3 November 2026

How to Make Sure Your Business Owns Its Domain Name

Photo by Zifeng Xiong on Pexels

Your domain name is probably the most important thing your business pays for and never looks at.

Once the website is live and email is flowing, the domain fades into the background. It renews itself, or it seems to, and the account where it's registered can sit untouched for five or ten years. Nobody thinks about it until the day something forces the question: a web designer stops replying, the person who set it all up leaves, or the renewal payment bounces off a card that expired two years ago.

That's a bad moment to discover the login belongs to someone else. The good news is that checking takes less than an hour, and fixing it is usually straightforward as long as you do it before you need to.

Everything else sits on top of the domain

Your website, your Microsoft 365 or Google Workspace email, and often a handful of other services all depend on your domain pointing in the right direction. The domain's DNS settings tell the rest of the internet where your website lives and which servers should receive mail sent to your team.

If the domain lapses, those services stop being reachable through it, even though the hosting and email subscriptions you're paying for are still perfectly active. Customers type your address and get nothing. Emails to your staff bounce.

The other risk is less obvious. Whoever controls the registration usually controls the DNS too, and someone with that access can redirect your website, reroute your email or take services offline. Treat the registrar account with the same care as your bank login or your Microsoft 365 admin account, because the impact of losing it is in the same league.

Paying for a domain isn't the same as controlling it

Strictly speaking, you don't buy a domain outright. You register the right to use it for a period, and keep that right by renewing. The registration is held by a registrar, the company you (or someone on your behalf) signed up with, and it records a registrant, the person or organisation the domain is registered to.

Problems creep in because those two things don't always line up with who actually pays. Common setups that cause trouble later:

• A web designer registered the domain in their own account while building the site, and has been recharging you for it ever since.
• A previous IT provider holds it in a single account alongside dozens of other clients' domains.
• An employee registered it on day one with their personal email address and personal card.
• A hosting company sold it to you as a reseller, so the registrar shown in a lookup is a company you've never heard of.

None of these are unusual, and none of them are a problem while everyone stays on good terms. They become a problem the moment you need a renewal, a change or a transfer and the person who can approve it isn't you.

Real control means people inside your business can sign in, renew, update the details, recover the account and approve a transfer, without asking anyone outside the company for permission.

The check: six things to confirm

Work through these in order. Each step depends on the one before it.

1. Find out which registrar holds it

Start with a public lookup. For a .co.uk or .uk domain, use Nominet's lookup service, since Nominet runs the .uk registry. For generic domains like .com, .net or .org, use ICANN's Lookup tool. Both will show the registrar, and the ICANN tool also shows the registration and expiry dates and the nameservers.

You may still hear this called a WHOIS search. For generic domains, WHOIS was replaced by a newer system called RDAP in January 2025, and Nominet is phasing out its own WHOIS service for .uk too. The name has changed, but the idea is the same.

If the registrar's name means nothing to you, that's often because your domain was sold through a reseller, such as a hosting company or web agency. Your IT provider can usually work out the chain quickly.

2. Make sure someone in the business can sign in

Knowing the registrar is only useful if you can get into the account. Confirm that someone at your company can log in and see the domain listed there.

Be careful not to confuse this with access to your website. A WordPress login, a website builder account or a hosting control panel may let you edit pages without giving you any power over the domain registration itself.

If your web designer or IT provider holds the domain in a shared account with other clients, they can't simply hand you the password, because that would expose everyone else's domains. The right fix is for them to move your domain into a separate account set up in your company's name. They can still manage it for you afterwards; the difference is that the account, and the ability to recover it, belongs to you.

3. Check whose name is on the registration

Inside the registrar account, look at the registrant details: the name, organisation, address, email and phone number. Where an organisation is recorded, it should be your company, not your web designer, an agency or an employee.

Don't be alarmed if the public lookup shows very little. Personal details are routinely withheld from public results, and privacy or proxy services can replace them entirely. The private record inside the account is what matters. If a proxy service is in use, read its terms and confirm your business is the customer, and that you know how renewals, recovery and transfers work under that arrangement.

4. Update the contact and recovery details

Renewal notices and security alerts go to whatever email address is on the account. If that's a former employee's mailbox or a supplier's address, those messages are going nowhere useful.

Use a business-controlled address that someone actually reads, ideally a shared mailbox rather than one person's inbox. Then set up a recovery route that still works if your main email is down, such as a second address, a phone number or recovery codes, depending on what the registrar offers.

At least two trusted people should know which registrar you use and how to get back into the account. The NCSC's guidance on managing domain names makes the same point: more than one trusted person, and all contact with the registrar going through your organisation's own systems rather than personal accounts.

