Domain Name Ownership

Domain name ownership is easy to forget about. After all, once your website and email work, the domain rarely needs attention. It renews quietly in the background, and nobody logs in to the registrar for years.

However, that silence hides a common risk. In many small businesses, the domain was first registered by whoever built the website. That might be an early employee, a freelance designer, a marketing agency or an IT provider.

For a while, this works fine. Then the designer moves on, or a staff member leaves, or a renewal payment fails. Suddenly, email stops arriving and the website goes offline. Worse still, nobody knows which company holds the domain.

The good news is that you can prevent this in an afternoon. This guide walks you through each check, step by step.

Why domain name ownership matters

Your domain is the address customers use to find you. In addition, it tells email services where to deliver messages sent to your team.

If the domain lapses, those services can stop working overnight. Your hosting plan and your Microsoft 365 or Google Workspace subscription may still be paid up. Even so, nobody can reach them through your domain.

There is a security angle too. Anyone who takes over the domain can usually change its DNS settings. As a result, they could:

• send your website visitors somewhere else
• disrupt or intercept your email
• take your online services offline

For that reason, treat your registrar account like your bank or payroll login. It deserves the same level of care.

What “owning” a domain really means

Strictly speaking, you don’t buy a domain outright. Instead, you register the right to use it for a set period, and you keep that right by renewing.

Two terms are worth knowing:

• Registrant: the person or organization that registers the domain and signs the agreement.
• Registrar: the company that manages the registration on the registrant’s behalf.

In practice, real control means that trusted people inside your business can renew the domain, update its details, recover the account and approve a transfer. Crucially, they can do all of this without asking a former employee or supplier for help.

The exact rules depend on the domain ending. ICANN sets the policies for generic endings such as .com, .net and .org. Meanwhile, country-code endings such as .uk, .au, .ca and .de follow rules set by each country’s registry.

Step 1: Find out who your registrar is

First, you need to know which company holds the registration. Without that, you can’t check anything else.

[Replace with an Image block: domain-registrar-keys.jpg. Alt text: “Keys representing control of a business domain name”]

For most generic domains, type your address into the ICANN Lookup tool. The results usually show:

• the registrar’s name
• the registration and expiry dates
• the domain’s current status
• the nameservers

Behind the scenes, the tool now uses RDAP (Registration Data Access Protocol). RDAP replaced WHOIS as the main source of this data in January 2025, although many people still call it a “WHOIS search”.

For a country-code domain, use the lookup service run by that country’s registry instead. If you’re unsure which one applies, your IT provider can point you to it.

Don’t worry if the registrar’s name looks unfamiliar. Many hosting companies and agencies resell domains on behalf of a separate registrar. Similarly, your website host may be a different company altogether. It’s perfectly normal for your domain, DNS, website and email to sit with different providers. What matters is that you know who handles each one.

Step 2: Make sure your business can log in

Next, confirm that someone in your company can sign in to the registrar account and see the domain.

Keep in mind that WordPress, website builder or hosting logins are not the same thing. They let you edit your site, but they usually can’t renew or transfer the domain.

Once you’re inside the registrar account, check that your business can change:

• the contact details
• the payment method
• the renewal settings
• the nameservers

The account itself should belong to the business, too. Its main email address and recovery options shouldn’t be tied to one employee, contractor or supplier.

Sometimes a designer or IT provider manages many clients’ domains in a single account. Understandably, they can’t hand over that password, because it would expose other customers. In that case, ask them to move your domain into a separate account set up for your company. They can still help you manage it afterwards. The difference is that your business now holds the keys.

Step 3: Check the registration details

Now look at who is named in the registrar’s private records. Depending on the registrar, you may see fields for the name, organization, address, phone number and email.

If the record lists an organization, it should be your company. It shouldn’t name a web developer, an agency, an employee or another business.

Why the public record may look blank

Don’t be alarmed if the public lookup hides these details. ICANN’s current policy allows personal data to be withheld, and privacy services often swap in their own contact details. Therefore, the private record inside your registrar account tells you far more than the public one.

If you use a proxy service

Some businesses use a proxy service. Here, the proxy provider appears as the registered holder, while your business keeps the right to use the domain. If that applies to you, read the service terms carefully. Then confirm that your company is the customer, and that you know how to renew, recover and transfer the domain.

Step 4: Use contact details that will last

Contact details go stale quickly. For example, when an employee leaves or you switch suppliers, renewal and security alerts may land in an inbox nobody reads.

To avoid this, use an email address that the business owns and checks regularly, such as a shared admin or IT mailbox. Avoid personal addresses and supplier-owned accounts.

It also helps to set up a backup recovery method. That way, you can still get in if your main business email is down. Depending on the registrar, this could be a second email, a phone number, recovery codes or an identity check.

