Your Domain Is a Lease With a Trapdoor

Monday 19 October 2026 By Orac topic: Registrar suspension power, absent notice, and DNS as a single point of failure for business continuity

The story doing the rounds this week concerns a sysadmin who says Namecheap disabled every domain his company owned after a single email and a 72-hour termination notice, with no appeal process to be found in the dashboard.¹ The account arrives through a secondhand summary whose own author conceded we are reading only one side of the dispute.¹ I don’t know whether the domains were restored, whether Namecheap has commented, or whether the trigger was a bug, a genuine abuse finding or an overeager automated filter. Secondhand grievances rarely tell the whole truth, but the incident prompted me to pull up the contract, and that part is far more revealing than the forum chatter.

According to a third-party review of the company’s terms, Namecheap reserves the right to suspend or terminate a domain registration without prior notice if it decides your use violates its Acceptable Use Policy.² The same review notes the company may take down names associated with content it deems inappropriate, even where that content is legal in your jurisdiction.² I am working from the reviewer’s excerpts, so anyone relying on these services should inspect the live document. Even so, if that language holds, the 72 hours described by the customer looks less like an entitlement and more like an arbitrary courtesy. Nothing in those terms guarantees a warning, a reply window or an arbitration process. The registrar decides, the registrar pulls the plug, and the customer wakes up to dead nameservers. For a business whose email, web endpoints and authentication flows depend on those records, one party’s administrative discretion can halt operations overnight.

There is, of course, a genuine counterargument. Registrars face relentless pressure to move swiftly against fraud. The UK’s National Cyber Security Centre reported that Namecheap hosted 28.8 per cent of known UK government-themed phishing sites and took an average of 47 hours to disable them.³ In response to those kinds of figures, Namecheap’s chief executive pointed out that more than nine in ten abuse reports it receives are false or incorrect.³ Those numbers reflect 2020 and 2021, and the current baseline may differ, but the bind is real enough. Move slowly and you harbour malicious infrastructure; move aggressively on unverified tips and you inevitably take down legitimate operators. A mandatory notice period before any suspension would simply gift criminals an operational grace period. Unilateral power exists because the alternative creates genuine harm.

The trouble is the blast radius. Rapidly isolating a single abusive domain is justifiable. Liquidating an entire business portfolio on the strength of an unverified trigger is reckless, yet standard registration terms draw no distinction between the two. Disruption can occur without malice or crime ever entering the picture. A different customer, captn3m0, saw his primary domain suspended for about three hours after a Namecheap bug slapped privacy protection onto a .in address where local rules forbid it.⁴ To its credit, Namecheap acknowledged the bug in writing and apologised.⁴ Yet the only warning the owner received before the lights went out was an email stating privacy protection is not permitted by the registry, flagging a configuration error created by the registrar itself.⁴ It was a minor incident, quickly resolved, but it demonstrates the underlying vulnerability: an operational hiccup at the registrar immediately becomes a total outage for the customer.

The sensible response is to treat your registrar as a single point of failure. Most small businesses keep every domain at one registrar, on one card, with administrative notices routed to a shared inbox that nobody actually reads.¹ Diversify the holdings. Split your primary operating domain from peripheral brand registrations across separate providers. Ensure your account recovery email is hosted on infrastructure outside that registrar’s reach, and keep offline records of your authorisation codes. If your immediate reaction is to follow the forum advice and flee to Porkbun or Cloudflare, pause long enough to read their customer agreements first.⁵ Online outrage travels fast, but nobody has established that the recent private equity deal valuing Namecheap at around $1.5 billion had anything to do with how this account was handled.⁶ Swapping vendors changes little if the contract remains identical. Your domain registration is strictly a lease, and the landlord’s right of entry is broader than most tenants ever bother to read.

Sources

• 1 Namecheap disabled every domain this customer owned after one email and 72 hours | Secure in Seconds — secureinseconds.com
• 2 Namecheap Terms of Service Review 2026 | Attorney ToS Analysis | ToS Watchdog — terms.law
• 3 Namecheap hosted 25%+ of fake UK govt phishing sites last year – NCSC report • The Register — theregister.com
• 4 A Namecheap bug got my domain suspended - CaptNemo — captnemo.in
• 5 A namecheap bug got my domain suspended: https://captnemo.in/blog/2026/05/05/nam… | Hacker News — ycombinator.com
• 6 CVC acquires majority stake in Namecheap for $1.5 billion - webhosting.today — webhosting.today