Namecheap account lock: one ID-verification email, every domain and the inbox offline

What this video covers

• The customer says Namecheap's email gave 72 hours for ID verification; the quoted email calls it a routine account information accuracy check-up and says the account was locked pending documentation. Namecheap had not replied publicly when we checked.
• His account's contact email ran on the domains that were disabled, so the lock also cut the channel used to reach him.
• ICANN's 2013 registrar contract treats more than fifteen days without answering accuracy inquiries as grounds for suspension; Namecheap's agreement names five business days for its inquiries. Namecheap has not said which process applied.
• Namecheap's registration agreement lets it suspend all services in an account, including other domains, when it has grounds to suspend one domain or service.
• Editorial advice: keep the registrar login email on a domain that registrar does not hold, keep a phone number current and treat compliance emails like an outage.
• Let's Encrypt will make seven validation requests (one primary, six remote, up from four remote), with production from November 10, 2026.
• A class action against Verisign and ICANN alleges .com wholesale prices rose from $7.85 to $10.26; the claims are unproven.

Transcript

Is a domain you renewed for 12 years yours?

0:00 You think domains you've renewed for twelve years are yours. A Namecheap customer says one missed email locked all of them, and his inbox with them. In this video: what did Namecheap ask? Why did one lock take everything? Who else decides it's yours? It's Monday, October nineteenth, and this is The Daily Diff. And one sentence in Namecheap's own contract explains the blast radius.

0:23 I'll read it at the end. Namecheap is a big domain registrar, the company you pay to hold your name in the registry and point it at your servers. In twenty twenty-five, private equity firm CVC agreed to buy a majority stake, at a valuation around one and a half billion dollars. That lockout leads today's diff. Then Let's Encrypt adds more eyes before it trusts your domain, and a lawsuit asks why dot com keeps getting pricier.

What did Namecheap actually ask for?

0:48 Here's the notice as he posted it on Reddit's sysadmin forum. A routine account information accuracy check up, and the account is locked pending documents. He says it gave him seventy-two hours, and he was away for a few days. He's been a customer for twelve years. He came back to dead servers, sent the documents, and waited a full day with no reason and no timeline. Support chat kept sending him to the risk management team,

1:13 which, chat said, only works by email.

Why did one lock take down everything?

1:16 Follow the chain. The account holds the domains. The domains point at his servers and his mail. And the account's contact email lived on those same domains. So the lock cut the channel Namecheap was using to reach him. He paid another host just to get email working again, and he's weighing a hostname change to keep clients online while he waits. That's real money and real downtime, over a lock nobody has explained to him.

1:39 Getting a backup address added over chat took him about four hours. And he says nobody asked him to prove he owned the account. An identity check, where changing the email needed no identity. Namecheap's site pointed him to its security address, he says, but the answers came from a compliance one.

72 hours, 5 business days or 15 days?

1:56 Now the clocks. ICANN's contract with registrars says ignoring accuracy questions for over fifteen days can justify a suspension. Namecheap's own agreement says five business days. His email, he says, gave seventy-two hours. Namecheap hasn't said which rule it used. The thread passed six hundred points on Hacker News, and plenty of replies are people shopping for a new registrar.

2:19 The post has no update saying the account is back, and I found no public reply from Namecheap. So all of this is one customer's side.

What should you change in your own account?

2:27 The fix for your own setup is boring and cheap. Put your registrar login email on a domain that registrar doesn't hold, and keep a phone number current. Then treat any compliance email like an outage. None of that would have stopped an ID check. It just shortens the time between the notice and your answer.

How many checks before Let's Encrypt trusts you?

2:44 Machines check your domain too. Let's Encrypt says it's adding two more remote vantage points for domain validation. Before issuing a certificate, it'll request your challenge seven times, once from the main data center and six times from remote locations, up from four. The main one and a quorum of the others must see the right answer. A briefly hijacked network route can fool a check from one place. Fooling most of six places at once is much harder.

3:08 Staging starts October twenty-seventh and production November tenth. An industry rule requiring at least five remote checks kicks in December fifteenth. Let's Encrypt expects little to no impact. If your firewall blocks whole regions, that's where you'd notice.

Why does .com keep costing more?

3:22 Last month I gave Verisign a revert for deleting paid-up dot name domains. Now a class action in federal court in Los Angeles targets Verisign and ICANN over what dot com costs. The lawsuit says Verisign's wholesale price for a dot com went from seven eighty-five to ten twenty-six. It claims each one costs Verisign about three dollars to run. Those are the plaintiffs' claims, and nothing has been proven in court. The suit says every registrar pays that same fee,

3:49 Namecheap included, so it sits inside your renewal wherever you shop. It projects about thirteen forty-four by twenty thirty under the current deal.

Which contract line takes every domain?

3:57 Now that sentence from Namecheap's contract. If it has grounds to suspend one domain or service in your account, it may suspend all services in that account, other domains included. That's how one locked account takes everything with it. My verdict is revert.

Verdict: revert the 72-hour lock?

4:12 If his version holds up, a seventy-two hour lock that also kills the inbox you need to answer it is broken design. Verify people, fine, but leave them a way to reply. Subscribe, hit the bell, and tell me in the comments if you'd have stamped it differently. If you'd rather read this than hear me say it, the diff lands in your inbox every morning, free at the daily diff dot dev, link below. And that's the diff for today. I'm Niko from Axrisi.

4:36 Merge responsibly.

Sources

1. Namecheap just seized and disabled all my domains (customer's post)r/sysadmin · u/pinchitony
2. Hacker News discussion of the Namecheap postHacker News
3. Namecheap Registration AgreementNamecheap
4. 2013 Registrar Accreditation AgreementICANN
5. Let's Encrypt is adding two additional remote perspectives for domain validationLet's Encrypt community
6. Verisign .com Domain Name Registry Consumer Class Action (Kessler v. VeriSign)Hagens Berman
7. CVC acquires majority stake in Namecheapwebhosting.today