The first week after payment

Day one: confirm what actually arrived

Open the registrar account and check the name is listed against the buyer's account rather than pending. Then check three fields against the agreement: the exact spelling, the expiry date, and the sponsoring registrar.

Run an independent lookup as well. WHOIS and RDAP show the registrar of record and the status codes, which is the outside view rather than the control panel view. A name that shows as transferred in one place and not the other is a transfer still in progress, not a completed one.

Record the moment. A screenshot of the domain overview page, with the date visible, is the evidence that the seller performed. Keep it with the rest of the paper trail.

Day one: take the account out of shared hands

Assume every credential involved in the sale is compromised, because in a sense it is: it was shared, emailed or typed into a marketplace at some point.

1. Set a new password on the registrar account, generated rather than chosen.
2. Enable two factor authentication, using an authenticator application or a hardware key rather than text messages.
3. Remove any sub user, team member or agency access created for the purchase.
4. Regenerate or revoke API keys on the account.
5. Check the account for a second, forgotten email address with reset rights.

A name bought through a marketplace such as Tappaya sits in the buyer's own account once the handover completes, and the security work belongs to the buyer from that point on.

Days one to two: contacts and email

Change the registrant, administrative, technical and billing contacts to the buyer's details. The registrant is the one that matters legally; the administrative contact is the one that receives transfer confirmations.

Use an email address on a domain the buyer controls and that is not the newly bought domain. A recovery address on the same name that has just been acquired creates a loop that breaks the moment the DNS is misconfigured.

For generic extensions, be aware that changing the registrant can put a sixty day inter-registrar transfer lock on the name. If the plan is to move the domain to a different registrar, do that first and change the contacts afterwards, following the order in registrar locks and waiting periods.

Days two to three: cut the old owner out

This is the step buyers skip. The previous holder may still have a route back through:

• an old email address still listed as an alternative contact or recovery option
• a marketplace or parking account that still lists the name
• nameservers still hosted on the seller's infrastructure
• a DNS provider account the seller opened and still controls
• an SSL certificate or a registrar sub account created during the sale

Move the nameservers to a DNS provider the buyer owns, even if the current ones work. Ask the seller in writing to delete stored authorisation codes and remove the name from every listing, and confirm that they have done so.

Recovery paths, not passwords, are how names are stolen back. Check every address and phone number attached to the account, not only the login credential.

Days three to five: renew, lock and verify

Renew the name if the expiry is anywhere near. A domain that arrives with a short remaining term is a scheduling risk rather than a bargain.

Switch the registrar transfer lock back on and enable auto renew. Where the name is valuable enough, ask the registrar about a registry level lock, which requires an out of band identity check before any change and is the strongest protection available.

Respond to the registrant contact verification email if one is sent. Ignoring it can lead to the name being suspended, which is an avoidable way to lose a week.

Days five to seven: put the name to work and close the file

Point the domain somewhere, even a holding page. A name resolving to a live server is easier to monitor and less likely to be quietly hijacked at the DNS layer.

Set a calendar reminder well before the expiry date, independent of the registrar reminder emails. Add monitoring on the registration record so that a change of nameservers or registrar produces an alert.

Finally, close the transaction file: agreement, invoice, proof of payment, escrow confirmation and the handover screenshots in one place. The relevant items are listed in the buyer checklist, and having them together is what makes a later question about ownership a two minute answer.