Domain and email after shutdown: why letting them lapse is risky

What happens to a company domain after shutdown?#

A company domain that is not renewed after shutdown expires and, after the registrar's grace and redemption steps, returns to the open market where anyone can register it. Grace periods and recovery fees vary by registrar and domain extension, so check your registrar's terms instead of assuming you have time.

Expired domains with an operating history attract resellers and people who want the inbound traffic. Whoever registers the name can set up email on it and receive messages sent to any address at the old company, from the billing inbox to the founder's own address.

Before worrying about expiry, check who controls the registrar account. In many small companies the domain was registered by a former employee or a web agency under a personal or agency login. Move it into a company-controlled account, with the wind-down contact as the registrant and billing owner, turn on the registrar's transfer lock and two-factor authentication, and only then change anything else.

Why a lapsed domain is a security risk#

A lapsed domain is a security risk because addresses on that domain are still tied to accounts, contracts and people's trust. The new owner does not need to break into anything; the messages simply arrive.

Founders tend to underestimate how many systems use the company address as the recovery route. Banks, payroll providers, state tax portals, the registrar itself and every SaaS tool the team signed up for are common examples.

• 1Password resets: recovery links for banking, payroll, tax and SaaS accounts go to the address on file.
• 2Sign-in with Google or Microsoft: accounts created with company logins may become recoverable through the domain.
• 3Customer and vendor mail: late invoices, warranty claims, contract notices and personal details keep arriving.
• 4Impersonation: a new owner can send mail that appears to come from the old company to former customers.
• 5Domain verification: some services let whoever controls the domain's DNS records claim the organization's account.
• 6Records access: admin accounts for archived systems may be tied to addresses that no longer exist.

The rule: keep the domain until three jobs are done#

The domain rule is simple: keep the domain and at least one monitored mailbox until records are exported, account recovery is moved and final notices have arrived. Only then decide whether to transfer, sell or let the name lapse.

A practical approach is to prepay renewal for longer than you think you need, turn on auto-renew with a payment method that will stay active and store the registrar login with the person handling post-closing matters.

What to do with company email accounts#

Company email accounts should be exported before the email plan is cancelled, because providers such as Google Workspace and Microsoft 365 typically delete data from cancelled accounts after a period set in their terms. Check which export and retention tools your plan includes, and read the provider's documentation before you cancel anything.

After export, a common setup is a single paid mailbox or shared mailbox that receives forwarded mail from the old addresses, with an automatic reply that gives the new contact route. Former employees' mailboxes can be converted or forwarded rather than deleted outright, subject to the company's privacy notices and any legal holds.

• 1Export every mailbox, including shared and former-employee accounts, in a standard format.
• 2Forward key addresses such as billing, support and the founders to the monitored inbox.
• 3Add an automatic reply explaining that the company has closed and how to reach the wind-down contact.
• 4Remove access for former staff and keep one admin account with strong two-factor authentication.
• 5Write down which provider, plan and admin account control the domain's email settings.
• 6Once nobody needs to send mail from the domain, ask IT to publish SPF and DMARC records that tell receiving servers to reject mail claiming to come from it, which makes impersonation harder while you still hold the name.

Keep, transfer, sell or let lapse?#

The choice among keeping, transferring, selling or letting the domain lapse depends on whether anyone still needs to receive mail at it and whether the name has value to a successor. Selling early is the riskiest move, because the buyer inherits every message still addressed to the old company.

Illustrative: a roofing contractor's domain after closing#

Illustrative: a fictional family roofing contractor closes after the owners retire. The office manager plans to cancel the website, Microsoft 365 and the domain in the same month to stop recurring charges. Housecall Pro, QuickBooks Online, the payroll provider and the state tax portal all use company addresses for login recovery.

The wind-down advisor changes the order. Mailboxes and job histories are exported first, account recovery moves to the owner's personal address, and the domain is renewed with forwarding into one shared mailbox. Over the following months that mailbox receives a warranty claim on an old roof, a final payroll tax notice and a vendor refund. Only after dissolution is accepted and the retention schedule is covered does the owner let the domain go.

Why exported records may still matter after closing#

Exported records may still matter after closing, which is one more reason not to rush the domain and email shutdown. Job histories, estimates, support threads and warranty decisions show how a business actually handled its work, and some AI developers license operational records like these once personal and customer details are removed. Mailboxes are usually the hardest to clear for that use, so the structured systems tend to matter more.

SourceX lets closing companies check fit using metadata only, before any files are shared. If records qualify, the SourceX five-step transaction covers Supply, Rights, Preparation, Approval and Delivery; the records are licensed, not sold, and the owners approve each step. Keeping the domain and the exports intact preserves that option while counsel decides what must be retained or deleted.