Buying a domain name is one of the few high-value digital purchases you can make in an afternoon — and one of the few where a single mistake is unrecoverable. There is no chargeback on a wire transfer, no buyer protection on a registrar push, and no way to claw back an auth code once it has been sent to the wrong address.

This is the checklist we walk every serious buyer through.

Step 1: Never move money before escrow is open

If someone asks you to send funds directly — by wire, crypto, gift cards, or “friends and family” payment — before the domain has been verified and the transfer process started, that is the single most common way buyers lose money.

Use a licensed escrow service. Escrow.com is the industry standard for domain transactions; some registrars and marketplaces run their own escrow or a payment-hold equivalent. The mechanics that matter:

  • Your funds sit with the escrow agent, not the seller.
  • The domain is pushed or transferred to your account before the seller is paid, or the transaction is structured as a simultaneous exchange through the agent.
  • Neither side can unilaterally take the money.

If a seller refuses escrow and the price is more than you would comfortably lose, walk away. A legitimate seller has no reason to refuse.

Step 2: Confirm the domain is actually theirs to sell

Ask for proof of control. Any one of these is sufficient:

  • The domain is listed for sale on the registrar’s own marketplace under their account (Afternic, Sedo, GoDaddy, Porkbun and others show verified ownership).
  • They can produce a recent registrar screenshot showing the exact domain in their account.
  • They can add a TXT record you specify, or point a temporary subdomain to a server you control.

Be careful with screenshots: they are trivially editable. A live TXT record or a marketplace listing is far stronger evidence.

Step 3: Check the transfer lock and renewal date

Two registrar-level settings decide how fast (or whether) a deal can close:

  • Transfer lock / clientTransferProhibited. If the domain is locked, the seller must unlock it and release the auth code. Ask up front — this is the most common cause of a “three-day” deal turning into a three-week one.
  • Recent registration or recent transfer. Most registries impose a 60-day transfer hold after a new registration or an inter-registrar transfer. If the domain changed hands two weeks ago, you may simply have to wait it out.

Also check the expiration date. A domain expiring within 30 days adds renewal timing to an already fiddly process.

Step 4: Run the history checks

Fifteen minutes of research prevents most post-purchase regrets:

  • UDRP and UDRP-adjacent disputes. Search the WIPO case database for the exact name and close variants. A domain that has been found to be a cybersquatter’s asset carries reputational and legal risk.
  • Trademark exposure. Search your national trademark register (USPTO, EUIPO, or equivalent) for the exact term in relevant classes. Owning a domain is not the same as having the right to use the brand it spells.
  • Prior spam or malware use. Check historical DNS and web archives. A domain burned by spam is harder to mail from and harder to rank.
  • Matching social handles. Availability of @name on the platforms you care about changes the value of the package — and it is not guaranteed to come with the domain.

Step 5: Agree the exact deliverables in writing

Before anything moves, get a short written statement covering:

  1. The exact domain name and price.
  2. That the seller holds clear title with no liens, disputes, or co-owners.
  3. That the domain will be unlocked and the auth code provided, or pushed directly to a named registrar account.
  4. Whether any website, content, email, trademark, or social accounts are included (usually: none).
  5. The escrow arrangement and who pays the transfer fee.

For a single-asset purchase this fits in five lines of email. If a seller will not put it in writing, treat that as a red flag.

Step 6: Take delivery the right way

Two safe paths, in order of preference:

Registrar push. The seller moves the domain into your registrar account, same registry, usually minutes. Fastest and lowest risk — but it only works if you both use the same registrar.

Inter-registrar transfer with auth code. You unlock, receive the code, and initiate the transfer from your own registrar. This typically takes one to seven days and requires control of the email address on your account.

Whichever route you use, confirm you set the new contact details and enable the transfer lock immediately after delivery. The transaction is not finished until the domain is locked under your account.

Step 7: The five red flags, at a glance

  1. No escrow, or “escrow is too slow.” Non-negotiable for four-figure-and-up purchases.
  2. Pressure and false scarcity. “Three other buyers are waiting” is a sales tactic, not information. Verify what you can, ignore what you cannot.
  3. Price far below market with an odd payment route. Steep discounts plus crypto or gift cards is the classic scam shape.
  4. Refusal to prove control of the name.
  5. Requests for your registrar credentials. Never share them. A legitimate seller never needs your password.

A note on the asset itself

A premium domain is a one-of-one asset: when it sells, it is gone, and there is no second copy to buy. That is exactly why the due diligence runs in both directions — the buyer needs proof of title, and the seller needs proof of funds.

Get escrow open, prove control, confirm the locks, and put the deliverables in writing. Do those four things and the risk in a domain purchase drops from “unrecoverable” to “routine.”

This guide is general information, not legal advice. For transactions with trademark or cross-border implications, speak to counsel.