The short answer: Your business should control the account where its domain name is registered. That includes the login, the contact details, the recovery options, the billing, the renewal settings, and the DNS. None of it should depend on one employee, a contractor, a web designer, or an IT provider who could someday walk away.
Here's a question that stumps a surprising number of business owners: Who actually owns your website address?
Not who built the website. Not who pays for hosting. Who holds the registration for the name itself, the yourcompany.com part?
If the honest answer is "Hmm. I think the web designer set that up back in 2016?" you're in good company. And you're also sitting on a problem that tends to stay quiet for years, right up until it doesn't.
Why a boring little detail matters so much
Your domain name is your business's street address on the internet. It tells web browsers where to find your website, and it tells email services where to deliver messages sent to @yourcompany.com.
Once everything is up and running, nobody thinks about it. Renewal happens automatically (hopefully), and the account where it lives can go untouched for years.
That's exactly why problems tend to show up at the worst moments: when you part ways with a vendor, when an employee leaves, or when the domain quietly fails to renew. Suddenly your website won't load, your team can't send or receive email, and nobody can remember which company holds the registration or who has the login.
Here's the kicker. Your Microsoft 365 or Google Workspace subscription and your website hosting may still be paid up and running perfectly. But if the domain lapses or its settings get changed, customers simply can't reach them anymore. It's like having a fully stocked store with no address on the building.
And if the wrong person gains control of the domain, they may be able to redirect your website visitors or mess with your email delivery. That's why the account holding your domain deserves the same care as your bank login.
The good news? Checking takes less time than you'd think. Here's the same step-by-step playbook we'd use at Justice IT Consulting.
What "owning" a domain actually means
Technically, you don't buy a domain forever. You register the right to use it for a set period, and you keep that right as long as you keep renewing.
Two terms worth knowing:
- Registrant: According to ICANN, the organization that oversees domain names, this is the person or company that registers the domain. Ideally, that's your business.
- Registrar: The company that maintains the registration. Think GoDaddy, Namecheap, Cloudflare, and similar providers.
For your business, real control means that people inside your company can renew the domain, update its details, recover the account, and approve a transfer, all without needing a favor from a former employee or an old vendor.
Rules for common endings like .com, .net, and .org are set by ICANN. Country-specific endings (like .uk or .ca) follow their own local rules, so if you use one of those, ask your IT provider to check the specifics.
Step 1: Find out who's holding your domain
You can't confirm who controls the domain until you know which registrar has it.
For most .com, .net, and .org domains, type your web address into the free ICANN Lookup tool. It should show you the registrar, the registration and expiration dates, the current status, and the "nameservers" (more on those in a minute).
Fun fact: this lookup replaced the old "WHOIS" system as the main source of domain registration info in January 2025, but plenty of people still call it a WHOIS search.
Don't panic if the registrar's name looks completely unfamiliar. Some hosting companies and web agencies resell domains through another company behind the scenes. ICANN explains how registrars and resellers work together.
It's also totally normal for your domain, DNS, website, and email to each live with a different company. That's fine. You just need to know who handles what.
Step 2: Make sure someone in your business can actually log in
Once you know the registrar, confirm that someone at your company can sign in and see the domain.
Watch out for a common mix-up here. Having access to WordPress, a website builder, or your hosting account doesn't mean you control the domain registration. Those logins might let you edit your website without letting you renew or transfer the domain.
Inside the registrar account, confirm that:
- Your domain actually shows up in the account
- Your business can change the contact details, payment method, renewal settings, and nameservers
- The account's main email address and recovery details belong to the business, not to an employee, contractor, or vendor
What if your web designer or IT provider manages domains for lots of clients in one big account? They can't hand you that password without exposing everyone else's domains, and that's fair. In that case, ask them to move your domain into a separate account created just for your company. They can still help manage it afterward. Your business simply holds the keys.
Step 3: Check whose name is on the registration
Inside the registrar account, look at the registered holder's name, organization, address, phone, and email. Where the registrar records an organization, it should be your company, not your web developer, an agency, an employee, or some unrelated business.
Don't be alarmed if the public lookup shows blank or "redacted" contact info. ICANN's current policy allows personal information to be hidden from public results, and privacy services can swap in their own details. The information inside your registrar account (and your registration agreement) is what really counts.
Some businesses use a proxy service, where the proxy company appears as the registered holder and your business gets the right to use the domain. If that's your setup, read the terms and confirm your company is the customer, and make sure you know how to renew, recover, and transfer the registration.
Step 4: Use contact info that won't walk out the door
Here's how domains get lost: the registrar's contact email belongs to someone who left the company three years ago. Renewal notices and security alerts go straight into an inbox nobody reads.
A few simple fixes:
- Use a business-controlled email address that someone actually checks. Skip personal addresses and anything owned by a vendor.
- Set up a backup recovery method that still works if your main business email is down, such as a second email, a phone number, or recovery codes.
- Make sure at least two trusted people know which registrar you use and how account recovery works.
- Give each person their own login if the registrar allows it. If there's only one login, store it in a company password manager, not in an email or a shared spreadsheet.
