(713) 965-7200 How to Make Sure Your Business Owns Its Domain Name
Article Summary: Your business should control the account where its domain is registered. The registration details, recovery methods, billing information, renewal settings, and DNS access should not depend on one employee, contractor, web designer, or IT provider.
Once your website and email are working, the domain name rarely needs day-to-day attention. Renewal may happen automatically, and the registrar account can go untouched for years.
That is why ownership problems are often found when a supplier relationship ends, an employee leaves, or the domain fails to renew.
When a business first launches, an employee, web designer, marketing agency, or IT provider may register the domain while setting up the website. That arrangement can work for years. But if the registration stays in that person’s account, the business may need their help every time it wants to renew, transfer, or update the domain.
Sometimes the first sign of a problem is an email failure. Staff cannot send or receive messages, the website no longer loads, and nobody knows which company holds the registration.
You can avoid that situation by checking the domain now.
Why Control of Your Domain Matters
Your domain tells web browsers where to find your website. It also helps email services work out where messages sent to your company should go.
If the domain expires or its settings are changed, those services may stop working. Your website hosting and Microsoft 365 or Google Workspace subscription may still be active, but customers will not be able to reach them through your domain.
Someone who gains control of the domain may also be able to change its DNS settings. Depending on the setup, that could allow them to redirect website visitors, interfere with email delivery, or make services unavailable.
The registrar account therefore needs the same care as other company accounts that affect your operations.
What It Means to Own a Domain Name
A domain registration gives you the right to use a name for a set period, provided you keep renewing it.
ICANN defines the registrant as the person or organization that registers a domain and enters into an agreement with the registrar. The registrar is the company responsible for maintaining that registration.
For a business, control means that authorized people inside the company can renew the domain, update its details, recover the account, and approve a transfer. They should be able to do this without depending on a former employee or a supplier that no longer works with the business.
The exact rules depend on the domain ending. ICANN sets policies for generic domains such as .com, .net, and .org. Country-code domains such as .uk, .au, .ca, and .de follow rules set by their local registry operators. ICANN confirms that these policies vary between country-code domains.
Find Out Which Company Holds the Registration
You cannot confirm who controls the domain until you know which registrar holds it..
IMAGE SOURCE: https://www.pexels.com/photo/a-close-up-shot-of-a-person-holding-keys-8112169/
For most generic domains, enter the address into the ICANN Lookup tool. The tool should show the registrar, registration and expiry dates, current domain status, and nameservers.
ICANN’s tool now uses the Registration Data Access Protocol, or RDAP. This replaced WHOIS as the main source of generic domain registration information in January 2025. You may still hear people refer to this as a WHOIS search.
For a country-code domain, you may need to use the lookup service provided by the registry for that country. Your IT provider can help you find it.
The registrar’s name may be unfamiliar. Some hosting companies and web agencies sell domains through a reseller agreement, while another company acts as the registrar. ICANN explains how registrars and resellers work together.
Your website host may also be different from the registrar. It is quite normal for the domain registration, DNS, website, and email to be handled by several companies. You just need to know who handles each one.
Check Who Can Access the Registrar Account
Once you know the registrar, confirm that someone in your business can sign in to the account and see the domain.
Access to WordPress, a website builder, or a hosting account does not provide control over the registration. Those accounts may let you edit the website without letting you renew or transfer the domain.
Inside the registrar account, confirm that the domain appears in the account and that the business can change its contact details, payment method, renewal settings, and nameservers.
The account itself should also be held for the business. Its main email address and recovery information should not belong to an employee, contractor, or supplier.
A web designer or IT provider may manage domains for several clients through one account. They cannot give you the password to that account because it would expose their other customers. In that situation, ask them to move your domain into a separate account created for your company.
They can still help manage the domain after the move. Your business will simply have its own account and recovery process.
Check the Registration Details
The next step is to check who appears in the registrar’s private records.
Look for the registered name holder, organization, address, phone number, and email address. Registrars use different labels, and the information they collect varies by domain type.
Where the registrar records an organization, it should identify your company rather than a web developer, agency, employee, or unrelated business.
The public lookup record may not show this information. ICANN’s current registration data policy allows personal information to be withheld from public results, and privacy services can replace the visible contact details.
A blank or redacted public record can therefore be normal. The information inside the registrar account and the registration agreement will tell you more than the public result.
Some businesses also use a proxy service. With this type of service, the proxy provider may appear as the registered holder while the business receives the right to use the domain. If your domain uses a proxy, read the service terms and confirm that your company is the customer. You should also know how to renew, recover, and transfer the registration.
Use Contact Details the Business Will Keep
Registrar contact details can become outdated after an employee leaves or a supplier changes. When that happens, renewal and security messages may go to someone who no longer works with the company.
Use an email address that the business controls and checks. Avoid an employee’s personal address or an account owned by a supplier.
It is also worth setting up a recovery method that will still work if your main business email is unavailable. Depending on the registrar, that may be a second email address, phone number, recovery code, or identity-checking process.
At least two trusted people should know which registrar the company uses and how account recovery works. Where the registrar allows separate administrator accounts, give each person their own access. If it only provides one login, store the credentials in a company password manager rather than sending them by email or saving them in a shared document.
