity’s domains

• Register it in the charity’s name, not a trustee’s, a volunteer’s or your web designer’s.
• Turn on auto-renew, paid with an organisation payment method rather than someone’s personal card. This is also the National Cyber Security Centre’s advice.
• Renew for several years at a time. Registrars can renew .uk domains for up to ten years.
• Send reminders to a role address that isn’t on the same domain, such as a shared mailbox elsewhere, so they still arrive if the domain itself has a problem. This is our advice rather than an official rule, but it closes the gap that catches most charities out.
• Keep control in-house. The NCSC recommends managing domains yourself rather than leaving them with your web hosting company, and protecting the registrar account with two-step verification.
• Keep renewing old domains after a rebrand. Redirect them to your new site. A few pounds a year is cheap insurance against your old name being reused.
• Know what a registry lock does and doesn’t do. Nominet’s Domain Lock stops unauthorised changes, but it does not stop a domain lapsing. Only renewing does that.

Check your charity register entry too

The website address on your charity’s register entry is often the first place people look. When we checked the addresses recorded on the register for Bristol-area charities, 17.9% were wrong on first contact: dead, parked or pointing somewhere else. Make sure yours is current, and that it doesn’t still list a domain you’ve let go. See the research.

Five questions for your next trustee meeting

1. Which domain names does the charity own, including old ones?
2. Who is the registrant, and is it the charity?
3. When does each one expire, and is auto-renew switched on?
4. Where do renewal reminders go, and does someone read that inbox?
5. Which important accounts use email addresses on our domains?

Domain security is part of a wider picture. Our guide to email spoofing after the Beacon breach explains how to stop people sending email pretending to be you.

How we can help

When we build or take over a charity’s website, we check who controls the domain, when it expires and how its email is set up, and we flag anything at risk. If you’d like us to look at yours, get in touch, or see our WordPress care plans.

Questions trustees ask