How to Make Sure Your Business Owns Its Domain Name

Why domain control matters

A domain is quiet infrastructure until it expires, stops resolving, or points somewhere it should not. It helps customers find your website and tells email services where business messages should go.

Your website host and Microsoft 365 or Google Workspace subscription can still be active while the domain account behind them is controlled by the wrong person. That is why ownership deserves a deliberate check.

Find the company holding the registration

Start with ICANN Lookup for most generic domains, or the relevant registry lookup for a country-code domain. Record the registrar, expiry date, status, and nameservers.

The registrar, DNS provider, website host, and email platform may be separate. That is normal. What matters is that your team knows which company handles each service and how to recover it.

Check the registrar account—not just the website

Access to WordPress, a website builder, or a hosting dashboard does not automatically give you control of the registration. Sign in to the registrar account and confirm the domain is visible there.

Check that the business can update contact details, payment, renewal settings, nameservers, and transfer approvals without relying on a former employee or supplier.

Make the business the account owner

Use a company-controlled address and recovery method. Registration details should identify the business rather than a web designer, agency, employee, or unrelated supplier.

Privacy services can hide details from public lookup results, so a blank public record is not proof of a problem. Check the private registrar records and service agreement instead.

Protect recovery and renewal

Use a unique password, strong MFA, a business-managed payment method, and automatic renewal. Keep a calendar reminder before expiry because cards expire and renewal emails can go to an old address.

At least two trusted people should know which registrar is used and how recovery works. Give them separate administrator accounts where possible, or store a single credential in the company password manager.

Check who controls DNS

Nameservers point to the provider that manages DNS. DNS tells the internet where to find your website and where to deliver email, so a compromised DNS account can redirect visitors or interfere with mail.

Record the DNS provider, approved users, recovery process, and important records. Ask your IT provider to monitor significant DNS changes.

Secure the registrar account

Remove former employees, agencies, and providers that no longer need access. Turn on alerts for renewals, contact changes, DNS changes, and transfers.

Enable the registrar’s transfer lock where appropriate. It can help prevent an unauthorized transfer, but it is not a replacement for MFA and good recovery details.

If a supplier controls the domain

Ask for the registrar, expiry date, registered holder, nameservers, and the process for moving the domain into a company-controlled account before ending the relationship.

Moving the registration does not normally require moving the website or email. Keep the current nameservers in place and monitor both services during the change to avoid an outage.

Review ownership every year

Confirm the registrar, expiry date, payment method, auto-renewal, registration details, recovery options, MFA, transfer lock, nameservers, DNS provider, and account users.

Repeat the check when an IT provider, web agency, marketing supplier, or privileged employee changes. Keep credentials and recovery codes in the company password manager—not in the review document.