Also forgetting to setup 2FA with the registrar, forgetting to setup whois privacy on the domain, forgetting to turn on transfer locks. Domains with their short term leases and meant-to-be-easy transfers between/among too many lowest common denominator, cost cutting providers and a technical standard/backend ripe for easy accidental dox leaks are an interesting case of almost built to cause social engineering attacks, in too many different ways.

Not that any of the alternatives to DNS have yet proven to be half as reliable, but it's still fascinating how DNS is both simultaneously our best and worst hope for identity "ownership" on the current internet.

If you care, pay for 10 years in advance, and still extend every year to keep the 10 year rolling window.

I think there's a significant base rate difference.