Ask HN: How to prevent a company from taking my domain name?

Domain investor here. Some, but not all of the advice here is absolutely dreadful and is an example of why you should not take advice from random strangers on the internet.

Some basic rules if you wish to keep the domain:

* Don't offer to sell the domain. If you are contacted by a prospective buyer, just decline, saying that the domain is not for sale. Don't counter-offer or enter into discussions or negotiations.

* Don't put ads or links to third-party commercial entities on your website. If you're going to use it for business purposes, make sure that it's just for your business, which incorprates your family name, eg FamilyName IT Services Ltd.

* Make sure your website has an "About Me/Us" page, which briefly outlines who you are, ensuring that you mention that your Family Name is the same as the domain name.

* The advice in this thread regarding use of 2FA on everything is sound. I've a high value domain portfolio and receive password reset requests every week, triggered by bad actors trying to access anything that they can think of that might give them access to accounts.

* Don't use GoDaddy or any or their network.

* Read up on UDRP (dispute resolution) and Reverse Name Hijacking if you want to get up to speed on the legal and procedural issues that might affect you.

* Domain disputes are a specialised field and you would need the advice of a specialised lawyer if you find yourself the recipient of a UDRP complaint. John Berryhill (I've no connection) is well regarded in this area, and I'm sure that there are others. He would be my first port of call.

You are a random stranger on the web giving good advice, though.

And now I am concerned for the domain I use for our family email addresses, which is not related to our last names (well, it has the initials of me and my wife, but then I added a random number to make it available. It's 3 letters domain)

Tell me more about Godaddy, please. Why shouldn’t we use them?

Because they are shady. I wouldn't put it past them to somehow claim they didn't receive renewal payment for the domain then take over ownership of the domain and then charge/sell it for an absurd amount of money.

Because they're incompetent. Literally just a week ago a report (https://www.bleepingcomputer.com/news/security/godaddy-hacke...) just describe how GoDaddy is simply incompetent with security. This is in addition on having one of the worst customer support of all major registrars.

A customer of mine had their website hijacked by Godaddy (copied their website text and pointed to a Godaddy IP). The application stopped working of course because that was hosted elsewhere (with me). They did this because they didn't like what was being sold on the website.

The owner / founder likes to kill elephants.

Not a company I’d like to support.

I would add the purpose of half of this advice is to make sure to prevent any possibility your domain possession is viewed as being used to monetise the name association with another legitimate company.

If your name is Apple and you somehow obtain new domain named apple.newtld you have a chance to loose the domain if there is any way it can be seen as profiting off of the association with the APL. For example if you put ads on a page that is nominally your personal page it can be seen as getting traffic from people who mistakenly came to this page since there is very little chance they came legitimately.

If it is large company they will be looking at every possible way to get your domain and the only way to fight it is to either spend huge amount of money on lawyers or not give any pretext, however small.

You are also as likely to lose the domain by a targeted attack by people who hope to then sell the domain. If you have a nice domain name you need to invest a bit of thought in protecting it from takover (locking the domain, protecting your information, not using your regular phone number, phone, email, laptop, etc. to have anything to do with the admin access to the domain).

Amazon.se was registered by a 1-person company Amazon AB in 1997. The reason Amazon didn't launch in Sweden until 2020 was because the person who owned Amazon AB didn't want to sell (but finally did).

Since company tax filings are public in Sweden, you can deduct Amazon paid ~$500k for amazon.se, which in my mind is very cheap.

Funny story.

I have three domains (.com, .org, and .net) of my [first initial][last name][.tld]. Have had them for a long time.

A defense law firm in Australia, set up a domain, with [first initial][last name].com.au

I used to get regular emails, with terrifyingly personal stuff in them. Many of these emails came from Australian government/court orgs. They probably could have been sued into the mantle for some of the stuff (like juvenile criminal proceedings), that got sent to some random Yank in New York.

I was always careful to forward everything I got to the lawyers, along with contacting the courts, and letting them know their mistake.

In a couple of instances, I was thanked. In most, I was ignored.

No one ever tried the barratry route with me. I actually probably would have sold them my domains at cost, if they had asked, but they never did.

I haven't gotten one of those emails in years. I have no idea why.

Why not have one or two mail accounts on the domain and reject or bounce everything else?

