It's 3 AM and your website is down
Not because of a DDoS attack, not because of a coding error. Your domain has expired and the registry has put it in a suspended state. You have no idea this happened because the renewal email went to the address you registered with five years ago—an address on an old email service whose password you no longer even have.
We see this scenario at ServerNet several times a week. A user calls asking why their site is down, and the answer is always the same: your account contact information is outdated, and we had no other way to reach you.
Let me be blunt: updating your contact information is not a clerical task—it's part of your service's reliability. Just as critical as taking backups.
Which "contact information"? Three different layers that get confused with each other
Most users think one email in their profile is enough. But in every hosting account, there are three layers of contact information, and each one has its own separate path:
- Account Email: The address you log in to the control panel with. All system notices, security changes, and payment alerts go to this address.
- Registrant Email: The address registered in the domain's WHOIS. The registry (such as IRNIC for .ir domains) sends renewal alerts and transfer confirmation codes to this address. This address has nothing to do with your account email and must be checked separately.
- Mobile Number: Used for two-factor authentication and password recovery. If you've changed your SIM card and haven't updated the number, you've effectively lost the key to your account.
The common mistake is that users change their account email and think they're done. No. The domain is a separate entity.
This is where they go wrong
A scenario I've seen many times: a user transfers their .ir domain from one company to another. The transfer appears successful, but because the WHOIS address still has the old email, the transfer confirmation code (which must be entered within 15 minutes) goes to an inbox that no longer exists. The result? An incomplete transfer, the domain stuck in limbo, and the site offline for 24 hours or more. The new provider says "we didn't send any email" and the old provider says "the domain is no longer with us." And you're caught in between.
Why an old email means losing renewal alerts
Automated renewal systems typically have three alert stages: 30 days before, 7 days before, and 1 day before expiration. These alerts are only sent to the address registered in your profile. If that address is dead, effectively there is no alert at all.
Now imagine your bank card has also changed and the automatic payment has failed. Your service is suspended on the expiration date. Not because you didn't have the money, but because the "payment failed" notification went to an address nobody reads anymore.
At ServerNet, if your service is Linux hosting, a service suspension means losing access to your files and database until settlement. Every hour of delay means every hour of downtime for your visitors.
Recovery codes; when only one email can save you
Forgot your password? The "forgot password" option sends a recovery link to your account email. Two-factor authentication is enabled and you've lost your phone? You should have saved your backup codes in advance—otherwise, the recovery path goes through email.
Now, what if that email belongs to a provider that shut down three years ago?
In that case, the only way to prove ownership is to send identity documents (national ID card and domain registration documents) to support. This process takes at least 24 to 72 hours. During that time, no changes can be made to your service. No renewal, no DNS changes, not even viewing your files.
How to properly update your contact information
The exact process depends on your panel, but the order of operations is almost always the same:
- Change your account email. Log in to your control panel, go to the profile or account settings section, and register the new email. The system sends a confirmation link to the new address. Until you click that link, the change is not applied.
- Check your domain's WHOIS address. If your domain is .ir, go to the IRNIC website and log in with your user code and domain password. Find the "owner information" section and update the email. For international domains (.com, .net, .org), check the registered address via your domain's WHOIS.
- Test your mobile number. Run the password recovery process up to the SMS step and make sure the text message reaches your current phone. Not the phone you left in a taxi last year.
- Keep your confirmation emails. After every change, you'll receive a confirmation email. Archive it in a separate folder. If someone later claims you never made a change, this email is your proof.
The final test everyone avoids
After updating, do a real test: log out of your account and run the "forgot password" process. See if the recovery email actually arrives. This test takes 2 minutes and simulates exactly the path you'll take in a real crisis.
Most users skip this test because "now isn't the time." Later, when the site goes down, there will be time. Plenty of time.
A real trade-off: personal email or business email?
Many people recommend using a business email for important accounts. This advice is correct, but it comes at a cost.
A business email (like info@yourdomain.com) is usually hosted on the same hosting as your site. If your hosting goes down for any reason (failed payment, attack, human error), your email goes down too. Now, how do you recover a service whose recovery email is on that very same service? An infinite loop.
The middle-ground solution: keep your business email on a separate service (like an independent cloud email service), or use a Gmail address created specifically for this purpose. Yes, Gmail doesn't look "professional." But its availability matters more than looking "professional." Personally, for critical accounts, I prefer an independent email that's outside your main infrastructure.
How often should you check your contact information?
Once a year, at the same time as your domain renewal, is enough. Not every month, not every week. Set a calendar reminder for the start of spring or fall, and on that same day check these three things: account email, domain WHOIS address, and mobile number.
If you change your email or number multiple times in a year, run this checklist every time you make a change. It takes five minutes.
When it's too late: the recovery path with documents
If you're currently in a situation where your email is outdated and you don't have access to it, don't panic. A recovery path exists, but it takes time:
- For a hosting account: contact support and send identity documents (national ID card along with a selfie). It usually takes 24 to 48 hours.
- For a .ir domain: you'll need to write to IRNIC and complete the ownership change or information update with registration documents. This process can take several days.
- For international domains: the recovery process is harder and depends on the registrar. Some registrars have an ownership verification form; others only work through the registered email.
For a more detailed guide, see the article reading your hosting welcome email, which explains what you should change on day one. Also review the first 24 hours checklist to see what other items we commonly forget.
Frequently asked questions
How do I change my account email at ServerNet?
Log in to your control panel and go to the "profile" or "account settings" section. Select the change email option, enter the new address, and click the confirmation link sent to the new address. Until you confirm, the change is not applied.
Where is my domain's WHOIS address and how do I change it?
For .ir domains, go to the IRNIC website and log in with your domain user code. Find the "owner information" section. For international domains, use a WHOIS tool or go to your registrar's panel. Changing the WHOIS address usually requires confirmation via the new email.
What if my old email is defunct and I've also forgotten my password?
You'll need to contact support and send identity documents. For a hosting account, a national ID card and a selfie are enough. For a domain, registration documents are required. This process takes a few days, so be patient.
Is a mobile number also necessary for account recovery?
Yes, if two-factor authentication is enabled, the mobile number is the primary recovery path. If you've changed your SIM card, be sure to update the number in your panel. Otherwise, the only recovery path is through sending identity documents.
Today, before closing this page, do one thing: log in to your panel and check your account email. If it's correct, move on to your domain's WHOIS. It takes two minutes and can eliminate days of downtime in the future. You can follow the rest of the details in the ServerNet documentation and the blog.