Notifications
Clear all
Topic starter
23/06/2026 7:16 pm
TL;DR: SMBs that manage multiple domains face rising DNS misconfiguration, certificate expiry, and email-authentication exposure as records, renewals, and access controls multiply, according to DigiCert. The core issue is not just operational load but governance drift, where domain portfolios become identity-adjacent assets without lifecycle, visibility, or control discipline.
NHIMG editorial — based on content published by DigiCert: Taming Domain Sprawl: How SMBs Can Simplify Multi-Domain Management
Questions worth separating out
Q: How should security teams govern multiple domains without losing control of DNS and certificates?
A: Security teams should centralise ownership, use templates for standard DNS records, and track every domain, certificate, and authentication setting in a single lifecycle register.
Q: Why do multiple domains increase security risk even when each site looks simple?
A: Multiple domains increase risk because every registrar, DNS zone, certificate, and email-authentication record is another trust surface that can drift or be abused.
Q: What breaks when domain management is not treated as a lifecycle process?
A: Renewals get missed, DNS records become inconsistent, certificates expire, and ownership becomes unclear when there is no lifecycle process.
Practitioner guidance
- Inventory every domain and its control owners Build a single register for domains, registrars, DNS providers, certificates, and email-authentication settings.
- Version-control DNS templates and change approvals Use reusable templates for common record sets, then require peer review for any production DNS change.
- Harden registrar and DNS admin access Require strong authentication, restrict privileged accounts, and review who can modify registrar settings, nameservers, and transfer locks.
What's in the full article
DigiCert's full blog covers the operational detail this post intentionally leaves for the source:
- Practical hosting and multi-domain setup options for add-on domains, VPS, and dedicated servers.
- Step-by-step DNS record handling for A, CNAME, MX, and TXT entries across multiple sites.
- Specific guidance on SSL/TLS, SPF, DKIM, DMARC, and DNSSEC configuration for domain portfolios.
- Tactics for using automation, APIs, and infrastructure-as-code to scale repeatable changes.
👉 Read DigiCert's blog on taming domain sprawl and multi-domain management →
Domain sprawl and DNS governance: what IAM teams are missing?
Explore further
25/06/2026 3:12 am
Domain sprawl is a trust governance problem, not just a web operations problem. Multiple domains expand the number of places where identity, access, and renewal control can fail. DNS, registrar permissions, and certificate handling all sit close to NHI-style governance because they determine who can alter trusted infrastructure. The practitioner takeaway is that domain portfolios need the same lifecycle discipline applied to other high-value identity assets.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how often identity-adjacent assets remain outside effective governance, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should be accountable for registrar access, DNS changes, and certificate renewal?
A: Accountability should sit with a named infrastructure or identity owner who can coordinate security, operations, and web teams. The key is to make privileged access and change approval explicit, because domains are trust infrastructure, not just marketing assets.
👉 Read our full editorial: Domain sprawl creates a governance gap for SMB identity security