I generally like to have the catchalls come to me. If they get spamjacked, then I'll block them. Has not been a problem, to date.

These weren't frequent, so it wasn't a big deal, and I didn't want these to get lost, as they were of critical importance to the people they concerned (like life/death jail/free stuff).

See also https://gail.com/

> There are only two valid e-mail addresses on the gail.com domain, so it is extremely likely that your photos were rejected by my e-mail provider and deleted.

> […]

> If you have a question not answered above, feel free to send it to: faq at gail period com. Thanks for visiting.

Now I wonder what the other address is. Probably gail@ or mail@. Actually the last one rhymes, I hope she uses that.

Probably snail.

snail.mail@gail.com

Everyone thinks .com is so desirable; but just think, she could have: snail.mail@gail.mail.

> Another interesting gail.com factoid: my amazing e-mail provider, ProtonMail, rejects about 1.2 million mis-addressed e-mails per week to the gail.com domain.

Bloody hell, there could be some spicy stuff on a few of those emails!

Reminds me of gamil.com

Ah, yes

There is a legit public sector company (huge one) in India with that very name GAIL. It uses

https://www.gailonline.com/

Gas Authority of India Limited, USD $12Bn annual revenue.

(IL and CL are very common in company names here that originated as initialisms. Something India Limited or Something Corporation Limited. E.g. HPCL, BPCL, CRISIL, etc)

The domain is yours for now and that cannot be changed easily.

By far the most likely outcome is that a company that is interested in your domain will offer to buy it from you for a nice sum. You are free to reject their offer.

They may decide to sue you but you have a good standing because it is your last name. Relax.

This. Look into the backstory and history on nissan.com

To prevent domain hijacking:

Tip 1: Pick an enterprise-class domain name registry.

Tip 2: Set up 2FA that isn't phone-based.

Tip 3: Request DNSSEC from your registrar.

And secure the email addresses used for your registrar account with 2FA, and disable weak recovery methods.

Done.

Also register it out for 10 years and turn auto renew on

Regarding tip number 1, how can one find an enterprise-class domain name registry? Any advice?

Most enterprise class registrars (registry =/= registrar) are brand protection and brand monitoring services. Quite expensive for individuals and probably not in the price range of OP, according to the description of his circumstances.

I've used name.com, namecheap.com, sav.com and porkbun.com as registrars without difficulty, although one will always find anecdotal reports of problems other users have had with any service.

GoDaddy, on the other hand, is to be avoided. It's like the PayPal of domains. Awful customer service and dark patterns everywhere.

How about Cloudflare Registrar?

I like them as a company, but I wouldn't use them as a registrar if there was a significant risk of UDRP. Domains are not their core business and customer service is close to non-existent if you're not at least a pro-level customer. For your case, you should use a dedicated domain registrar, such as the ones I outlined earlier. Infomaniak is another registrar that I've found good in terms of customer service and price. They're Swiss based, and I've found them to be competent and professional.

I understand and really appreciate the feedback.

Thanks! Does it make a difference that the registrar is in your country, or at least in your "continent" (i.e.: EU) for those bad things that can happen like UDRP, etc.?

Pick your top 10-100 large enterprises, especially those with a major internet presence. Use whois to find the registry they use. See if you can get sales to call you back.

My experience is many years old now, but when Network Solutions's incompetence resulted in our glue records getting changed by hackers, the startup I was at switched to MarkMonitor. At the time, MarkMonitor charged a large premium per domain year, and a significant annual cost to setup 'registry lock' (which prevents the customer or the registrar from making changes to the domain without going through a proccess with the registry), and they had IIRC a $10k/year minimum spending commitment. A lot has changed since then, it's probably worth getting them on the phone if you're serious about your domain, but it's probably still going to be expensive. Get on the phone with at least CSC Domains as well.

1. How bad is Cloudflare? 2. Done. 3. Done.

> registry

Registrar. You can't buy directly from the registry unless you become registrar yourself.

Some other important tips:

- make sure auto-renew is enabled with a reliable credit card

- make sure to update your personal data once a year. Registrars are mandated by the registry to send a reminder email once a year, but for an important domain I'd also set a recurring reminder every year, 2 weeks before expiration to make sure that everything is ok. You probably shouldn't "setup and *forget*" your domain names

- if you can afford it, make sure to register multiple years at once, the max is usually 10 years, but I'd recommend registering for only 9 years, because if you need to transfer to another registrar for some reason, the registration will be bumped 1 year. If you're already at 10, you're stuck.