Step 5: Make sure the domain actually renews
Check the expiration date and the renewal settings.
Turn on auto-renewal and use a payment method the business maintains. An employee's personal credit card or a vendor's card can stop working without anyone at your company knowing about it.
Auto-renew isn't a "set it and forget it" guarantee, though. Cards expire and payments get declined. Pop a reminder on the calendar a few weeks before the renewal date so someone can confirm the payment went through.
ICANN requires registrars to send renewal reminders for common domains like .com, but those reminders only help if they're going to an inbox someone reads.
If the registration does expire, your website and email may go dark. Some domains have a grace or recovery period, but the timing, cost, and process vary. Renewing on time is much easier than winning your domain back afterward.
Step 6: Know who controls your DNS
DNS is like the GPS directions for your domain. It tells the internet where to find your website and where to deliver your email. The nameservers on your registration show which company is managing those directions.
A very common setup looks like this: the domain lives with one registrar, the DNS with a cloud provider, the website with a hosting company, and email with Microsoft 365 or Google Workspace. Nothing wrong with that, as long as your business knows which company handles each piece and how to get back into every account.
Ask your IT provider to confirm your nameservers are correct and that the DNS account is protected. Keep a record of the provider's name, who's approved to use the account, and how recovery works. The UK National Cyber Security Centre's domain management guidance also recommends having more than one trusted person able to manage the domain and keeping an eye on important DNS records for changes.
Your IT provider can absolutely keep managing DNS day to day. Your business just needs enough information in-house to approve changes and recover the account if that provider ever disappears.
Step 7: Lock it down
Once ownership and recovery details are squared away, secure the account:
- Use a unique password stored in your company password manager.
- Turn on multifactor authentication (MFA), using the strongest option the registrar offers.
- Remove former employees, agencies, or vendors who no longer need access.
- Turn on alerts for DNS changes, transfers, contact updates, and renewals if the registrar offers them.
- Turn on the domain's transfer lock. Your registrar might call it "Registrar Lock" or "Client Transfer Prohibited."
ICANN explains that a transfer lock helps prevent unauthorized transfers. But it's not a force field. Someone who takes over your registrar login could simply turn the lock off, which is why MFA and current recovery details matter just as much.
What if your web designer (or old IT company) has your domain?
Plan the move before you end the relationship. It's a lot easier to get cooperation while everyone is still on good terms.
Ask them for:
- The registrar's name and the expiration date
- The registered holder's details
- The current nameservers
- Their process for moving the domain into an account your company controls
Then create a new registrar account with company details, add proper recovery information, and turn on MFA. Your current provider can move the domain into that account or help transfer it to a different registrar.
Good to know: moving the domain registration doesn't mean moving your website or email. The existing nameservers can normally stay in place during the transfer. Still, one accidental settings change can cause an outage, so ask your IT provider to keep an eye on your website and email while the move happens.
If a former employee or vendor won't cooperate, gather any contracts, invoices, payment records, registration emails, and messages showing the domain was registered for your business. Contact the registrar and ask what proof it needs. If there's a real dispute over ownership or contract terms, it may be time to talk to a lawyer.
Make it a once-a-year checkup
Once everything's in order, put a yearly domain review on the calendar. Confirm the registrar, expiration date, payment method, auto-renew setting, registration details, recovery options, MFA, transfer lock, nameservers, DNS provider, and who has access.
Run the same check any time you switch IT providers, web companies, or marketing agencies, and make it part of offboarding whenever an employee with access leaves.
Keep the results with your IT records. Just keep passwords and recovery codes in the password manager, not in the document.
Frequently Asked Questions
How can I find out who registered my business domain?
For most .com, .net, and .org domains, use the free ICANN Lookup tool at lookup.icann.org. It will show the registrar, expiration date, and nameservers. The registrant's contact details may be hidden for privacy, so log in to the registrar account to see the full record.
Does private registration mean my business doesn't own the domain?
No. Privacy services simply hide contact details from the public. To confirm who holds the domain, sign in to your registrar account and check the private registration details and your service agreement.
Does my web designer own my domain if they registered it?
It depends on the registration details and your agreement with them. Check who's listed as the registered holder, whose account the domain sits in, who pays for it, and what the contract says. If it depends on the designer, ask them to move it into a business-controlled account.
Should my domain and website hosting be with the same company?
They don't have to be. Many businesses keep their domain registration, DNS, website hosting, and email with different providers. What matters is keeping a record of who handles each service and making sure your company can recover every account.
What happens if my domain expires?
Your website and business email may stop working. You may have a limited window to recover the domain, sometimes for an extra fee, but the rules vary by registrar and domain type. The safest move is to renew before the expiration date.
Not sure who's holding the keys to your domain?
Ask your IT provider to confirm who holds your domain registration and who can recover the account. If you don't have an IT provider, Justice IT Consulting can help. We work with businesses across Dallas-Fort Worth and beyond to make sure the accounts that keep the lights on are actually in their hands. Book a discovery call with our team and we'll help you find out where your domain really lives.
