Domain Ownership Controls for Singapore Businesses: Renewal, Registrar Lock and Scam Warnings

Your domain name carries your website, your business email and much of your customers' trust. If it lapses, moves to another registrar without your knowledge or is redirected, all three can stop at once. Most of the controls that prevent this are free or already available. They need an owner and a routine.

This guide is for founders, IT leads and operations managers who already hold a domain and want to keep it safe. It assumes a .sg or .com.sg name, where the registry is SGNIC (Singapore Network Information Centre). Most principles also apply to .com and other extensions, but registry rules differ, so check them before relying on any step here. This article is educational and is not legal advice.

Executive summary

Know who holds each role on your domain

A domain has several contacts, and each does a different job. The registrant is the party that registers the domain and is bound by an agreement with SGNIC, plus a separate commercial agreement with the registrar. The administrative contact verifies the registrant's identity and, for .sg names, manages SGNIC's Registry Lock. The technical contact receives operational issues.

Use company-controlled role mailboxes rather than one person's inbox, so notices survive staff changes. Do not host the only copy of that mailbox on the domain it protects. If the domain expires, email linked to it stops working, and so do the reminders. For setting up email on your own domain, see our business email guide for Singapore teams.

WHOIS shows some of these details. SGNIC masks the email addresses and phone numbers of registrant, administrative and billing contacts, but displays the technical contact in full. Use a role mailbox there as well.

VerifiedID@SG: the step that can switch a domain off

For .sg names registered on or after 2 May 2013, the administrative contact must verify the registrant's identity within 21 calendar days of registration, with a one-time 7-day extension. If missed, the domain is suspended and the website and email stop. Per SGNIC's FAQ, a domain is not renewable until verification is complete.

Verification is required again when the registrant's identity or contact details change, or the administrative contact changes. Names registered before 2 May 2013 come under the scheme once the registrant's identity or contact information is changed. The 21-day deadline covers new registrations only.

The administrative contact verifies using Singpass (an individual with an NRIC or FIN) or Corppass (an organisation with a UEN). A registrant can self-verify only if it is also that contact. SGNICID is an exception, not a general alternative: SGNIC may consider it for a foreign applicant unable to appoint a local administrative contact, or a local organisation without Corppass that manages many .sg names, and issues it only after verifying identity. An SGNICID administrative contact needs a local presence and a valid Singapore postal address. WHOIS shows the state as VerifiedID@SG-Pending, VerifiedID@SG-OK or VerifiedID@SG-Mandatory. Our .sg vs .com.sg guide covers the eligibility rules for each extension.

Make renewal automatic, visible and owned

Auto-renew is the simplest protection against accidental loss. On Z.com, auto-renew is enabled by default after registration, and an invoice is issued before expiry. You can check it in the Client Area under Domains, then My Domains, then the settings icon. An invoice alone does not complete a renewal: make sure it is paid by the due date, then confirm the new expiry date.

Know what expiry means in practice. Z.com's renewal page states that an expired domain becomes inactive immediately, linked websites and email stop working, and management is suspended. It then describes a 30-day grace period at the regular renewal rate, followed by a redemption stage that costs a registry-set fee plus the standard renewal fee. If the domain is still not renewed, it is released for public registration. The same page notes that country-code extensions may have unique renewal rules, so confirm the timeline for your .sg or .com.sg name with your registrar rather than assuming it.

For .sg names, SGNIC allows renewal terms of 1 or 2 years, and the expiry date cannot be more than 3 years from the date SGNIC receives the renewal instruction. A two-year term reduces the number of renewal events, but it does not replace a calendar reminder. Z.com lists prices in SGD on its domain price list; confirm the final amount, including any GST, at checkout.

Understand what each lock does and does not do

"Lock" can mean three different things. They protect against different risks, and none replaces the others.

SGNIC describes Registry Lock as a defence against domain hijacking, where an attacker changes nameserver records to redirect your website and email. It is currently free, and the administrative contact needs a valid Singpass, Corppass or SGNICID account to use it. SGNIC reserves the right to charge in future, with advance notice. The administrative contact manages it in SGNIC's RegistryLock portal. Because email routing depends on DNS, pair it with the authentication records in our SPF, DKIM and DMARC setup guide.

Locks also matter when you move a domain. For .sg names, SGNIC's rules say the losing registrar issues a domain transfer password, may require outstanding payments, and may approve or reject the request. If it does not respond, SGNIC approves the transfer after 7 days from the request. If you receive a transfer notice you did not start, contact your registrar immediately.

If you plan to move a domain to Z.com, its domain transfer page lists the preconditions: the domain must be more than 60 days from registration or last transfer, have at least 15 days left before expiry, and have its registrar lock removed and an auth code obtained from the current registrar. That page does not state whether .sg and .com.sg transfers are supported, so confirm with Z.com before you plan a move.

Spot fake renewal and SGNIC emails

On 21 September 2026, SGNIC published a scam alert and advisory about emails that impersonate SGNIC and ask recipients to click a link, share personal information or make payments. SGNIC says it never requests payment for domain name transactions, and that domain renewal notices come only from your registrar or service provider. It also reminds users that SMS Sender ID Registry fees are paid only through the official portal, and that its emails contain no payment links.

Before paying any domain-related invoice, run this check:

• Read the actual sender address, not just the display name, and ask whether it matches your registrar.
• Do not click payment links in the message. Type your registrar's address into the browser and log in.
• Look up the domain on the WHOIS function at sgnic.sg and compare the expiry date with the email.
• Compare the invoice with the renewal shown in your registrar account.
• If you are unsure, call the ScamShield helpline on 1799 or use the "Report a Scam" link on scamshield.gov.sg.

Tell your finance team the same rule: domain payments go only through the registrar's portal, never to a bank account named in an unsolicited email.

Run a quarterly ownership review

Set a recurring 30-minute review. Whoever owns the domain should confirm each item and record the date.

• Registrant, administrative and technical contacts use current role mailboxes and a phone number someone answers.
• For .sg names, WHOIS shows VerifiedID@SG-OK, not Pending, and any re-verification is complete.
• Auto-renew is on, the payment method is valid and the expiry date is in the shared calendar.
• The registrar account uses two-factor authentication, former staff have been removed and shared logins are replaced.
• Registrar lock is on, and you have decided whether to enable SGNIC Registry Lock.
• Nameservers and DNS records match what you expect, including your email authentication records.
• You have recorded the registrar, the login owner, the expiry date and who approves transfers.

Common mistakes to avoid

Frequently asked questions