Executive summary
Assessing and consolidating domains and DNS providers are critical “pre” and “post” M&A deal priorities. You are not only buying the valuable assets, you are also buying the cyber security risk.
Peter LaMantia, Founder and CEO, Authentic Web Inc.
Most guidance on acquiring domain assets centers on ownership rights, title and brand protection, which helps legal counsel, finance and marketing. It overlooks a large area of risk and cost: enterprise security and the network operations teams that must manage the DNS, mitigate risk and control integration cost after the deal closes. This guide covers the known security and operations problems in acquiring domain and DNS assets, and a pre-deal audit and post-deal consolidation approach for companies active in M&A.
Key points
- You are not just buying the assets, you are acquiring cyber security risk. The acquirer has a limited window to take ownership of the domains and integrate them. They carry latent operational and security issues the target never addressed, and the buyer has no visibility into their true state.
- Sellers do not know what they have, and neither do buyers. Few operators have an accurate inventory of domains and DNS, because those are scattered across multiple registrars, DNS services and certificate authorities. Even when high-value domains sit with one corporate registrar, more are managed elsewhere. Add 10 to 20 DNS services and management rarely has an accurate picture of its own DNS network.
- Pre-deal knowledge drives post-deal execution. Pre-deal audit data gives asset value, a one-time snapshot of DNS security posture, and a checklist to execute before and after closing. Without it, the acquirer assumes the risk.
- The only effective end state is one control system. Most large corporations use multiple registrars and DNS services that do not integrate, creating silos and a security and compliance mess. Domains, DNS and TLS certificates belong under a single unified change management system with permissioned, role-based access, change history and security monitoring.
The solution has two parts: (1) a domain and DNS audit to inform pre-deal schedules and post-deal execution planning, and (2) a post-deal consolidation of domain assets and DNS network under a single, unified control platform. The result is control, visibility, automation, security and compliance.
Background: why domains and DNS are insecure by default
Domain portfolios and the DNS networks they run on are inherently non-secure despite the best efforts of network operators and IT security staff. The DNS is a top attack vector for organizations that have not prioritized locking it down, and audits show every enterprise has vulnerability gaps unknown to its IT staff. There are two main reasons.
1. Few companies know their full domain inventory, and virtually none know the full extent of their DNS network
The digital footprint often includes unknown or poorly inventoried domains, registrars and DNS providers. Access to registrars and DNS for change management can be unclear or fragmented, with gaps in access controls and change management. Accurate zone file enumeration is rarely present: zone files are the “junk drawer” of the infrastructure kitchen, full of long-forgotten legacy settings that expose the enterprise to cyber risk. The problem for an acquirer: the target cannot, or will not, tell you what it owns or has configured on the DNS, yet it falls to your team to gain control and integrate the assets and network.
2. The DNS is a global public network, non-secure by design
The DNS is available to anyone who wants to look, which makes it a prime attack vector used in almost all cyber attacks. Domain portfolios about to change hands are especially vulnerable. Third-party actors watch every company for security gaps, and two merging companies raise the risk because those actors expect institutional knowledge loss and staff disruption around merger events. The problem: enterprise DNS networks contain many ungoverned errors and omissions, and any single one is a vulnerability and attack vector. Examples: missing or misconfigured SPF, DMARC and Start of Authority (SOA) records, orphaned A records, dangling CNAMEs and insecure redirects.
The two deal phases
| Phase | Focus | What the acquirer needs |
|---|---|---|
| Pre-deal | Due diligence assessment, audit, and consolidation and integration planning | (1) Digital asset inventory and network audit. (2) DNS network security and change compliance risk and maturity assessment. (3) Annual recurring total cost of ownership (post-deal). (4) Scoping, planning, deal terms and readiness for post-deal consolidation. |
| Post-deal | Consolidation, integration execution and control system set-up | (1) Take control of registrar, DNS provider and certificate authority vendor systems. (2) Consolidate with a turnkey vendor service that also addresses security gaps. (3) Establish an enterprise control system so teams can manage assets and networks. |
Pre-deal problem: due diligence in this area is weak. It relies on the target’s internal, potentially biased and incomplete information, so acquirers need a third party with technology for the assessment and the post-deal consolidation plan. Domains, DNS and certificates map onto familiar diligence areas:
| Due diligence area | What domains, DNS and certificates add |
|---|---|
| Operational due diligence (ODD) | Operational gaps and risks |
| IT due diligence (ITDD) | Operational and financial risk |
| Digital due diligence | Digital footprint inventory |
| Technology asset due diligence | The tech stack supporting the assets |
Post-deal problem: domains and DNS are hard to manage and consolidate, relying on internal institutional knowledge and cooperation. Acquirers need an integration and consolidation plan that is documented and resourced at closing, and should consolidate and take control of digital assets as soon as possible after the deal.