I have always skimped on giving real life details to registrars, I don't trust them to handle my data well, especially cheapo ones like namecheap.

If you don't have real details on file, and you get UDRP'ed, you might not receive the complaint, and you'll lose by default if you don't respond.

The email is correct, so I should be OK.

Setting up DNSSEC will not do anything to prevent domain hijacking, which is an attack that occurs at the registrar level.

You have a legitimate use case and are using it in good faith. I can't imagine any scenario where someone would have any success in taking it away from you against your will unless you made a mistake in letting the registration lapse or something. Make sure you've got auto renewal set up, with a reputable registrar.

Thank you! Yes, auto-renewal is on. It's not an option, that it will expire.

You should be fine. See nissan.com as an example. You aren't a domain squatter and even they barely have issues.

https://jalopnik.com/uzi-nissan-spent-8-years-fighting-the-c...

> At the time, it didn’t seem like the start of an all-consuming legal battle, a David vs. Goliath fight that took nearly 10 years and cost the small business owner millions of dollars—to say nothing of the incalculable toll on his personal life.

Not exactly a great example of “fine”.

He was someone with several millions of dollars to burn and apparently not a lot of business sense.

He could have just sold the domain for a ton of money and had Nissan give him uzi.nissan.com in perpetuity, for example.

I mean, I'm all for freedom and all, but being smart about things is also a solid guiding principle.

Edit:

Ah, he agreed at some point:

> “Who the hell wants to buy a computer from a company that’s in a lawsuit with a giant like Nissan Motor?” he said. “I would have let it go first day if I knew what I would have to go through, and what it would do to me and my family,” Uzi told Jalopnik. “I was driven 99.9 percent out of business.”

> “Court proceedings were going every week,” he added. “I had to read hundreds of pages of proceedings and make sure they are correct. The best attorneys will make mistakes. You know your story more than anybody else. And then you don’t have time for anything else.”

To add to this: Mr. Nissan passed away in 2020 and yet the site is still up.

Expiry date is in 2029, if he passed on, they'll have to talk to the estate. It's also possible they don't know he died.

The stories I hear are when the domain name owners ask how much, and then reject the amount.

Do not enterain any offers. If they reach out, it is best to completly ignore and do not respond. Failing that, tell them it is your name, and your name is not for sale at any price.

If they ever try to take you to court, point the judge to nissan.com which is owned by someone with the name Nissan, and even the large car manufacturer did not have the right to take it.

Thank you! No, I wouldn't be considering an offer at all.

I'm not an expert, this is not expert advice.

AFAIK Trademarks are not automatically an international thing. A business would need to make an effort to register in multiple countries. Trademarks are also not all industries, all at once. McDonald's wouldn't like it, but if my last name was McDonald, and I wanted to setup a lawnmowing business called McDonald's Lawnmowing, they cannot stop me (although you can bet they'd try to scare me off).

I am not sure of your financial position, but it might be economical to register a business name, and even a trademark in your country. This will will give you one more level of protection. They would need to challenge your trademark first. Now, protecting a trademark is not necessarily cheap. It could be a matter of sending a few "piss off" letters in response to their inflated threats, but it could escalate. That said, the same escalation could happen regardless of you having a trademark. Depending on your country, people can (and do) sue other people with no legal standing, and use costs of defending oneself as a cudgel to get what they want.

It's your last name, they cannot force it off you. I'm not a lawyer, but worked for a company which tried.

Exactly. Same here.

Best thing you can do is this:

- ask your registrar to do the 'registry lock' on your domain. Not registrar lock but 'registry lock' specifically. Most will do this. If they won't, then transfer to another registrar.

- register the domain for at least 5 years. 10 years if you can.

- use the 2FA at your domain registrar. There are some registrars that offer a "pass code" or other task to be performed before the domain can be transferred. At one registrar, I have the requirement that they need to call me on my cell phone and I must mention a code word to them.

- If you're using Google or a Google Account (not recommended but in some cases it's necessary), then absolutely sign up for Google Advanced Protection. I cannot tell you how many domains have been stolen and lost because they were using a google account (gmail).

