A domain name sits across several systems that are easy to confuse: registrar, registry, authoritative DNS, hosting, certificates, email, analytics, and application settings. The documentation should make those boundaries visible, identify who can make each decision, and provide enough evidence to verify a change without copying secrets into a shared file.
Build a control record for each domain
Record the exact domain, purpose, business owner, technical owner, registrar, account owner, renewal method, expiration date, authoritative DNS provider, nameservers, hosting targets, certificate provider, email provider, and critical subdomains. Add the canonical website URL and any domains that redirect to it. Separate production, staging, parked, defensive, and marketing domains.
The ICANN Registration Data Lookup Tool can display current publicly available registration data using RDAP, with a WHOIS fallback in some cases. Use it as independent evidence for registrar, status, expiration information, and nameservers when those fields are public. Do not treat missing contact data as a failure; privacy rules and policy can limit what the public sees.
Link to the registrar and DNS accounts through approved internal references, but never paste passwords, API tokens, transfer codes, recovery codes, private keys, or full identity documents into the domain record. Identify credentials by vault item name and authorized role. List the people who can recover the account and the owner who reviews access.
Document DNS as intended state
Maintain a table of required records with hostname, type, content or protected reference, TTL, proxy setting, purpose, service owner, change ticket, and last verified date. Cloudflare's DNS record guidance explains that record type defines purpose, name identifies the resource, content contains the target, and TTL controls how long resolvers cache the record. Those are distinct settings and should not be collapsed into a screenshot.
Mark records that prove ownership, route mail, publish sender policy, point at a website, or support an application. For sensitive or frequently rotated values, document the source system and verification method instead of duplicating the value. Record which service will break if a record is removed.
Cloudflare's nameserver guidance describes authoritative nameservers as the servers holding the definitive DNS records for a domain. Put delegation in its own section because a correct record table is ineffective if the parent zone points to another DNS provider. Record both the intended nameservers and the last independently observed delegation.
Assign decisions and approvals
Create a responsibility matrix for registration, renewal, nameserver changes, ordinary DNS edits, DNSSEC, certificates, mail authentication, hosting, redirects, and incident response. Identify who proposes, approves, implements, verifies, and can roll back each class of change. A vendor administrator may be able to click Save without having authority to approve a security or email change.
For every material decision, record the reason, alternatives, affected services, security and privacy impact, expected propagation, maintenance window, test plan, rollback trigger, owner, and approval time. Treat transfers, deletion, auto-renewal changes, payment replacement, account recovery, and security changes as owner gates.
Record verification, not just configuration
After a change, capture authoritative DNS answers, independent resolver results, HTTPS status, certificate names, redirects, email tests, and critical application paths. Save timestamps and tools used. Mark the outcome as verified, failed, or pending cache expiry. A control-panel success banner is not independent verification.
Include a renewal review well before expiration. Verify registrar contact routes, payment ownership, lock status, recovery access, and responsible people without exposing payment or identity data. Record what happens if the primary owner is unavailable.
Keep history and emergency instructions
Use an append-only change log with ticket, old value, new value, reason, implementer, approver, verification result, and rollback. Keep a current diagram plus historical exports in an access-controlled location. Test emergency access periodically through a read-only exercise; do not reset credentials merely to prove the document exists.
The domain record is complete when another authorized operator can identify the registrar, delegation, required DNS, dependent services, renewal owner, approval boundaries, verification steps, and rollback path without receiving any secret in the document itself.
Sources
- ICANN Registration Data Lookup Tool — ICANN
- DNS records — Cloudflare
- Nameservers — Cloudflare