Defensive domain registration means buying the same name under several extensions, such as .com, .net, .co and your country code, so that nobody else can. It is one of the oldest habits in the domain world, and one of the most expensive when done without a rule. Big brands register hundreds of variants because a single phishing campaign on a lookalike costs more than a decade of renewals. A two-person business does not have that math, and buying every extension "just in case" quietly turns into a $200-a-year bill for names that do nothing.
The right answer is not "yes" or "no" but a short list: the one name you use, the one or two variants that would actually hurt you in someone else's hands, and nothing else. This guide gives you the rule, the costs, and the way to make the extra names useful instead of idle.
MailShrine Domains lets you search a name across 150+ extensions in one lookup and shows the first-year and renewal price for each, so the defensive list is priced before you decide. Every extra name gets free WHOIS privacy and transfer lock, and you can forward it to your main domain from the same DNS editor.
Real-life example: Wanjiru's bakery
Wanjiru Kamau owns Golden Crumb, a bakery with two branches in Nairobi and a growing order-by-WhatsApp business. She registered goldencrumb.co.ke a year ago. Last month a customer sent an order to goldencrumb.com, which belongs to a parked page in another country, and never heard back. Now she is wondering whether to buy .com, .ke, .africa, .shop and .cafe before someone else does.
Wanjiru's goals this week:
- Work out which extensions are worth defending and which are noise.
- Keep the total yearly cost under $60 without leaving a real gap.
- Make sure mail and web visitors on any variant end up at the real bakery.
When extra extensions earn their keep
| Situation | Buy the variant? | Why |
|---|---|---|
| Customers already type the wrong extension | Yes | You are losing orders today, as Wanjiru is with .com. |
| You operate in one country but use a generic TLD | Yes, the ccTLD | Local customers assume .ke, .ng or .de exists; it is also the easiest phishing target. |
| You use a ccTLD but plan to sell abroad | Yes, .com | It becomes the international front door later and is hard to get back once taken. |
| The variant is a common typo of your name | Only if traffic is measurable | Typo domains mostly matter for brands with thousands of daily direct visits. |
A new extension "matches your industry" (.cafe, .shop) | Usually no | If nobody types it unprompted, nobody will type it with your name either. |
| You are about to launch publicity or funding | Yes, for the core two or three | Squatters watch press and trademark filings and register variants within hours. |
The test is simple. Would a stranger holding this exact name cost you money or trust? If the honest answer is "probably not", skip it.
What the extras cost over time
A defensive portfolio is a recurring bill, so price it on renewals, not launch promos.
| Extension | Typical first year | Typical renewal | 5-year cost |
|---|---|---|---|
| .com | $12.99 | $12.99 | $64.95 |
| .co.ke | $10–15 | $10–15 | $50–75 |
| .co | $3–10 promo | $25–35 | $100–150 |
| .shop | $1–5 promo | $30–40 | $120–165 |
| .africa | $10–20 | $15–25 | $70–120 |
Five extensions at these rates run to roughly $400–575 over five years. Two well-chosen ones run to about $115–140. That difference is a month of flour for Wanjiru. MailShrine displays both prices on every search result so the five-year number is visible before checkout.
What you need before you start
| You need | Why |
|---|---|
| Your primary domain, registered and renewing | Every extra name will point at this one; nothing should point the other way. |
| A list of how customers currently reach you | Check email bounces, WhatsApp messages and call logs for mis-typed addresses. |
| A trademark or business registration, if you have one | Needed to recover a squatted name later through UDRP or a registry dispute, and to register some restricted ccTLDs. |
| A yearly budget ceiling | Decide the number first, then fill it with the highest-risk variants. |
Step 1: Rank the variants by damage, not by availability
Write down every extension you are tempted by, then ask for each: if a scammer owned this and emailed my customers from it, what would happen? For Wanjiru, goldencrumb.com and goldencrumb.ke score high because customers already guess them. .cafe and .shop score low because nobody has ever typed them.
Step 2: Check who holds the taken ones
For a variant that is already registered, run an RDAP lookup (the successor to WHOIS). If the registration is recent and parked, it may be for sale at a reasonable price on the aftermarket; MailShrine shows for-sale names with a Buy Now option up to a cap. If it belongs to an active business in another sector, let it go and make sure your own branding never points to it.