An illustrative scenario: the deal and the team story
The paper walks through a typical M&A event with a sizeable domain portfolio, using a fictional target called “GlobalCo”. The CFO and Chief Legal Officer set short deadlines. Network Ops and IT security are brought in after diligence, told to prioritize revenue and customer-supporting systems, and inclined to leave the DNS as is “for now”. That is when problems start.
Evaluating digital asset value and security posture the old way
Getting a handle on inventory and pre-deal security is expensive and difficult even for internal experts. Few tools provide detailed accounting of individual domains, networks and security settings, and proprietary audit tools are rare. Teams are forced into laborious server-level queries. The paper states that approximately 80% of the Fortune 1000 use Excel spreadsheets to snapshot domain portfolios, which are manual, time-consuming and error-prone, and commonly miss material data from the “don’t know what we don’t know” category. The diligence team is need-to-know and under NDA, so it cannot reach the staff it needs. An independent third party with specialized systems can provide an assessment record, a risk profile and an inventory of assets and configurations.
Pre-deal phase
The first issue is valuing the target’s digital assets accurately. GlobalCo may have a corporate registrar with several hundred domains, but more likely has many retail and corporate registrars and several DNS providers, and it has absorbed other domain portfolios over years of acquisitions without consolidating them under one registrar, DNS network and change control system. Your team does not know the true number of domains, what they are, where they are registered or what DNS service they run on, and the DNS footprint cannot easily be inventoried. Diligence ends up accepting the information received, trusted or not, and the deal gets done.
Asset value is one thing; IT security and control risk is another. In-house counsel and the CMO focus on ownership, while significant risk sits under the surface of the DNS network. A domain and DNS security posture audit requires knowledge of:
- Domain registrars, with a review of access and change controls.
- DNS service providers, with a review of access and change controls.
- Assessment of DNS security risks, with a time-stamped state of the network.
- Mapping of domain and DNS security settings, for example SPF, DMARC and DNSSEC.
- Risk audit of HTTPS, redirects, CNAMEs and certificate coverage.
A time-stamped assessment matters because the interval between assessment, closing and the later consolidation is highly vulnerable: internal personnel can make changes that affect asset value or create new vulnerabilities. Deal terms should include an agreed plan to consolidate and secure the acquired assets, budgeted into the integration phase as early as possible.
Post-deal phase
When the deal closes you own all of the target’s domains, DNS operations, value and unseen risk, ready or not. An M&A-active team has usually not fully consolidated the last batch of domain assets, or the one before that (“we’ll get to it when things settle down”). Before close you need a DNS security policy and a plan for system-based compliance governance. The immediate post-close period carries its own risks: staff are uneasy under new management, key personnel turn over, and institutional knowledge dissipates. Every month after closing the need to consolidate grows while institutional memory erodes. Audits of M&A-active enterprises invariably reveal unresolved legacy issues and security-compromising artifacts dating back years.
| Common post-closing risk | Description |
|---|---|
| Inventory | Only a partial inventory of valuable digital assets. |
| Security risk | Unknown risks you must discover and mitigate. |
| Expiring domains | Valuable assets that fall through the cracks. |
| Expiring certificates | Expiring, ungoverned TLS certificates. |
| Personnel | Turnover and internal errors expose the business. |
| Post-close priority | Action |
|---|---|
| Security policy | Establish a DNS security policy and run a system-based compliance program. |
| Consolidation | Consolidate to an enterprise-grade registrar, DNS and certificate provider control system. |
| DNS hygiene | Assess, clean up DNS resource records and set criteria to cull non-valued domains. |
| People and systems | Establish internal ownership and systems to maintain compliance with DNS security policies. |
| Full zone security | Audit and address DNS security risk once everything is under a single control system. |
These priorities are easier said than done. The manual processes and missing tools that limited diligence apply after close too, now across a larger, more disparate legacy base. Existing vendors help little: retail registrars are ill-equipped for enterprise consolidation; the corporate registrar is the logical candidate but is typically not equipped on the DNS and security side; DNS providers and certificate authorities supply commodities and do not help customers migrate to competitors. Once done at great effort and expense, the next acquisition repeats the cycle, so a repeatable process with policy, systems, process, project and people is required.