Make Sure the Domain Will Renew
After confirming the account and contact details, check the expiry date and renewal settings.
Image Source: https://www.pexels.com/photo/a-person-writing-on-calendar-6172482/
Turn on automatic renewal and use a payment method maintained by the business. An employee’s personal card or a supplier’s card may stop working without anyone inside the company knowing.
Auto-renewal still needs checking because cards expire and payments can be declined. Add a calendar reminder before the renewal date so someone can confirm that the payment went through.
ICANN requires registrars to send renewal reminders for generic domains, but you should not depend on those emails alone. Country-code domains may follow different rules, and reminders will not help if they go to an old address.
If the registration expires, the website and email linked to it may stop working. Some domains enter a grace or recovery period, but the length, cost, and process vary. Renewing before the expiry date is much easier than trying to recover the domain afterward.
Check Who Controls the DNS
The registrar and DNS may be managed through separate accounts, so the DNS account needs to be checked as well.
DNS tells internet services where to find your website and where to deliver your email. The nameservers shown in the domain registration indicate which provider manages those records.
A common arrangement might place the domain with one registrar, the DNS with a cloud provider, the website with a hosting company, and the email with Microsoft 365 or Google Workspace. There is nothing wrong with that setup, provided the business knows which company handles each service and how to recover the accounts.
Ask your IT provider to confirm that the nameservers are correct and that the DNS account is protected. The company records should include the provider’s name, the approved account users, and the recovery process.
The UK National Cyber Security Centre recommends that organizations use company-controlled contact details and make sure more than one trusted person can manage the domain. Its domain management guidance also recommends monitoring important DNS records for changes.
Your IT provider can continue managing the DNS day to day. Keep enough information inside the business to authorize changes and recover the account if the provider becomes unavailable.
Protect the Registrar Account
Once the ownership and recovery details are correct, secure the account.
Use a unique password and store it in the company password manager. Turn on multifactor authentication using the strongest option the registrar offers.
Review the account users and remove former employees, agencies, or providers that no longer need access. If the registrar offers alerts for DNS changes, transfers, contact updates, or renewals, turn them on.
Enable the domain’s transfer lock too. The registrar may call it “Registrar Lock” or “Client Transfer Prohibited.”
ICANN explains that a transfer lock can help prevent an unauthorized transfer. It cannot protect an account on its own, since someone who takes over the registrar login may be able to remove the lock. Keep MFA and account recovery details up to date as well.
What to Do If a Supplier Controls the Domain
If a web designer, agency, or IT provider controls the domain, plan the move before ending that relationship.
Ask for the registrar’s name, the expiry date, the registered holder’s details, the current nameservers, and the process for moving the domain into an account controlled by your company.
Create the new account with company details, add the correct recovery information, and turn on MFA. The current provider can then move the domain into that account or help transfer it to another registrar.
Moving the registration does not require moving the website or email. The existing nameservers can normally remain in place during the transfer. An accidental change to those settings could cause an outage, so ask your IT provider to monitor the website and email while the move takes place.
If a former employee or supplier refuses to cooperate, collect any contracts, invoices, payment records, registration emails, and messages showing that the domain was registered for your business. Contact the registrar and ask what evidence it needs. If the dispute concerns ownership or contract terms, you may also need legal advice.
Review the Domain Once a Year
Once the records are correct, schedule a yearly review. Confirm the registrar, expiry date, payment method, auto-renewal setting, registration details, recovery options, MFA, transfer lock, nameservers, DNS provider, and account users.
Run the same check when you change IT providers, web companies, or marketing agencies. It should also be part of the offboarding process when an employee with access leaves.
Keep the results with your IT records. Passwords and recovery codes belong in the company password manager, not in the document itself.
Frequently Asked Questions
How can I find out who registered my business domain?
Use the ICANN Lookup tool for most generic domains or the relevant registry’s lookup service for a country-code domain. The result should identify the registrar, although the registrant’s contact details may be hidden.
Does a private registration mean my business does not own the domain?
No. Privacy services often hide contact information from the public. Sign in to the registrar account and check the private registration details and service agreement.
Does my web designer own the domain if they registered it?
That depends on the registration details and your agreement with the designer. Check who appears as the registered holder, whose account contains the domain, who pays for it, and what the contract says. Ask for the domain to be moved into a business-controlled account if it currently depends on the designer.
Should my domain and website hosting be with the same company?
They do not have to be. Many businesses keep the domain registration, DNS, website hosting, and email with different providers. Record which provider handles each service and how your company can recover every account.
What happens if my domain expires?
Your website and business email may stop working. You may have a limited period in which to recover the registration, sometimes at an extra cost. The rules differ between registrars and domain types, so renew it before the expiry date.
Sources and Further Reading
- ICANN: Information for Domain Name Registrants
- ICANN: Registration Data Lookup
- ICANN: Registering Domain Names
- ICANN: Domain Name Renewals and Expiration
- ICANN: About Locked Domains
- ICANN: Country-Code Domain Policies
- UK National Cyber Security Centre: Managing Public Domain Names
Ask your IT provider to confirm who holds your domain registration and who can recover the account. If you do not have an IT provider, you can always reach out to us and we’ll help you.
—
This Article has been Republished with Permission from The Technology Press.
