Should You Buy Multiple Domain Extensions to Protect Your Brand?
The moment you register a domain, your registrar will offer you a bundle: the .net, the .org, the .co, the .io, and a dozen others "before someone else takes them." Some of those registrations genuinely protect your brand; most are an annual cost that protects nothing. With well over a thousand top-level domains now in the root zone, it is impossible to own them all, so the real question is which ones are worth having and how to set them up so they actually help. This article covers the threats defensive registrations address, a practical framework for choosing extensions, how to configure the extra domains with redirects and anti-spoofing DNS records, and the alternatives that are often cheaper. If you are still choosing your main extension, read .com vs .net vs .org first.
Why Businesses Register Extra Extensions
Defensive registration means registering domains you do not intend to build a website on, purely to stop someone else from using them. The motivations are real:
- Customer confusion: If your site is
acme.comand a competitor or unrelated business runsacme.net, some of your customers will end up in the wrong place. - Phishing and fraud: Attackers register lookalike domains to send convincing emails to your customers or staff. An invoice from
acme.coinstead ofacme.comis easy to miss. - Cybersquatting: Someone registers your brand in another extension hoping to sell it back to you at a high price. See what cybersquatting is for how that works.
- Typosquatting: Misspellings of your domain catch visitors who mistype it. What is typosquatting covers the tactics.
- Future expansion: If you plan to open in another country, the matching country-code domain is much easier to register now than to buy back later.
Why You Cannot, and Should Not, Register Everything
The root zone contains well over a thousand TLDs, according to IANA's Root Zone Database. Even registering your brand in a fraction of them would cost a significant amount every year, and the protection is weaker than it sounds:
- Attackers have endless variations to choose from: hyphens, extra words like
acme-login.comoracmesupport.com, character swaps, and homograph lookalikes. Owningacme.xyzdoes nothing to stopacme-billing.com. - Each extra domain is one more thing to renew, secure, and monitor. An expired defensive domain can be picked up by exactly the people you were trying to keep out.
- Some extensions have premium pricing for strong brand words, so the cost of a single defensive registration can be surprisingly high.
The goal is not completeness. It is covering the handful of domains that people are most likely to confuse with yours, and monitoring the rest.
A Practical Framework for Choosing Extensions
Think in tiers. The table below is a starting point, not a rule:
| Tier | What to register | Why |
|---|---|---|
| Essential | Your primary domain, plus .com if your primary is something else | .com is what people type by default |
| Strongly recommended | ccTLDs for the countries where you actively sell or operate | Local customers expect them, and some are hard to recover later |
| Recommended for larger brands | .net, .org, and obvious typos of your primary domain | The most common points of confusion |
| Situational | Industry-specific TLDs such as .shop, .app, .law, or .bank | Only if they are a natural fit or a likely abuse target in your sector |
| Usually skip | Random new gTLDs with no link to your audience | Low risk of confusion, ongoing cost |
Ask three questions about each candidate:
- Would a real customer plausibly type or trust this domain? If not, the risk is low.
- What would happen if a bad actor owned it? A lookalike that could host a convincing phishing page for a bank is a higher risk than one for a hobby blog.
- Could I recover it later if needed? For gTLDs, the UDRP gives trademark owners a route to recover domains registered in bad faith. That is slower and more expensive than a registration fee, but it means you do not have to pre-register every possible extension.
For new brands, check each candidate extension's eligibility rules first: many country-code TLDs require local presence, and some new gTLDs are restricted to verified businesses or professions.
Check Which Variants Are Already Registered
Before deciding, see which variants are free. This Bash script queries RDAP for your brand across a list of extensions. RDAP returns HTTP 404 when a domain is not registered:
#!/usr/bin/env bash
# Usage: ./variants.sh acme
brand="$1"
tlds=(com net org co io app shop uk de ca)
for tld in "${tlds[@]}"; do
domain="${brand}.${tld}"
code=$(curl -s -o /dev/null -w "%{http_code}" -L --max-time 15 "https://rdap.org/domain/${domain}")
case "$code" in
404) status="not registered" ;;
200) status="registered" ;;
*) status="unknown (HTTP ${code})" ;;
esac
printf "%-20s %s\n" "$domain" "$status"
done
Some ccTLD registries do not publish RDAP, so an "unknown" result needs a manual whois check. For registered variants, look at who owns them and what they host before assuming they are a threat; many will be legitimate, unrelated businesses.
How to Configure Defensive Domains
Registering a defensive domain is only half the job. Left unconfigured, it shows a registrar parking page, which looks unprofessional and may display ads. Configure every defensive domain in three ways.
1. Redirect Web Traffic to Your Main Domain
Use a permanent 301 redirect so visitors and search engines end up on your primary domain. Search engines treat a 301 as a signal that the main domain is the canonical one, so defensive domains do not compete with it.
On Nginx, a single server block can handle all defensive domains:
server {
listen 80;
listen 443 ssl;
server_name acme.net www.acme.net acme.org www.acme.org acme.co www.acme.co;
ssl_certificate /etc/letsencrypt/live/acme-defensive/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/acme-defensive/privkey.pem;
return 301 https://www.acme.com$request_uri;
}
On Apache with .htaccess in the document root shared by the defensive domains:
RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\.acme\.com$ [NC]
RewriteRule ^(.*)$ https://www.acme.com/$1 [R=301,L]
Make sure HTTPS works on the defensive domains too, otherwise visitors who type https://acme.net will see a certificate error before the redirect happens. A single certificate with all the defensive names as Subject Alternative Names works well. If you would rather not run a server, most registrars and DNS providers offer forwarding; what domain forwarding is compares the options.
