Academy › Publishing › Domain and email

The recovery email can't live inside the domain it's protecting

Your business domain and email have a recovery address that's separate from both, controlled by the owner and stored with their password.

By Yodai · Published September 6, 2026 · Updated October 13, 2026

Your domain and your email each have their own password, and every password has a way back in: the address the system notifies when someone, you or an attacker, clicks "forgot it." Time to check where that notice goes. Open your registrar's dashboard, the company you pay for the domain, and look for the field labeled contact email or recovery email. Odds are you'll see something like contact@yourbusiness.com or orders@yourbusiness.com. That's the problem, and you won't notice it until it's too late.

That email depends on the very domain it's supposed to protect. The day you lose the domain, whether from a missed payment, a stolen registrar account, or a provider outage, you lose that mailbox too. And without that mailbox, the recovery notice never reaches you. It's a lock that keeps its own key inside the box it's supposed to secure.

This isn't an exaggeration. According to the ICANN policy for expired domains, which governs generic domains like .com, .net, or .org, the registrar has to notify you at least twice before the domain expires, roughly a month and a week ahead, and send another notice with renewal instructions within five days after it expires. But once it expires, the registrar is required to take the domain offline, and the rules allow deletion at any point after that; if it's deleted more than eight days later, the registrar first has to keep it offline, and still renewable by you, for at least eight straight days. While the domain is offline, the website and email tied to it stop working: any notices sent during that time land in a mailbox that isn't receiving anything. That same policy asks registrars to recommend a second contact email that isn't tied to the domain.

The loop you can't see until you're already stuck in it

In the previous lesson you already settled that you don't reuse the same password anywhere else. But a strong password doesn't help if the way back, the one you use when you forget it or when someone else gets into an account they shouldn't, runs through the very thing you're trying to protect.

The same mistake shows up with your main email too, not just the domain. Google's help center says it plainly: your recovery email should be one you check regularly, but not the one you use to sign into that account. And that's not enough on its own. If you use Gmail or Workspace and set another account of yours from the same provider as recovery, or a second address on the same domain, the flaw is identical: you lose one and you lose both at once, because they were never truly independent of each other.

There are two separate places to check this field. One is the registrar panel, where the domain's contact email is listed. The other is your email account's own settings, where the account's recovery address is listed. They're configured separately, and almost nobody checks the second one.

What address to use instead

The rule is easy to state and almost nobody follows it all the way through: the recovery address has to survive the loss of everything else. That means three things. It has to be with a different provider than the one you use for your business email. Its password has to be written down separately, in the password manager you already set up in the last lesson, not memorized or stored on the same computer you use every day. And it has to be controlled by the business owner, not an employee, not the designer who built the site, not a partner who might not be one tomorrow.

An old personal Gmail account, one you've had for ten years and only open once a month, works fine. An account created just for this purpose, with no business name or visible tie to it, works even better, because nobody researching your domain will find it by searching for your brand.

Doing this now takes a few minutes. Doing it after you've already lost access isn't possible, because by then you have no way in to change anything: that's the core contradiction of this kind of lockout. That's why it's worth checking today, not after the domain has already sent its first warning.

With the recovery email already moved outside the domain, the next thing to close is the door that opens with a single code sent by text: two-factor authentication, and there, not every method is equally strong.

In Yodai you connect the domain you already have to your site, and it stays registered where it is, in your name. See how your own domain for your website works.