How to Make Sure Your Business Owns Its Domain Name

Your domain name is how customers find your website and how your email reaches you. If you lose control of it, you can lose both, and getting it back can be slow and costly. Many small businesses are surprised to learn that their domain is registered to a web designer, a former employee or a long-forgotten account. A few checks can tell you where you stand.

Why control of your domain matters

Whoever controls the domain can change where your website and email point, renew it or let it expire, and move it to another company. If that person is not you, a falling-out, a lapsed credit card or an unreachable freelancer can take your business offline. Attackers also target domains, because taking one over lets them intercept email and impersonate you.

What it means to own a domain name

You do not buy a domain outright. You register it through a company called a registrar for a set period, and the person or organization listed as the registrant is the legal holder. For your business, the registrant should be the business itself, not an individual or a vendor, and the account used to manage the domain should belong to people you control.

Find out which company holds the registration

Look up your domain in a registration lookup service to see the registrar and the registrant details, though some information may be hidden by a privacy service. Your invoices and old emails may also show where it was bought. Then check that you can log in to the account at that registrar. If you cannot, find out who can.

Check who can access the registrar account

The account that manages your domain is as valuable as a bank login. Check:

• Whose email address is the account tied to, and is it an address the business keeps?
• Who knows the password, and is it stored safely?
• Is multi-factor authentication turned on?
• Are there accounts for people who have left?

Use a company address, such as a role mailbox that more than one trusted person can reach, rather than one person’s mailbox.

Check the registration details

Make sure the registrant name is your business and the details are correct. Incorrect contact details can cause problems with verification, and a domain registered to an individual can create disputes when that person leaves. If the registrant must change, know that ICANN’s transfer policy requires registrars to apply a lock of 60 days after a change of registrant, during which the domain cannot be moved to another registrar, unless the registrar allows you to opt out. So plan changes with that in mind, and if you intend to transfer the domain, ICANN advises requesting the transfer before changing the registrant.

Use contact details the business will keep

Registrars send renewal notices and security messages to the contact email. If that address belongs to an employee who left or a web designer who moved on, you may not see them. Use an address the business owns and monitors.

Make sure the domain will renew

An expired domain can be lost, and a lapsed one can be bought by someone else. Check the expiry date and set a reminder well ahead. Auto-renew helps, but it only works if you have turned it on with your registrar and the payment method on file is valid. Registering the domain for a longer period gives you more buffer.

Check who controls the DNS

The domain’s DNS settings decide where your website, email and other services point. They may be managed at your registrar, your web host or another provider. Find out where, and who can log in. An outsider with DNS access can redirect your email and website. Ask for a list of the records so you can see what each one does, including your email security records. Our post on stopping scammers from using your domain explains the ones that matter for email.

Turn on the protections your registrar offers

• Registrar lock, which blocks transfers to another registrar unless you unlock it.
• Multi-factor authentication on the registrar account.
• Transfer authorization code kept safe. This code is needed to move a domain, so treat it like a password. ICANN notes that registrars must provide it to the registrant on request within five calendar days.
• Notifications for any changes to the domain.

If someone else holds your domain

Ask them, in writing, to transfer it to an account in your business’s name, or to give you the authorization code and update the registrant. A reputable vendor will do this. If you cannot reach the person, contact the registrar’s support, and be prepared to prove that the business is the rightful holder, for example with business records and past invoices. Do it before there is a dispute, not after.

A short checklist

1. Look up the domain and confirm the registrar and registrant.
2. Confirm the registrant is your business.
3. Log in to the registrar account, and secure it with a business email and multi-factor authentication.
4. Check the expiry date, auto-renew and payment method.
5. Turn on the registrar lock.
6. Find out where the DNS is managed and who has access.
7. Record all of this in a place the business controls.

Our Microsoft 365 support covers your email setup, and you can contact us if you want help checking where your domain stands. A free security review also looks at who can get into your accounts and how passwords are protected.

Frequently asked questions

Sources and further reading

• ICANN: FAQs for registrants about transferring a domain name
• ICANN: Things every registrant should know about the Transfer Policy