Common types
- Look-alike renewal invoices from a company you’ve never used, suggesting your domain will expire unless you pay them.
- Offers to “protect” or “reserve” other versions of your name. Nominet has warned about misleading offers to secure the .uk version of an existing .co.uk domain, saying such offers were inaccurate and unnecessary (Nominet).
- Spoof emails pretending to be Nominet, for example asking you to “validate” email credentials. Nominet has warned about phishing emails spoofing nominet.co.uk and says its registry communications come from nominet.uk and nominet.org.uk addresses (Nominet).
How to spot them
- The sender isn’t the registrar you pay. Check by looking up your domain with Nominet’s lookup on nominet.uk.
- There’s pressure to act today.
- The price or service is vague (“online connection”, “listing”, “protection”).
- The link goes to a site that isn’t your registrar or nominet.uk.
- It asks for passwords, codes or card details by email.
What to do
- Don’t click links or pay. Nominet advises registrants to be wary of unsolicited calls, texts or emails about their domain and to contact their registrar to check whether any action is needed (Nominet).
- Log in to your registrar account directly (type the address yourself) and check the real expiry date.
- If a message claims to be from Nominet and you’re unsure, contact Nominet’s customer services (Nominet).
- Tell your trustees, so nobody else pays it.
- Report phishing emails. The Charity Commission’s cyber crime guidance explains how charities can report cyber crime.
If you’ve already paid or clicked
- Contact your bank straight away.
- If you entered a password, change it and switch on two-factor authentication.
- The Charity Commission’s guidance gives the Report Fraud helpline number (0300 123 2040) for live cyber attacks (GOV.UK, checked 20 October 2026).
- Consider whether you need to report a serious incident to the Charity Commission. Its guidance explains when.
Questions people ask
Does Nominet send renewal invoices directly?
Normally your registrar handles renewal and billing. Nominet does email the registrant if a domain isn’t renewed by expiry, with the registrar’s contact details. If in doubt, contact your registrar or Nominet directly, not via links in the message.
What email addresses does Nominet use?
Nominet says its registry-related communications come from nominet.uk and nominet.org.uk addresses.
Do we need to buy the .uk version of our .org.uk name?
Nominet has warned that unsolicited offers to ‘secure’ the .uk version of an existing name were misleading. Decide calmly, and only buy through a registrar you choose.
Related guides
Who should be the registrant?
Why a charity’s domain should be registered to the organisation, not a volunteer, and how to set it up properly.
Renewals and expiry
How .UK renewals work, the expiry timeline, and how to make sure your charity never loses its domain.
Moving or transferring a domain
Switching registrar versus changing the registrant: the two different ‘transfers’, and how each works for .UK domains.
Domain security checklist
A one-page checklist for trustees: access, 2FA, renewals, records and who to call, linked to Charity Commission and NCSC guidance.