Guide · Scam Watch
That domain renewal letter is not your renewal bill
How to recognize a domain-transfer solicitation, find your real registrar, and renew safely in Canada or the US.
Updated 2026-10-07
An official-looking letter arrives with your domain name, an expiry date, and an urgent payment request. It may call itself a renewal notice. If the sender is not the registrar where you bought the domain, paying can start a transfer or buy an unrelated listing instead of renewing your existing registration.
The US Federal Trade Commission documented this transfer-by-renewal-notice pattern, and its current small-business advice says unexpected domain invoices deserve the same verification as any unfamiliar bill.
Check the sender, not the design
Do not use the phone number, QR code, or web address printed on the letter.
- Open your password manager or original purchase receipt.
- Sign in to the registrar you already use.
- Check the domain’s expiry date and auto-renew status there.
- Compare the registrar’s legal name with the sender.
- If they differ, treat the letter as a solicitation, not your bill.
The important fine print often says “transfer,” “listing,” “offer,” or “not a bill.” A real renewal happens inside your existing registrar account.
Canada: letters using names such as “Domain Registry of Canada” can look government-adjacent, but CIRA operates the .ca registry and your retail registrar handles your renewal. Use CIRA's WHOIS lookup (it shows the registrar) and the official ICANN lookup for .com records. A registry is not automatically the company you pay.
United States: variants have used “Domain Registry of America” and similar names. Use the official ICANN Registration Data Lookup to identify registration details, then sign in to your known registrar directly.
Why they knew your domain
Some registration data is public, and newly registered or soon-to-expire domains are easy to target. Privacy or proxy registration reduces exposed contact details where the domain extension allows it, but it does not stop every mailing.
For .ca, CIRA applies privacy protection differently depending on whether the registrant is an individual or organization. Check the current CIRA policy rather than assuming a business registration is hidden. For .com, confirm that privacy is enabled in the registrar dashboard.
If you already paid
Check your real registrar account immediately:
- Did the registrant, registrar, nameservers, or domain lock change?
- Did you receive a transfer authorization email?
- Is your website and email still resolving?
- What cancellation or refund terms appear on the solicitation?
Contact your existing registrar from its official website. If a transfer is pending, ask how to stop it. Save the letter, envelope, receipt, and correspondence.
Canadian businesses can report deceptive marketing or fraud to the Competition Bureau and Canadian Anti-Fraud Centre.US businesses can report deceptive invoices to the FTC at ReportFraud.
The free route and the paid trigger
You need no paid monitoring service. Turn on auto-renew, keep a valid payment method, enable the domain lock, and add two calendar reminders before expiry.
A paid domain-management service is justified only when a company owns enough domains that one employee can no longer maintain the inventory and renewal controls. For most small businesses, the registrar dashboard plus the ownership checklist is enough.