5. Check renewal and payment

Look at the expiry date and turn on auto-renew. Then check which card is on file. An employee's personal card or a supplier's card can expire or be cancelled without anyone at your end knowing, and auto-renew quietly fails.

Even with a company card in place, put a reminder in a shared calendar a few weeks before the renewal date so someone can confirm the payment actually went through. Registrars send reminder emails, but those only help if they reach a mailbox someone reads.

6. Find out who controls the DNS

The DNS is often managed somewhere other than the registrar. The nameservers shown in your lookup tell you which provider holds your DNS records. A perfectly reasonable setup might have the domain at one registrar, DNS with a cloud provider, the website with a hosting company and email with Microsoft 365. That's fine, as long as you know who handles each piece and how to get back into every account.

DNS is also where the records that protect your email reputation live. If you've worked through SPF, DKIM and DMARC to stop scammers sending email in your company's name, those settings are only as safe as the DNS account they sit in.

.co.uk and .com don't follow quite the same rules

Most advice about domains online is written with .com in mind, and much of it is governed by ICANN. UK domains are run by Nominet under its own rules, and a few differences are worth knowing:

• Transfers work differently. A .com is moved between registrars using an authorisation code. A .co.uk or .uk domain doesn't use one. Instead, the current registrar changes the domain's IPS tag, which is the identifier for the registrar that should hold it.
• Expiry has a fixed timeline. If a .uk domain isn't renewed, Nominet suspends it 30 days after the expiry date, and your website and email stop working at that point. It can still be renewed through your registrar during the suspension, but if it isn't renewed within 90 days of expiry, the registration is cancelled and the name can be lost. Generic domains have their own grace periods, which vary by registrar and domain ending.
• Locks are different too. For a .com, look for a transfer lock in your registrar account, which may be labelled "Registrar Lock" or "Client Transfer Prohibited". For .uk domains, Nominet offers a paid registry-level Domain Lock, arranged through your registrar, which blocks changes to the domain and its DNS until it's deliberately unlocked. It's aimed at domains where an outage would be costly, so it's worth a conversation rather than a reflex purchase.

If you hold both a .co.uk and a .com, check each one separately. They may well be with different registrars.

Lock the account down

Once the right people are on the account and the right details are recorded, secure it properly:

• Turn on two-step verification. The NCSC describes this as the most important recommendation for registrar accounts, and it should be enabled for every administrator, using the strongest option the registrar supports.
• Use a unique password stored in a company password manager, not in an email, a spreadsheet or someone's notebook.
• Give each person their own login where the registrar allows it. If it only offers a single account, keep the credentials in the password manager so access doesn't depend on one person.
• Remove anyone who no longer needs access, including old agencies, past providers and former staff.
• Switch on alerts for DNS changes, contact updates, transfers and renewals if the registrar offers them.

A transfer lock on its own isn't enough. Anyone who gets into the account can usually just turn it off, which is why the login itself needs protecting first.

Getting it back from a designer or old supplier

If a web designer, agency or previous IT provider still holds the domain, sort it out before the relationship ends, not after. Ask them for the registrar's name, the expiry date, the registrant details, the current nameservers and their process for moving the domain into an account your company controls.

Set up the new account first, in your company's name, with your own contact and recovery details and two-step verification turned on. The current holder can then move the domain across, either into a new account at the same registrar or, for a .uk domain, by changing the IPS tag to a registrar of your choice.

Moving the registration doesn't mean moving your website or email. The nameservers can normally stay exactly as they are during the move. An accidental change to them is the main thing that causes an outage, so have whoever looks after your IT keep an eye on the website and email while it happens. Plan the exit while everyone is still cooperating.

If a former supplier or employee won't cooperate, gather anything that shows the domain was registered for your business, such as invoices, payment records, contracts and the original registration emails. Contact the registrar and ask what evidence it needs. If the disagreement is really about ownership or contract terms, it may be time for legal advice.

Make it part of the routine

Once everything is correct, keep it that way with a short yearly review. Confirm the registrar, expiry date, payment card, auto-renew, registrant details, recovery options, two-step verification, any locks, the nameservers, the DNS provider and the list of people with access.

Repeat the same check whenever you change web designer, marketing agency or IT provider, and build it into your leaver process for anyone who had access. It's one of those accounts that tends to get missed when someone leaves, which is exactly the pattern behind messy offboarding.

Record the results alongside your other IT documentation, but keep passwords and recovery codes in the password manager rather than in the document itself. Keeping that record up to date is part of what proper managed IT support should include as standard.