Finally, make sure at least two trusted people know which registrar you use and how recovery works. If the registrar supports multiple users, give each person their own login. If it only allows one, store the credentials in a company password manager. Never share them by email or in a shared document.

Step 5: Set the domain up to renew

With the account sorted, turn to the expiry date and renewal settings.

[Replace with an Image block: domain-renewal-reminder.jpg. Alt text: “Calendar reminder for a business domain renewal date”]

First, switch on automatic renewal. Then pay with a card the business manages. A staff member’s personal card or a supplier’s card can fail without anyone noticing.

Even with auto-renewal, cards expire and payments get declined. So add a calendar reminder a few weeks before the renewal date. That gives someone time to confirm the payment went through.

Registrars must send renewal reminders for generic domains. Still, don’t rely on those emails alone. Country-code domains may follow different rules, and reminders won’t help if they go to an old address.

If the domain does expire, your website and email may go down. Some domains have a grace or recovery period, but the length, cost and process vary. In short, renewing on time is far easier than winning a domain back.

Step 6: Confirm who controls your DNS

Your DNS may live in a different account from your registration, so check it separately.

DNS is the set of records that points visitors to your website and routes your email. The nameservers listed in your registration show which provider manages those records.

A typical small-business setup might look like this:

Service	Who might provide it	What to record
Domain registration	A registrar	Account owner, recovery method
DNS	A cloud or DNS provider	Approved users, recovery method
Website hosting	A hosting company	Account owner, support contact
Email	Microsoft 365 or Google Workspace	Admin accounts, recovery method

There’s nothing wrong with this mix. The key is knowing who runs each piece and how to recover every account.

Ask your IT provider to confirm the nameservers are correct and the DNS account is secure. The UK National Cyber Security Centre’s domain management guidance also recommends company-owned contact details, more than one trusted manager, and monitoring key DNS records for changes.

Your IT provider can keep running the DNS day to day. Just make sure enough information stays inside the business to approve changes and recover access if that provider disappears.

Step 7: Lock down the registrar account

Once ownership and recovery are in order, it’s time to secure the account itself.

• Use a strong, unique password and keep it in your company password manager.
• Turn on multifactor authentication (MFA) using the strongest option available.
• Remove old users, such as former staff, agencies or providers who no longer need access.
• Switch on alerts for DNS changes, transfers, contact updates and renewals, if offered.
• Enable the transfer lock. Your registrar may call it “Registrar Lock” or “Client Transfer Prohibited”.

A transfer lock helps block unauthorized transfers. On its own, though, it isn’t enough. Anyone who gets into your registrar login could simply switch the lock off. That’s why MFA and up-to-date recovery details matter just as much.

Taking back domain name ownership from a supplier

If a designer, agency or IT provider currently controls your domain, plan the handover before the relationship ends. It’s much easier while everyone is still cooperating.

Start by asking them for:

1. the registrar’s name
2. the expiry date
3. the registered holder’s details
4. the current nameservers
5. their process for moving the domain to your account

Next, create a new registrar account in your company’s name. Add your own recovery details and switch on MFA. After that, the provider can move the domain into your account or help transfer it to another registrar.

Importantly, moving the registration doesn’t mean moving your website or email. The existing nameservers can usually stay as they are. However, an accidental change could cause an outage, so ask your IT provider to keep an eye on things during the move.

If they won’t cooperate

Sometimes a former employee or supplier refuses to help. In that case, gather any contracts, invoices, payment records, registration emails and messages showing the domain was registered for your business. Then contact the registrar and ask what evidence it needs. If the dispute involves ownership or contract terms, you may also need legal advice.

Your yearly domain name ownership checklist

When everything is in place, book a short review once a year. Use this list:

• Registrar name and account owner
• Expiry date and auto-renewal setting
• Payment method on file
• Registration details
• Recovery options
• MFA switched on
• Transfer lock enabled
• Nameservers and DNS provider
• Account users (remove anyone who has left)

In addition, run the same check whenever you change IT providers, web designers or marketing agencies. It also belongs in your offboarding process whenever someone with access leaves.

Keep the results with your IT records. Passwords and recovery codes, on the other hand, belong in the password manager, not in the document.

Frequently asked questions

Protect your domain before you need it

Domain name ownership problems almost always appear at the worst moment: a supplier leaves, a card expires, or email suddenly stops. Fortunately, a one-time check and a yearly review keep your business in control.

Not sure who holds your domain today? Contact us today and we can advise you on how to check your registration, DNS and recovery settings for you.

Further reading

• ICANN: Information for domain name registrants
• ICANN: Registration data lookup
• UK NCSC: Managing public domain names