- Remove privacy whois on your domain. Use a business address, email (not gmail) and a real phone number on the whois of your domain. If the domain is stolen, then the whois history will show who owns it... if it goes to privacy then the thief/hacker most likely wants to hide themselves. If you get spam email/calls from that public whois data, then change registrars. It's certain registrars that are giving out or allowing scraping of their whois data.

- If you don't already own a trademark on the word in the domain, then don't think that that getting a tm will protect your domain name. If you registered the domain before someone files for the trademark, then you have the rights to it. Don't let anyone else tell you that you don't, especially if you are using it for a website.

I have `<firstname>.nu` as one of my domains, some company that resides on the same postal address as the owners of `<firstname>.se` reached out to buy the domain from me for I think it was €1000. I just told them no, I've had that name for 15 years, I've used it for my personal website ever since and have email and such set up.

I don't care if they printed out my domain on a car print or a card or something that they give out. That's not my problem.

The thing is, companies can (at least under some TLD's) claim domain names. But this claim has to be tested. And the test that I'm aware that exists is kinda if you have some kind of claim to it as well. It may that you own a business with that name, but it's also claim enough that you have that name as your name. Then your claim is valid and you had it first.

I'm not sure how it works with .com, but I wouldn't think they are very different.

In whois records I've seen something called registry lock, may be worth for you to look into that: https://internetstiftelsen.se/en/domains/tech-tools/registry...

Look into the trademarks for the same name. (for example here: https://branddb.wipo.int/en/quicksearch)

You can't use the domain name for the same activity (the same Nice class https://en.wikipedia.org/wiki/International_(Nice)_Classific...) as the company with the same name that has a trademark for the same activity class.

If you follow this rule no company will be able to contest your domain name.

There are a couple with that name. Then what can I do? Register a company for what I might be doing in the future?

In general if you're using it for legit purposes it's hard to take a domain taken even for big brands. You have it first, and unless you're using it for a competitor or to defame them it's hard to claim malice. They should have checked the name was able for them to use before using it.

But do make sure you have auto-renew setup etc. If you lose it, they can nab it fast and it'd be hard to get it back.

> But do make sure you have auto-renew setup etc

Instead of auto-renew I register my domains for 10 years, and add an annual recurring event to my calendar to remind me to add another year.

That way I keep the expiration 9-10 years in the future so that if there is ever a big price increase and I need to move to a cheaper domain I've got a long time to make the move.

No need for auto-renew because there is no way that I'd manage to miss the calendar events enough years in a row to have the domains expire, and even if I did have auto-renew the on-file credit card information would be out of date when it is time to auto-renew.

I don’t understand, what’s the emotional attachment? Put the domain up for sale and hire a broker, the money could be life changing for you.

Actively trying to sell it is the way he most likely encounters the problem he's worried about (losing the domain for nothing to a company that argues he was trying to profit from their trademark....)

I'm sorry, but I can't explain it. Some people are sentimental and are attached to items and memories. People are different. It's important for me for some reason, which I can't comprehend.

Also worth a read about an upstart computer company being sued.

https://en.wikipedia.org/wiki/Apple_Corps

I always wondered how Apple Computer Inc. were allowed to enter the iPod business without being sued again.

https://en.wikipedia.org/wiki/Apple_Corps_v_Apple_Computer

They were sued again. Apple Computer won the case.

You might want to consider registering a trademark on that name if at all possible. Even if you can't register the 5 letter name itself, register something else like "iname widget". it should bolster your defence if it ever came to it.

I wouldn't do that. A trademark might be lost due to that company being the first one to trade under that name, and part of that might be the court forcing the person owning the domain to transfer the domain name. If there's no trademark and there's no business at that domain there's no way to sue for trademark infringement.

I would keep it as far away from anything business-like as possible.

It's complicated.

It is worth noting that for a trademark to be enforceable it has to be in use, at least in the US. So if you're not going to use it in any way, then yeah it has no value.

But if you are going to use that trademark then it can give you an awful lot of protection. Note that defense of a trademark is usually around if there is potential for confusion. Say the trademark is the name of a medicine and your trademark includes that name but you sell luggage, the phamaceutical company doesn't really have a claim against you because they don't operate in that area and there's no potential confusion. If you want to sell first aid kits however that might be a problem.

Without a trademark, you may still face a company who does have a trademark.