Step 3: Register the shortlist for the same term as your main name
Buy the defensive names for the same number of years as your primary so they all renew together and you get one set of reminders at 30, 7 and 1 day. MailShrine supports 1–10 year terms and leaves auto-renew on by default; keep it on for defensive names, since a lapsed one is exactly what a squatter waits for.
Step 4: Redirect web traffic to the primary
In the MailShrine DNS editor, point each extra domain at your primary with a redirect record or an A record to your site, and make sure your web host returns a permanent (301) redirect to the main domain. Google then consolidates all signals onto one domain instead of splitting them.
Step 5: Catch mis-addressed email
Add MX records on each variant that deliver to your main mailboxes, or set up a forwarding address so orders@goldencrumb.com lands in orders@goldencrumb.co.ke. Publish an SPF record of v=spf1 -all on any variant you never send from, plus a DMARC record with p=reject, so nobody can spoof mail from the names you bought to protect yourself.
Step 6: Review the list once a year
When the renewal reminder arrives, look at the traffic and mail each variant received. A name that caught nothing in twelve months can be dropped at the next expiry. A name that caught real orders should stay for as long as the business does.
Wanjiru's checklist
- Listed every variant customers have actually mis-typed in the last yearCompleted
- Ran RDAP on
goldencrumb.comand found it parked, not in useCompleted - Set a $60 yearly ceiling and chose
.comand.keonlyCompleted - Registered both for 2 years to match the
.co.kerenewal dateCompleted - Added 301 redirects and MX forwarding on both variantsNot completed
- Published
v=spf1 -alland DMARCp=rejecton the non-sending namesNot completed
Common mistakes
Buying everything the search page offers. Registrars show every extension because they can. Price the renewals, not the promos, before adding to the cart.
Leaving the extras parked with no DNS. An unredirected variant teaches customers that the wrong address is dead. Redirect it so the mistake self-corrects.
Forgetting the extras have their own expiry. If you register them at different times, you get reminders on different dates and one will slip. Align the terms.
Treating the defensive names as a trademark. Owning goldencrumb.com does not stop someone registering golden-crumb.com. For real protection, register the mark; a trademark is also what wins a UDRP dispute.
Check your work
Open each variant in a private browser window and confirm it lands on your main site with the main domain in the address bar. Send a test email to hello@ at each variant and confirm it arrives in your primary inbox. In the MailShrine dashboard every name should show Active, the same expiry year, and privacy and lock on.
FAQ
Does owning several extensions help SEO?
No. Google treats each domain separately, and duplicate sites on multiple domains can split your signals. Redirect the extras to one canonical domain so all authority accumulates in one place.
Should I buy the .com if I already use a country domain?
If there is any chance you will sell outside your country, yes. The .com is the extension international customers guess first and it is rarely available later. If you are strictly local, the ccTLD alone is defensible.
What about misspellings of my brand?
Typo domains matter when you have high direct traffic. For a small business, one or two obvious misspellings at most; beyond that the money is better spent on the primary name's renewals.
Can I recover a variant someone else registered?
If you hold a trademark and the registrant is using the name in bad faith, ICANN's UDRP process or a registry-specific dispute policy can transfer it to you. It costs more than a registration and takes months, which is why buying early is cheaper.
Can I drop a defensive domain later?
Yes. Turn off auto-renew in MailShrine, let it expire, and the registry releases it after the grace and redemption periods. Make sure no customer mail or links still rely on it first.
Next steps
- Country Domains vs .com for International Business — when the ccTLD or the
.comshould be your primary. - Domain Portfolio Management for Agencies — keeping many names renewing on time.
- Parking a Domain: What It Means and Whether to Do It — what to do with names you are not using yet.
Citations & References
- Reference: ICANN: Uniform Domain-Name Dispute-Resolution Policy
- Reference: Google Search Central: Consolidate duplicate URLs
- Reference: RFC 7489: DMARC
- Reference: IANA: Root zone database
Written by Samira K., small-business editor. Samira writes for owners who run the business and the IT, and keeps every recommendation priced in real money.