Guides

How to buy a second domain for team mail

A variant domain beside your main one avoids the migration entirely. Which TLDs old validators reject, what the registry's own terms cost you, and the order that avoids a 60-day lock.

If the variant name you want is free, Yowl registers it for you and publishes the records itself — so the two days of work below collapse into one step, and the new domain arrives already locked down against forgery.

A domain is a two-day job because it is spread across five companies

That is the actual cost of the checklist below, and it is worth naming before you read it. The registrar sells you the name. A DNS host answers for it. A mail provider wants four records published. Something has to read the DMARC reports. And your old mailbox is at a sixth place entirely. Each has its own dashboard, its own login, its own idea of what “verified” means — and none of them can see the other four, which is why the failures in this guide exist at all.

Yowl is built to be the one shop for all of it. Register the name, point the DNS, publish the records, verify them, cut the mail over, import what was in the old mailbox, watch the DMARC reports and climb the policy ladder — one account, one picture, one thing to ask.

And the thing you ask is your AI

This is the part worth planning around, because it changes what the job is. Yowl’s whole surface is exposed to an agent over MCP: you connect Claude once, and the lifecycle stops being five dashboards and becomes a conversation.

“Is acme.email available? Register it, put the inbox on it, and lock it down so nobody can forge it while it is empty.”

Underneath that is: a registrar availability check, a purchase, a zone, a null MX, an SPF record that authorises nobody, DMARC at reject on the apex and a wildcard, then — when you are ready to actually use it — the mail records, the verification, and a first report read a fortnight later. Your agent sees the whole picture because it is one picture. It can tell you the name is taken and suggest three that are not; it can tell you the registrar signed the domain with DNSSEC by default and that this will matter the day you move nameservers; it can come back in a month and say the reports are clean and it is time to tighten.

An organisation links one domain permanently, so a second domain is a second organisation with its own inbox. But an agent can be shared across both — so the one you have taught your work to does not get set up twice, and “how are all our domains doing?” is a single question with one answer.

If you are buying it yourself

The name is the easy part and the registry’s terms are not.

Your main domain’s mail lives somewhere already, and moving it is a project with a change freeze and a rollback plan. A second domain has none of that. acme.email beside acme.com has no mailboxes, no MX record, and nobody’s Outlook rules depend on it. Point it at a shared inbox and nothing that works today is touched.

Pick a name people can type

Same brand, one word if you can get it. The address gets read out on the phone and typed into other people’s forms, so the test is whether a stranger can spell it after hearing it once.

Then prefer a TLD that old validation code accepts. HTML5’s own email check accepts any TLD, but plenty of software still runs a regex written when TLDs were two to four letters, or six at most. .email is five and passes nearly everything; .photography is eleven and fails anything capped at six. Two-letter country codes, .com, .net and .org pass everywhere. If you want a long TLD, paste an address on it into the three forms you use most before you buy.

Check the name’s past — site:acme.email and the Wayback Machine. A domain that once carried spam or scraped content carries a reputation you inherit with it.

⭐ The registry’s terms are part of what you are buying

This is the part nobody checks, and it varies far more than price does. Each registry sets its own rules, and some of them are things you would have wanted to know first.

Take .co.za, which we sell into and have verified against a registrar’s own API rather than its marketing page:

Zero renewal grace is the one that matters. Most TLDs give you a window after expiry in which a renewal still works and the domain keeps resolving. This one gives none, so a card that fails on renewal day is not a warning — it is the domain going down, with a restore fee seven times the renewal to get it back. Auto-renew plus a payment method that does not expire is not good practice here, it is the whole safety margin.

It is also a ccTLD, which means ICANN’s rules do not govern it — see the next section. And two TLDs carry residency conditions worth knowing early: .eu needs an EU or EEA registrant, .us needs a US nexus. Neither is a problem if you qualify; both are a problem to fix later.

The registrar, and the locks that catch people

Turn on auto-renew, turn on registrar lock, and set the registrant contact to a shared mailbox the team reads rather than one person’s address — the renewal notice arrives in five years, and the person will have moved on.

⚠ But mind the order. For gTLDs, ICANN’s transfer policy imposes a 60-day transfer lock in three situations: within 60 days of initial registration, within 60 days of a previous transfer, and for 60 days after a change of registrant. So changing the registrant contact to that shared mailbox can itself start a lock — do any registrar move before the contact change, not after. The post-registration lock has no opt-out; registrars may offer one on the change-of-registrant lock.

Two caveats. ⛔ None of this applies to ccTLDs, which set their own transfer terms — read the registry’s, don’t assume. And this is changing: the GNSO Council accepted a reform in March 2025 that removes the change-of-registrant lock and shortens the others to 30 days. It had not taken effect at the time of writing, so 60 days is what registrars enforce today.

Day one: DNS, in this order

1. Move the zone to the DNS host you actually want before anything else.
2. Then consider DNSSEC. ⛔ Not before — a signed domain whose nameservers you later change goes SERVFAIL everywhere until the DS is withdrawn, and some registrars sign by default without asking. If your TLD does not support DNSSEC at all, skip this.
3. Lock it down while it sends nothing — a null MX, an empty SPF and DMARC at reject, on the apex and a wildcard: the three records. We did exactly this to yowl.io on 24 September 2026, the day we bought it.

Day two: the inbox

Point the new domain’s MX at the shared inbox and switch the catch-all on (how). Add one forwarder on the main domain for the address people already know, so hello@acme.com lands in the new inbox too. Then change signatures. The old address keeps working; nothing was migrated.

dig +short NS  acme.email     # your DNS host
dig +short MX  acme.email     # the inbox, once pointed
dig +short DS  acme.email     # empty until you deliberately sign it

Connect a domain to Yowl →