Domain suspended: what breaks in WordPress email?

Nothing on your server changes. Everything that has to find your domain in DNS stops finding it: mail to your addresses fails, mail your site sends stops authenticating, and account recovery through that domain goes with it. Cached DNS makes it happen in stages, and after the domain comes back, your sending provider may still refuse to send to your own address. The fix is to keep one way to reach you, and one way to recover each account, on a different domain.

The question came from r/sysadmin, where a 12-year Namecheap customer found every domain switched off after an emailed notice: “I was away for a few days, I found my servers were down today.”

Two ways a registrar switches a domain off

A hold. The registrar sets clientHold (serverHold is the registry’s version). For either, “DNS delegation information MUST NOT be published” (RFC 5731 §2.3); in ICANN’s words, the domain “will not resolve” (ICANN EPP status codes). The TLD stops pointing anyone at your nameservers, and a fresh lookup gets NXDOMAIN: no such domain.

A nameserver swap. For contact-verification suspensions, Namecheap says “DNS will change to verification nameservers” and visitors see a suspension page (Namecheap: Whois verification suspension). The domain exists, but the registrar’s servers answer for it, without your records.

Namecheap applies clientHold “mostly for reasons related to fraudulent/abusive activity and non-compliance” with its terms, and its knowledge base states no general notice period for it (Namecheap: serverHold or clientHold). Verification has a clock. Under ICANN’s 2013 RAA, the registrar must verify the registrant’s email address or phone number within 15 days of a registration, transfer or contact change. If the registrant doesn’t respond in that window, the registrar must check the details by hand or suspend the domain, and a bounced email to the registrant triggers the same check (Whois Accuracy Program Specification §1, §2, §4).

To tell which you have: a whois status of clientHold or serverHold (RDAP shows client hold / server hold) is a hold, and inbound mail is bouncing. The registrar’s nameservers in place of yours is a swap, and senders are probably still queueing.

What fails, and in what order

Resolvers reuse each answer for its TTL (the time-to-live a record carries). That turns one registry change into a sequence:

1. The suspension lands. Uncached lookups get NXDOMAIN (hold) or the registrar’s records (swap).
2. Your cached records expire, and are fetched again. When an MX record (which names the servers that accept your mail) or an A record runs out its TTL, a resolver that still holds the delegation asks your nameservers, which still answer. Nothing fails yet.
3. The cached delegation expires. A resolver holding the TLD’s pointer to your nameservers can keep asking them until it runs out: 172,800 seconds (48 hours) for .com, unless the resolver caps it lower. The outage arrives on the TLD’s clock rather than yours.
4. Queued mail bounces. On a swap, senders give up when their retry window ends: RFC 5321 recommends “at least 4-5 days” (§4.5.4.1), but Microsoft 365 returns the message after 24 hours (Microsoft: NDR 4.4.7).
5. After restoration, cached NXDOMAIN answers from a hold last 15 minutes to 3 hours by TLD. After a swap, resolvers that cached the registrar’s nameservers keep using them for up to the TLD’s delegation TTL: 48 hours on .com. Suppression lists last until you clear them.

Mail to your addresses

On a hold, mail bounces. RFC 5321 reports a “non-existent domain error” as an error; only a temporary error is “queued and retried later” (§5.1). A customer writing to orders@yourdomain gets a bounce, not a delay.

On a swap, the registrar’s servers answer with whatever records they publish, and registrars don’t document those. If they publish an A record for the suspension page and no MX, senders try that server. If it refuses connections, senders treat that as temporary and retry; if it answers with a 554 greeting, some senders bounce the mail at once, while Postfix by default skips that server and keeps the message queued (Postfix: smtp_skip_5xx_greeting). (Both branches are inferences.) A swap cleared within a day may lose nothing; after that, mail from Microsoft 365 senders starts coming back.

Mail your site sends

Your SMTP plugin still reaches its provider, whose domain resolves fine. But once caches expire nobody can load the site, so request-triggered mail (orders, resets, form notifications) dries up. WP-Cron runs only on page loads (WordPress: cron), so scheduled mail, Action Scheduler jobs and SMTP-plugin retry queues stall too, unless the server runs cron through WP-CLI. A system cron that loads wp-cron.php by URL needs your domain to resolve, and it stalls the same way. The backlog fires together when traffic returns.

