Every side project used to start the same way: buy the domain. It was step zero of getting an idea off the ground, and the cheapest way to make an idea feel real. These days mine start with Claude prototyping something, and only once it’s looking feasible or interesting do I come up with a name and buy the domain - though I do usually end up there. What I’ve never written about is what happens to all those domains afterwards.
The answer is: nothing. Nothing happens to them. They pile up quietly at the registrar - the personal-name variants, the .co.uk “just in case”, one per project including the projects that died - each configured in whatever way seemed sensible at the time, on whichever DNS provider I was enjoying that year. I recently counted mine: thirteen live domains, spread across four DNS providers - AWS Route 53, Vercel, Netlify and Cloudflare - with no record anywhere of what pointed where or why.
The wake-up call
It started when I tried to register for a Google Play Console account and wanted to use my whitelist-all domain as the public-facing developer address - forgetting that I’d shut that mailbox down over a year ago. I couldn’t even log in to Fastmail any more; I’d deleted the account and forgotten all about it.
So I asked Claude to work out where that domain’s DNS actually lived. Once that domain was sorted, I asked the obvious follow-up: here’s a list of every domain I own - review all of them. The report that came back was full of red. Among it: five domains that had been failing DNS lookups entirely - not returning a clean “does not exist”, but SERVFAILing - for an unknown amount of time.
The cause of those five is a classic. At some point I’d deleted their Route 53 hosted zones to save a bit of money and forgot to park the DNS somewhere more sensible. I had nothing set up to alert on this. The websites just stop resolving, and email to those domains fails slowly and silently - senders’ servers see a temporary failure and politely retry for days. Nobody can tell you - mail is the thing that’s failing.
One travel day, with Claude
The whole thing took one travel day, and my share of the effort was honestly just clicking and bits of config - Claude did the tedious part: every record for every domain checked against two resolvers, anything odd chased to the authoritative nameservers, and everything written down as we went. Exactly the kind of work I’d normally lose patience with four domains in.
Then came the consolidation: DNS and hosting pulled back towards the providers I actually enjoy using, and - in a pleasing bit of scope creep - this very blog. My Svbtle subscription had lapsed too, and I wanted ownership of my blog content back so I could continue writing. You’re reading the result.
Every domain is now one of two shapes
The biggest win wasn’t fixing the broken domains - it was ending up with a rule. Every domain I own is now in exactly one of two configurations, and I’ll try not to invent a third, but I’m only human. And this human likes experimenting with new providers to see how they work.
Domains that send mail get the full treatment: proper MX, SPF, DKIM enabled per-domain (publishing the DNS record alone is not enough - ask me how I know), and DMARC with reporting so I can see who’s sending as me before turning enforcement up.
Everything else is parked, and parked properly. Three records make a domain provably incapable of mail:
@ MX 0 .
@ TXT "v=spf1 -all"
_dmarc TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s;"The null MX (0 .) is the one some people might be tempted to skip. It declares “this domain accepts no mail”, so anything misdirected bounces immediately instead of retrying for days. And the strict SPF and DMARC mean nobody can usefully spoof mail from a domain you’d forgotten you owned - which is exactly the kind of domain a bad actor might choose to spoof.
I’d rather keep all my domains mail clean for a future when I might want to use them for some new side project I can’t imagine yet.
Things I learned along the way
- TXT values cap at 255 characters per string - that’s DNS’s rule, but Route 53 makes you do the splitting yourself. A 2048-bit DKIM key is around 400, so it has to be split into quoted chunks inside one record - not two records. This is annoying, and AWS should make it more intuitive in their UI.
- Nameserver changes take up to 48 hours to look consistent. The TLD’s delegation records carry roughly a two-day TTL, so domains flip over at different times and it looks broken when it isn’t - which I found particularly frustrating, as I’m very impatient. There’s also a funny quirk you only find out when adding domains to Vercel in bulk: you have to actually select the Vercel DNS tab for it to work - it looks informational, it isn’t.
- DNS providers can disagree with themselves. One of mine was serving a DMARC record from some anycast nodes and NXDOMAIN from others, flipping between queries. You only see this if you ask each nameserver directly. More caching nonsense!
The output
The whole day boils down to one reference document in a private repo: every domain, its registrar, its DNS provider, what it points at, how its mail is configured, and a “last verified” date - because every line was checked against live DNS.
Claude automated everything it could, but it turns out Vercel’s MCP tools don’t allow editing DNS records - so the parked-domain lockdown runs as a small script against Vercel’s API instead, dry-run by default. Mildly annoying from a phone.
Next time something breaks, or I’m wondering whether it’s safe to let something lapse, nothing depends on what I can remember from August 2026.
Two retirements
An audit like this forces honesty about which projects are actually alive, and two of mine weren’t.
lapseguard.io is gone because I stopped believing there was enough of a market for it. The idea held up; the maths didn’t. AquaticIQ, a swim-specific project, is gone because it was extremely niche and near-impossible to test properly without a lot of manual human effort - with a Windows machine. Sack that.
Some ideas are cheap to build and expensive to validate, and it took me too long to notice these were the second kind.
Go and dig your own domains
Ten years ago I wrote that every day is International Backup Awareness Day and told you to go and check your backups. Same message today: you almost certainly own a domain you haven’t thought about in years, and it’s quietly resolving to something - or worse, quietly failing to. Take it from me - I was paying renewal fees on five domains that didn’t even resolve.
Go and do it now. It’s OK - I can wait.
Maybe I should build a simple one-shot website that allows dropping in a list of domains and getting a thorough review… let me know if you’d use this!