Small Business

How to Make Sure Your Business Owns Its Domain Name

November 10, 2026 · Jonanna Mason

A business owns its domain in practice only if people inside the company can sign in to the registrar account, renew the name, change its settings, and recover the account without help. This guide walks through finding the registrar, checking the private registration record, fixing contact and recovery details, making renewal reliable, locking the account, checking DNS, and moving a domain out of a supplier's account.

Your business owns its domain name in practice only if people inside the company can sign in to the account where it is registered, renew it, change its settings, and recover that account without asking anyone else. If any of those steps depends on one employee, a web designer, a marketing agency, or an IT provider, the business is borrowing its domain, however long it has used it.

Most companies never test this, because a domain asks for almost nothing. It renews quietly, the website loads, the email arrives, and the login that controls all of it may go unused for years. The gap shows up at a bad moment: a supplier relationship ends, the person who set it up leaves, or a renewal fails and the first symptom is that nobody can send or receive email.

The check takes about an hour and is far easier to do while everyone involved is still on good terms.

How a Business Ends Up Borrowing Its Own Domain

It usually starts sensibly. When the company launched, whoever was building the website registered the name as part of the job, in the account they already had. The invoice was paid, the site went live, and nobody thought about it again.

Years later the arrangement still works, but only as long as that person or company answers the phone. Every renewal, every DNS change, and any move to a new provider needs their cooperation. If they close their business, lose access to an old email address, or simply stop replying, the company has to prove to a registrar that a name it has used for a decade is its own.

What the Domain Actually Controls

The domain is the address that points customers to your website and tells mail systems where to deliver messages for your staff. Those instructions live in its DNS settings.

That makes the domain a single point of failure for services you pay for separately. Your website hosting and your Microsoft 365 or Google Workspace subscription can be fully paid and working, and still be unreachable if the domain lapses or its settings change. It also makes the account a target: someone who takes control of it may be able to send your website visitors elsewhere, interfere with email delivery, or take services offline.

Treat the login that controls your domain like the login to the company bank account.

Four Jobs, Often Four Companies

Part of the confusion is that "the domain" is really several services, and they are frequently held by different providers:

Registrar:

The company that holds the registration itself and through which it is renewed and transferred.

DNS host:

The provider whose nameservers hold the records that direct website and email traffic.

Website host:

Where the site's files and software run.

Email provider:

Usually Microsoft 365 or Google Workspace.

Splitting them is normal and often sensible. What matters is that the business can name the provider for each job and get into each account. Access to WordPress or a website builder lets you edit pages. It does not let you renew or move the domain.

Step 1: Find Out Where the Domain Is Registered

For names ending in .com, .net, .org, and other generic endings, enter the domain into the ICANN Lookup tool. The result shows the registrar, the registration and expiry dates, the domain's status, and its nameservers. People still call this a WHOIS search, although ICANN states that as of January 28, 2025 the Registration Data Access Protocol, or RDAP, is the definitive source for this information in place of the retired WHOIS services.

Two things can make the answer less obvious than expected.

First, country-code endings such as .uk, .ca, and .au are not run under ICANN's generic rules. ICANN notes that registrations in those domains are administered by each country-code manager, so the lookup tool and the policies come from that country's registry.

Second, the company you paid may not be the registrar. ICANN describes a reseller as a third-party company that offers registration services through a registrar, which is how many hosting firms and agencies sell domains. If you cannot reach the reseller, the registrar named in the lookup result is the one to contact.

Step 2: Prove the Business Can Get In

Knowing the registrar is not the same as having access. Ask whoever holds the login to sign in while you watch, or to hand over credentials for an account that belongs to the company, and confirm that the domain appears there and that you can open its contact details, payment method, renewal settings, and nameservers.

You will sometimes find that the domain sits in a supplier's own account alongside their other clients' domains. They cannot share that password, and you should not want it. The right request is for the domain to be moved into a separate account created for your company, with your details on it. The supplier can keep managing it afterward as a delegated user or with credentials you issue, which is a very different position from holding it for you.

Step 3: Read the Private Record, Not the Public One

Inside the registrar account, find the registered name holder, sometimes labeled registrant or owner, along with the organization, address, phone number, and email. The organization should be your company. It should not be a developer, an agency, an individual employee, or a business that no longer exists.

Do not rely on the public lookup result for this. Personal details are commonly withheld from public results, and privacy services replace the visible contact details with their own, so a blank or redacted public record is normal and tells you nothing about ownership. The account and the registration agreement are what count.

A proxy service goes one step further: the proxy provider is listed as the holder and your business is its customer. If your domain uses one, read the terms, confirm the customer on record is your company, and make sure you know how renewal, recovery, and transfer work through that provider.

Step 4: Replace Any Contact Details That Belong to a Person

Registrars send renewal notices, security alerts, and transfer approvals to the contact addresses on file. If those addresses belong to a former employee or a supplier, the warnings go to someone with no reason to act on them.

The UK National Cyber Security Centre's guidance on managing public domain names is direct on this point. If a domain was set up with a personal email account, change it so that dealings with the registrar go through the organization's own systems, and if it was registered by a web hosting company, make sure it is managed by your organization and not by the host.

In practice:

• Use a shared company mailbox that more than one person reads, such as a dedicated domains or IT address, not a named individual's inbox.
• Add a recovery method that still works if company email is down, because a domain problem is exactly when it will be. Depending on the registrar that may be a second address at a different domain, a phone number, or printed recovery codes.
• Make sure at least two trusted people know which registrar is used and how recovery works. The NCSC advises ensuring that more than one trusted person has secure access to manage the domain.
• Give each person their own login where the registrar supports it. Where it offers only one, keep the credentials in the company password manager, not in an email thread or a shared document.

