Should you buy extra domains for your brand?

Short answer: Buy a few extra domains only when they protect something real: the obvious misspelling customers actually type, the country domain where you trade, or a variant someone could use to impersonate you. Point every extra domain to your main site with a permanent redirect, lock down their email settings so nobody can send mail pretending to be them, and keep all of them at one registrar on auto-renew. Skip the rest; a drawer full of unused domains is a renewal bill, not protection.

Domain registrars are very good at suggesting extras at checkout: .net, .co, .shop, .online, plurals, hyphenated versions. Some are worth it. Most aren't. Here's how to tell the difference, and how to set up the ones you keep so they help instead of causing problems.

Decision guide

Worth buying

Your country domain if you trade there. If customers expect a local ending (such as .co.uk, .com.au, .de or .ca), owning it matters even if your main site is on .com.
The .com if your main domain is something else. People type .com by habit. If someone else owns it, some of your visitors and emails will go there.
The most likely misspelling. One or two realistic typos of a hard-to-spell name, especially if you say your web address aloud on the phone or radio.
A version that could be used for phishing. If your business handles payments or logins, a lookalike domain is an attack waiting to happen. Owning the obvious ones removes that option.
A short campaign domain you'll actually print. A memorable domain for flyers or vehicle signage can be useful if it redirects to a specific landing page.

Usually not worth it

Every new extension your registrar offers.
Dozens of typo variations nobody would realistically type.
Domains bought "just in case" for products you haven't launched and may never launch.
Defensive registrations in countries where you have no customers.

One line on trademarks: owning a domain isn't the same as owning a brand name, so if your name matters a lot, look into protecting it properly where you operate.

A quick test

For each candidate, ask: Would a real customer type this? Could someone use it to impersonate us? Will we put it on anything? If the answer to all three is no, don't buy it.

How to redirect extra domains properly

Pick one main domain

Google's documentation on redirects recommends choosing one preferred (canonical) URL when people can reach your site in several ways, and redirecting the others to it. That applies to extra domains as much as to www versus non-www.

Use permanent server-side redirects

Google recommends a permanent server-side redirect (a 301 or 308) when you want the target to be the address shown in search. For extra domains:

Redirect every version (with and without www, http and https) of the extra domain to the matching page on your main domain, or to the homepage if paths don't exist.
Make sure the extra domain has a valid HTTPS certificate. A browser warning appears before the redirect if it doesn't, which looks worse than not owning the domain.
Avoid redirect chains: go straight to the final URL in one hop.
Don't publish a copy of your site on the extra domain. "Domain forwarding with masking" at some registrars shows your site under the other address, which creates duplicate versions and confuses visitors.

Don't use extras for separate thin sites

A second domain with a cut-down version of your content to "rank twice" rarely works and splits your effort. If a domain has no clear job, redirect it.

Protecting email on domains that don't send mail

This is the step most businesses miss. A domain that doesn't send email can still be used by criminals to send spoofed emails that look like they come from you. The UK's National Cyber Security Centre recommends four DNS records for parked, non-sending domains:

SPF with no permitted senders (v=spf1 -all), saying no server is allowed to send mail for the domain.
A DMARC record with a reject policy (p=reject), telling receiving servers to discard mail that fails checks.
A null MX record, so mail sent to the domain fails immediately rather than being attempted.
A wildcard DKIM record, which NCSC describes as not strictly required but helpful.

If an extra domain does need to receive mail (for example, a typo version where customers might mistakenly email you), set up forwarding to your main mailbox instead of the null MX, and keep the SPF and DMARC protections that match.

Setup checklist

[ ] List every domain you own, where it's registered, and when it expires.
[ ] Move them to one registrar account with two-factor authentication on.
[ ] Turn on auto-renew and check the payment card on file. ICANN's guidance notes most registrars offer auto-renewal and says to keep payment details up to date.
[ ] Make sure the renewal reminders reach a monitored inbox. ICANN says registrars must send reminders roughly a month and a week before expiry.
[ ] Set up permanent redirects from each extra domain to the main domain, over HTTPS.
[ ] Add SPF, DMARC and null MX records to domains that don't send email.
[ ] Note in your calendar when each domain expires, as a backup to auto-renew.
[ ] Review the list once a year and let go of domains with no job.

FAQ

What happens if a domain expires by accident?

Your website and email on that domain stop working. ICANN explains that a deleted domain enters a 30-day redemption period during which it can usually be restored, often for an extra fee, before it becomes available to others.

Do extra domains help my SEO?

Not by themselves. Redirected domains mainly help people who type the wrong address, and protect your brand from misuse.

Should I redirect to the homepage or matching pages?

Matching pages if the extra domain was ever used with those paths; the homepage if it never hosted content.

Is a .co domain a good backup for a .com?

Only if you'll use it or need to protect it. People often confuse .co with .com, which can send your visitors elsewhere if someone else owns it.

If your domains, redirects and email records have grown messy over the years, we can sort them into one clean setup.