There is case law with WIPO on this issue which is in your favor, see https://swanturton.com/armani-v-ar-mani/

Thank you for sharing!

I would like to ask the inverse of this question; a company is squatting the domain that is the same as mylastname.com. They just redirect to their main site when you visit this address.

How can I get a hold of this domain?

Offer them enough money to let it go.

Buy it from them or wait until expiry, no other option unless you have a trademark from before the domain was registered.

Trademark sounds like a good route to be safe, but you will most likely win all UDRP cases regardless.

Which mail client do you use? Is it free?

Personal Gmail through Cloudflare.

u can't. just hire a good attorney if it does happen, because you better believe they will have several.

idk / imho ...

in case: be open selling your domain? just as one possibility to avoid lengthy legal disputes / costly interactions with lawyers!?

you mentioned above, you are "from a poor country" ... several k or even some 2 digit k of us$ / euro - depending on the actual name - might be a decent pain-compensation for "loosing" your domain and carry you further in your country than a stupid personal domain with nice email-addresses attached to it ;))

Your advice in how to protect their domain name is be willing to sell it and don’t bother putting up a fight…?

When it comes to registered trademarks, yes. I can't call myself Coke or Pepsi either.

Don't confront them to offer them anything, let them come to you.

If your name is John Pepper and you happen to be a doctor, you can certainly call yourself Dr Pepper.

They've clearly stated it's a name. You can't make a company, copyright a name, and then attempt to claim all rights to it. See gail.com, nissan.com above.

You CAN call yourself Coke, Pepsi, or whatever you like. What you cant do is cause confusion with other uses of the mark.

Trademarks dont mean you own a word, they mean that the use of that word is to be protected from passing-off/impersonation (intentional or otherwise).

So by all means call yourself Coke - just dont market yourself as a soft-drink (or whatever other categories the mark is held and/or defended in).

No offense but I think that is terrible advice. Basically ‘bend over for any corporation immediately’.

If the person holds an asset and isn’t doing anything malicious with it there is zero reason they should be forced to give it up just because some corporation wants it.

Do not do what this poster advises.

Offering to sell the domain will probably count as evidence that you've registered it in bad faith rather, and make it easier for a trademark owner to win a dispute.

I would hope that if domain matches your legal name, that should be sufficient evidence that you registered it in good faith. Anyway, I don't think the above poster was suggesting advertising it for sale, just that if someone reached out wanting to buy it that OP should seriously consider the offer.

> I already know of two companies in different countries which have the very same name as I occasionally receive emails written to them on my catch-all email address

If they ever decide to do business in your country, expect them to want their name. They will probably take you and your registrar to court, but in the end, they will have to pay you for the name.

Domains don't cost a lot, but I would just take what they offer you, don't try to fleece them because you got there first.

I would look at another domain name as a fallback should any of this happen, but just keep in mind that it's a possibility.

‘Their name’

If it’s your family name, what can they do but bleed you in legal costs? It depends on the country maybe, but I would not part with that domain in my country if it’s my family name and registered ages ago (clearly not to try to blackmail that company). Not sure anyone should.

Horrible advice.

Why spend the money defending a $5 domain name, especially when you're not making any money by having it?

It's just a name, and if you're not a registered company, you're going to be seen as a squatter no matter what.

All I'm suggesting is to be prepared to have the domain ownership contested and have a backup if you have to change domains.

Was it $5? I had the impression the OP paid more.

> I spent like a year or so to save up for it, which cost roughly 6 months of average net salaries in my country about 7 years ago.

They picked a bad registrar for a .com then, because they're dirt cheap.

They probably bought it from someone as it wasn't free at the time.

Correct. It was already registered and up for sale.

> All I'm suggesting

Not really, you are stating, matter of factly, that the big evil corp will own it and you are basically screwed. This is not true (in places I know, but might differ somewhere) if it’s not squatting and it’s actually your family name. It’s beyond reasonable.

Also, I find this capitalist overlord cynicism really quite annoying. I would help OP with legal fees to prevent this from happening. Just laying down and get pummelled just because it’s a big corp should not be the default.

That's kind of you, but will hopefully never be necessary.

Also, the amount doesn’t matter; OP describes, in enough detail, that they are proud of this name.

> I spent like a year or so to save up for it, which cost roughly 6 months of average net salaries in my country about 7 years ago.

It wasn't $5.