Best practices: a modern approach
Senior network operators and IT security managers often admit their domain and DNS operations have latent problems but are best left alone because of time, staff, cost and risk of breakage. The cycle of M&A-driven risk is at its core a process problem in change management. If acquisitions are part of your success model, you need a change management process built for consolidating and managing domains and the DNS networks the business runs on. The approach rests on five pillars:
| Pillar | What it means |
|---|---|
| Control | Change management workflow, control and change history. |
| Visibility | Single-pane-of-glass digital asset and network visibility. |
| Security | DNS security visibility so teams can get and keep control. |
| Compliance | System-based security policy compliance. |
| Automation | Automated, purpose-built tools to manage domains and DNS. |
On these pillars every step of an enterprise domain’s lifecycle can be managed reliably and economically, resolving urgent M&A issues and improving day-to-day operations.
Pre-deal due diligence and planning
Two concerns: an accurate inventory of the target’s digital assets, and a complete security audit of all domains and the related DNS network. Because the target’s assets may be simple or very complicated to absorb, the effort should be reflected in the purchase price as a cost to realize the asset purchase IRR. The checklist:
- Establish an inventory baseline to include in the purchase agreement schedules.
- Conduct a domain and DNS audit to benchmark current configurations pre-deal.
- Articulate the business risks the audit exposes and their potential impacts.
- Prepare a consolidation and integration plan and agreement between the parties, naming key personnel, vendors and technologies.
- Create and approve a budget as part of the larger post-deal consolidation and integration effort.
Getting pre-close diligence right makes consolidation a “once and done” step. Serial acquisition of disparate portfolios is not a rinse-and-repeat undertaking; it compounds and postpones operational pain.
Post-close integration
With an accurate inventory and a detailed audit, avoid two common scenarios:
- Bolt-on, bringing new domains and DNS operations in as they are. It resolves few security issues, gives few economies of scale and does not help with future M&A.
- Tuck-in, migrating acquired domains to the existing corporate registrar. One registrar is better than many, but it leaves DNS security, portfolio rationalization, zone file and resource record cleanup, and change management improvements unanswered.
The better approach uses the M&A event as the catalyst to integrate the whole domain and DNS operation under a single, unified change management platform:
- Use the pre-deal audit to scope a consolidation execution plan and its costs.
- Identify and retain key personnel from the target for execution.
- Establish the DNS security policies.
- Follow a best-practice domain and DNS consolidation project methodology.
- Once consolidated, address legacy security gaps to bring assets into compliance.
- Use control systems to keep control and to give the next acquisition a destination.
Benefits named in the paper:
- DNS and security issues are resolved down to sub-domains and every zone file resource record as part of the migration.
- Fragmented registrars, DNS providers and certificate authorities are replaced by one supplier, for control and lower cost.
- Change management control and security compliance cover legacy, newly acquired and future domain and DNS operations.
- Business case economics are highly positive: serial acquirers see operational savings that easily fund future domain acquisitions.
- Enforced compliance and monitoring keep domains and DNS secure through ongoing changes and new M&A events.
- A single control system automates change management tasks and compliance, and gives M&A stakeholders a repeatable playbook.
Summary and conclusion
Well-managed domains are valuable branded digital assets, and the DNS underpins the entire business and cannot be left to post-deal uncertainty. Pre-deal, teams lack the tools to identify domains and understand the scope of disparate DNS services, so a complete audit of the target’s DNS security posture is hard or impossible. Post-deal, bolt-on operations accept and perpetuate the acquired setup, and tuck-in integration fails to address the root cause: a flawed change management control posture across the portfolio and DNS network. Each M&A event is an opportunity to change the diligence and operations playbook and to rationalize legacy domain and DNS operations that successive acquisitions have made unsustainable.
Breaking the cycle of bolt-on and tuck-in acquisition takes a one-time shift to a pre-deal and post-deal playbook backed by a unified change management control system. The benefits:
- Maximized asset value capture after close.
- Less effort and better performance for digital asset due diligence teams.
- Immediately improved security in enterprise DNS operations.
- Assured go-forward compliance and maintained security.
- Lower total cost of ownership across all domains and DNS operations.
- An economical, secure and repeatable platform for current and future acquisitions.