You've picked a name. The fun part is over. Before you tell anyone, before you put it on a landing page, before you commit to merch, there's a roughly 45-minute, $20 sequence of lockdown moves. Skip them and they become an expensive regret within six months.
The common failure mode goes like this: post about the name on Twitter, discover three weeks later that someone registered the .com, claimed the GitHub org, and started serving SaaS under the same wordmark in an adjacent vertical. Renaming after that point costs a year of brand equity. The sequence below prevents it.
Step 1. Run it through the checker
Before any of the other steps, run the candidate through dibbed.dev. It checks 28 places in one shot: 12 domain TLDs, the USPTO trademark register, GitHub, npm, PyPI, crates.io, all the major socials. The single deal-breaker is an active US trademark in your target class. That's the signal to pick a different name, because likelihood-of-confusion litigation is the most expensive thing that can happen to an early-stage brand. (See the deep on the likelihood-of-confusion test for what makes a real conflict.)
A taken .com is not a deal-breaker on its own. Plenty of successful products run on .ai, .io, .dev, or .app alone. The TLD choice is a brand decision (see what each TLD signals), not a survival decision. What you do want to confirm is that at least one credible TLD is free, and that the key code-registry namespaces (npm, PyPI, GitHub) aren't taken by an active project in your space.
Step 2. Register the domain (5 min, $10–15)
First-year domain registrations are cheap and competition between registrars is tight. Result pages on this site link to Dynadot because they have the cleanest first-year pricing and an affiliate program. The price you pay is identical to going direct. Any registrar works. The important thing is that you register it now, before telling anyone the name. Names get bought out from under founders all the time after a public mention on Twitter.
Don't buy the WHOIS privacy add-on as a separate line item. Most registrars include it free in 2026. Don't buy SSL; your host (Cloudflare, Vercel, Netlify, etc.) provisions it free. Don't buy email; see step 6.
Step 3. Reserve the social handles (15 min, $0)
Even if there's no plan to use them, claim the obvious ones before someone else does. Username squatters comb new domain registrations daily and try to register matching handles to extract money from the eventual owner. The cheapest blocker is doing it first.
Priority order, by irreversibility:
- GitHub org (not user). Orgs can be transferred between accounts; users can't. Claim the org and assign it to your personal account as owner. Free.
- X (Twitter). 15-character limit. If you're over, pick a sensible truncation.
- Instagram.
- Reddit. Both
r/(subreddit) andu/(user profile). Subreddits can be created the instant they're free. - YouTube. Claim the
@handle. - TikTok, if relevant to your audience.
Skip LinkedIn for now. Company pages can be created later from an existing personal profile in two minutes.
Step 4. Claim the code-registry names (5 min, $0)
For software products, the package-registry namespaces are easy to lock:
- npm:
npm init, set the name,npm publish. Even a placeholder package works. A scoped namespace@yourname/...reserves the prefix. - PyPI: requires at least one wheel uploaded. A one-file stub package will do. Once registered, the name is yours.
- crates.io:
cargo publishon a stub crate. - Docker Hub: free namespace under your account, claim by creating any repo.
You don't have to actively maintain these. Squatting your own name is fine. One caveat: long-abandoned package names can be claimed by other users through npm's Package Name Disputes process if the name has been unused for two years and a real claim exists. A live package, even a stub, is far enough to block this.
Step 5. File a USPTO trademark application (20 min, $250)
Optional but cheap and powerful. Filing an intent-to-use (1(b)) application locks in your priority date. If anyone tries to use the name commercially after you file, you have a senior position even before launch.
Use tmsearch.uspto.gov to confirm no conflicts (we surface live USPTO data on every check page), then file directly at uspto.gov/trademarks. The 1(b) filing fee is $250 per class on TEAS Plus, $350 on TEAS Standard (current USPTO fee schedule). For a SaaS, that's typically class 9 (downloadable software) and/or class 42 (SaaS / software-as-a-service). See the explainer on how trademark classes work.
DIY is fine for straightforward filings. Pay a lawyer ($500–1500) if your name is close to existing marks or you want a freedom-to-operate opinion.
Step 6. Set up email forwarding (10 min, $0)
Add the domain to Cloudflare (free), enable Email Routing, set up custom-address rules: hi@yourname.com, help@, privacy@, legal@, all forwarding to your personal Gmail. Then add a catch-all so anything else (newsletter signups, registrar notifications, future aliases) also lands in your inbox.
This costs zero and gets you off "jacobmimms@gmail.com" on your public pages. Matters for spam protection and for looking professional.
Step 7. Defensive DNS (5 min, $0)
Once the domain is on Cloudflare's nameservers (step 6 already required this), three more switches to flip:
- HSTS (Cloudflare → SSL/TLS → Edge Certificates). Locks visitors into HTTPS so DNS-level attacks can't trivially MITM.
- DNSSEC (Cloudflare → DNS → Settings). Add the DS record at your registrar. Prevents cache-poisoning attacks.
- SPF/DKIM/DMARC records for any domain that sends mail, even if that's just transactional. Anti-spoofing.
None are required for the site to work. They cost no money and about 5 minutes, and they're a hassle to add retroactively. Do them now.
The total
About 45 minutes from "name picked" to "fully locked down." $15 for the domain. Optionally $250 for the USPTO trademark, worth it for any commercial venture that plans to spend on the brand later.
The most expensive thing you can do for a name is launch it and then have to rename because something you skipped becomes an issue six months in. The sequence above prevents that for less than the cost of dinner.
Ready to check a name? Run it through dibbed.dev →