Step 5: Make Renewal Impossible to Miss

Check the expiry date, then turn on automatic renewal with a payment method the business maintains. The NCSC recommends auto-renewal through a payment method actively maintained by the organization and not a personal credit card that will expire. A supplier's card is the same risk with less visibility.

Auto-renewal is only as reliable as the card behind it. Put a reminder in the calendar a few weeks before the date, and have someone check that the charge actually cleared.

Do not count on the registrar's emails to save you. For generic domains, ICANN policy requires registrars to send two renewal reminders, approximately one month and one week before expiration, and its Expired Registration Recovery Policy adds at least one more notice within five days after expiry if the name has not been renewed. Those messages only help if they reach an address someone reads, and country-code domains follow their own rules.

If a name does lapse, there may be a period in which it can be restored, but ICANN's guidance for registrants notes that restoring a name in the redemption grace period can carry an additional fee. Renewing early is cheaper and far less stressful than recovering late.

Step 6: Lock the Account Down

Once the right people are on the record, make the account hard to take over:

• Set a unique password and store it in the company password manager.
• Turn on multifactor authentication, using the strongest method the registrar offers.
• Remove users who no longer need access, including former staff and past agencies.
• Turn on alerts for transfers, contact changes, DNS changes, and renewals where they are available.
• Enable the transfer lock. ICANN explains that domain names can be locked to protect against unauthorized changes, and that the status may be called "Registrar lock" or "Client Transfer Prohibited."

The lock is a useful second barrier, not a substitute for the first. Anyone who gets into the account can usually switch it off, which is why the password, MFA, and recovery details matter more.

Do Not Stop at the Registrar

The nameservers shown in your lookup result tell you who hosts your DNS, and that is often a separate account with its own login and its own recovery process. Run the same checks there: who can sign in, whose contact details are on it, and whether MFA is on.

The NCSC also recommends monitoring critical DNS records for unexpected changes, including nameserver records and the MX records that route email. A changed record is often the earliest sign that an account has been misused, and it is the kind of check an IT provider can automate.

Your IT provider can keep handling DNS day to day. What should stay inside the business is enough written information to authorize a change and recover the account if that provider is ever unavailable: the provider's name, the approved users, and the recovery steps.

If a Supplier or Former Employee Holds the Domain

Start the move while the relationship is still working. It is a routine request and a reasonable supplier will expect it.

1. 1. Ask for the registrar's name, the expiry date, the registered holder's details, and the current nameservers.
2. 2. Create a registrar account in the company's name with company contact details, recovery options, and MFA.
3. 3. Have the current holder move the domain into that account, or transfer it to a registrar of your choice.
4. 4. Leave the nameservers exactly as they are during the move. Changing who holds the registration does not require moving the website or email, and an accidental nameserver change is what causes outages.
5. 5. Ask your IT provider to watch the website and email while the move completes, then confirm the new account shows the domain, the lock, and the renewal settings.

If the person holding the domain will not cooperate, gather the evidence that it was registered for the business: contracts, invoices, payment records, the original registration emails, and any messages discussing it. Contact the registrar, explain the situation, and ask what proof it accepts. Where the disagreement is about ownership or contract terms, get legal advice before the renewal date gets close.

A Short Check to Repeat Every Year

Put a recurring entry in the calendar and confirm each of these:

• The registrar, the expiry date, and that auto-renewal is on
• The payment method and the name on it
• The registered holder and every contact address
• The recovery options and MFA
• The transfer lock
• The nameservers and the DNS provider
• Everyone who has access to either account

Run the same check whenever you change IT providers, web companies, or marketing agencies, and add it to the steps you follow when an employee with access leaves. Our guide to why offboarding starts at onboarding covers the rest of that process. Keep the results with your IT records, and keep passwords and recovery codes in the password manager, never in the document.

How Cyber One Solutions Can Help

Documentation and vendor management are included in our managed IT services, which is where a record like this is kept current and where one team deals with your technology vendors on your behalf. For companies whose site we host and maintain through our website design, hosting, and maintenance service, DNS is handled by our team. If you are not sure where your domain stands today, an IT assessment is a practical way to find out before it matters.

Frequently Asked Questions

Where do I look up who holds our domain?

Look the name up with the ICANN Lookup tool for generic endings, or with the registry's own lookup for a country-code ending. You will see the registrar. The registrant's details may be hidden, which is normal.

Our public record is hidden or shows a privacy company. Does that mean we do not own it?

No. Public results commonly withhold contact details. Ownership is shown by the private record inside the registrar account and by the registration agreement, so sign in and read those.

Our web designer registered the domain. Is it theirs?

It depends on who is recorded as the holder, whose account it sits in, who pays for it, and what your contract says. Whatever the answer, ask for it to be moved into an account your company controls.

Is it a problem that our domain and website are with different companies?

No. Many businesses keep registration, DNS, hosting, and email with different providers. What matters is a written record of which provider does which job and how the business recovers each account.

What happens if the domain expires?

The website and company email can stop working. There may be a window to restore the name, sometimes for an extra fee, and the rules vary by registrar and by domain ending. Renew before the date.

Sources and Further Reading

• ICANN: Registration Data Lookup Tool
• ICANN Update: Launching RDAP; Sunsetting WHOIS
• ICANN: Registering Domain Names
• ICANN: FAQs for Registrants, Domain Name Renewals and Expiration
• ICANN: Expired Registration Recovery Policy
• ICANN: About Locked Domains
• ICANN: About Resellers
• ICANN: Resources for Country Code Managers
• UK National Cyber Security Centre: Managing Public Domain Names

Not sure who holds your domain, or who could recover the account? Ask your IT provider to confirm it this week. If you do not have one, contact Cyber One Solutions and we will help you check.