Verify the redirect from the command line:
curl -sI https://acme.net/pricing | grep -iE "^(HTTP|location)"
You want to see a 301 status and a location header pointing to https://www.acme.com/pricing.
2. Lock Down Email Spoofing
A domain that does not send email is still a phishing risk if anyone can send mail that claims to be from it. Publish records that tell receiving mail servers to reject everything:
acme.net. IN MX 0 .
acme.net. IN TXT "v=spf1 -all"
_dmarc.acme.net. IN TXT "v=DMARC1; p=reject; adkim=s; aspf=s;"
- The null MX record (
MX 0 ., defined in RFC 7505) states that the domain accepts no email. - The SPF record
v=spf1 -allsays no server is authorized to send mail for the domain. - The DMARC record with
p=rejectasks receivers to reject messages that fail authentication.
Check them with dig:
dig +short MX acme.net
dig +short TXT acme.net
dig +short TXT _dmarc.acme.net
3. Secure and Renew Them Like Production Domains
Defensive domains need the same protection as your main domain:
- Keep them at the same registrar account, protected by strong two-factor authentication.
- Enable the registrar lock on every one.
- Turn on auto-renew and track expiry dates. A lapsed defensive domain is an open invitation.
Cheaper Alternatives and Complements
Defensive registration is one tool among several:
| Approach | What it does | Best for |
|---|---|---|
| Trademark registration | Gives you legal standing in disputes such as the UDRP | Every established brand |
| Trademark Clearinghouse (TMCH) | Lets trademark holders register during new gTLD sunrise periods and receive claims notices | Brands concerned about new gTLD launches |
| Registry blocking services | Some registry operators sell blocks that prevent registration of your mark across many of their TLDs | Large brands with high abuse risk |
| Domain monitoring | Alerts you when lookalike domains are registered | Catching threats you cannot pre-register |
| UDRP or URS complaints | Recovers or suspends bad-faith registrations after the fact | Clear cases of cybersquatting |
A registered trademark is the foundation. Without one, recovering an infringing domain is much harder. What the UDRP is explains the dispute process in detail.
Recommendations by Business Size
- Solo creators and early-stage startups: Register your primary domain and, if it is not already the
.com, try to get the.comtoo. Add an obvious typo only if it is cheap. Put the money you save into a trademark later. - Small and medium businesses: Primary domain,
.com, ccTLDs for every country you sell in, and the most likely one or two typos. Configure redirects and anti-spoofing records on all of them. - Established and regulated brands: Add
.net,.org, relevant industry TLDs, common typos, and consider TMCH registration and a monitoring service. Banks, payment providers, and other frequent phishing targets should treat lookalike monitoring as essential.
Domain Extensions FAQ
Not necessarily. They are most useful for larger or well-known brands where confusion or phishing is likely. For a small business, the .com and any relevant country-code domains are usually more valuable.
No. Search engines do not reward owning many extensions. Defensive domains should 301 redirect to your main site, which consolidates signals on one domain rather than adding new ones.
It can cause duplicate content and split signals between hostnames. Use a 301 redirect from every secondary domain to the primary domain so there is a single canonical version.
Yes, if you redirect them. Visitors and links may use https, and without a valid certificate they will see a browser warning before the redirect. Free certificates from Let's Encrypt cover this easily.
Publish a null MX record, an SPF record of v=spf1 -all, and a DMARC record with p=reject. Together they tell receiving servers that the domain sends no legitimate mail.
Check what they use it for. If it is a legitimate unrelated business, there may be nothing to do. If it is used in bad faith against your trademark, you may be able to recover it through the UDRP or legal action.
For high-traffic or frequently phished brands, registering the most common misspellings is sensible. For most small sites, a couple of obvious typos at most is enough, combined with monitoring.
Conclusion
Buying multiple domain extensions can protect your brand, but only when the extra registrations target real risks. The domains worth owning are the ones customers might genuinely type or trust: the .com, country-code domains where you operate, and the most obvious typos or alternatives. Registering dozens of unrelated new gTLDs mostly adds annual cost without stopping attackers, who can always choose a different variation.
Whatever you register, configure it properly. Redirect web traffic to your primary domain with a 301, publish null MX, SPF, and DMARC records so the domain cannot be used for spoofed email, and protect every defensive domain with locks, two-factor authentication, and auto-renew. Combine a small, deliberate portfolio with a registered trademark and domain monitoring, and you get most of the protection for a fraction of the cost.
Here are some useful references for going deeper on defensive domain strategy:
- IANA: Root Zone Database — the full list of TLDs and the registries that run them.
- RFC 7505: A "Null MX" No Service Resource Record — the standard for declaring that a domain accepts no email.
- RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC) — how DMARC policies such as p=reject work.
- Trademark Clearinghouse: About the TMCH — sunrise registrations and claims notices for new gTLDs.
- WIPO: Domain Name Dispute Resolution — recovering domains registered in bad faith.