What goes out while visitors can still reach the site splits by domain. Checks against the provider’s domain pass: on Amazon SES’s defaults the envelope sender is a subdomain of amazonses.com, so SPF passes (SES: MAIL FROM), and SES adds its own d=amazonses.com DKIM signature (SES: troubleshooting DKIM). Checks against your domain fail:

• A DKIMDKIM (DomainKeys Identified Mail) is a cryptographic signature attached to each outgoing message, verifiable against a public key published in DNS. It lets receivers confirm the message was not altered in transit and originated from a server the domain authorised to sign on its behalf. Read full reference → signature with d=yourdomain gets PERMFAIL when its key can’t be found (RFC 6376 §6.1.2).
• SPFSPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send mail using your domain. Receivers compare the sending IP to that list and use the result as one input to their accept/reject decision. Read full reference → on a custom return-path subdomain of yours returns “none” (RFC 7208 §4.3; see the SPF reference).
• DMARCDMARC (Domain-based Message Authentication, Reporting, and Conformance) is a DNS TXT record that tells receivers what to do with mail from your domain that fails SPF or DKIM, and where to send reports about those failures. Read full reference → needs one of those to pass on your domain, so nothing aligns.
• Many receivers reject mail whose From domain doesn’t exist before DMARC is consulted. RFC 9989, the current DMARC specification, calls the existence check “a common practice among Mail Receivers to determine whether or not to accept a mail message before performing other more expensive processing” (Appendix A.4).

The provider reacts too. When SES can no longer find its DKIM records, it emails a deadline to re-publish them; miss it and the DKIM setup is revoked, signing stops, and setup starts over (SES: troubleshooting DKIM). A custom MAIL FROM domain whose MX vanishes falls back to amazonses.com, or blocks sending if you chose “Reject message”, and goes to “Failed” after 72 hours. Those notices go to the AWS account’s address.

Password resets and admin notices

WordPress sends password resets to each user’s address and site notices to the Administration Email; the fatal-error recovery-mode link goes to RECOVERY_MODE_EMAIL if defined, otherwise the Administration Email. On the suspended domain none of it arrives, and nor do reset links for provider, host and registrar logins at you@yourdomain.

The warning goes to the address that’s about to break

Namecheap sends verification requests to the registrant email (Namecheap: Whois verification suspension), with reminders once a week (Namecheap: Whois verification process); it doesn’t say where other suspension notices go, so treat the account email the same way. On the same domain, notice and outage share one point of failure. An off-domain inbox fixes that, but not the thread’s failure: the notice arrived and nobody read it in time. Send it to an inbox more than one person reads, and a short notice window no longer depends on one person being at their desk.

What to set up today

• Registrar login and registrant contact: an off-domain address that more than one person reads.
• WordPress Administration Email, or one administrator’s email: off-domain. If it must stay on-domain, define RECOVERY_MODE_EMAIL in wp-config.php.
• SMTP provider and host accounts: an off-domain recovery address, 2FA on an app rather than email.
• Don’t count on TTLs. While a resolver holds the delegation, it re-fetches your MX and A records from your nameservers as they expire; long record TTLs add only a little time past the delegation’s expiry, and nothing you set speeds recovery from a hold.

If it has already happened

Once the suspension is lifted:

1. Confirm the delegation is back. dig NS yourdomain.com @a.gtld-servers.net (or your TLD’s server) should list your nameservers.
2. Allow for negative caching. Cached NXDOMAIN answers last the lower of the TLD’s SOA TTL and SOA minimum (RFC 2308 §5). Queried from the TLD servers in October 2026: 900 seconds for .com, 3,600 for .org and .io, 10,800 for .co.uk. After a swap there is no NXDOMAIN to expire; resolvers keep the registrar’s nameservers for up to the delegation TTL, 48 hours on .com.
3. Fix the domain at your sending provider first. The cron backlog fires on the first page loads. Re-verify DKIM and any custom MAIL FROM domain, then confirm SPF and DKIM pass in a test message’s Authentication-Results header.
4. Check the suppression list. Mail the site sent to your own domain during a hold likely hard-bounced: a non-existent domain is an error, not a retry (RFC 5321 §5.1), though SES doesn’t document how it classifies one. SES keeps hard-bounced addresses on the account-level suppression list, where they “remain there until you remove them” (SES: suppression list); it is on by default for accounts opened since November 2019. Remove one with aws sesv2 delete-suppressed-destination --email-address [email protected]. Until admin@yourdomain comes off it, the site’s notices to you keep failing without a word.
5. Fix the admin address if you lost it. Changing the WordPress admin email when the old inbox is unreachable covers the bypasses, users not receiving password reset emails the lingering reset failures, and DNS records for WordPress email every record that has to be back.