Your website can look fine while the domain behind it sits in an old agency account. You may only discover the problem when a renewal fails or you need to change providers.
For a small business, domain ownership means knowing who is named on the registration and who can control the account. Those aren’t always the same person. Start by checking the record, then the access and settings that keep your website and email working.
Key takeaways
- Check the registered name holder and the account that controls the domain. A public lookup alone won’t prove you can manage it.
- Keep registrar access, recovery details, multi-factor authentication and renewal payments under business control.
- Record DNS settings before changing an agency, host or registrar. A domain move and a website move are different jobs.
- Review the details after staff or supplier changes, not only when renewal approaches.
Start your domain ownership checklist at the registrar
Find the account and registration records
Search your business inbox and payment records for domain renewal notices. The sender should help identify the domain registrar, which may differ from your web host. Sign in through the registrar’s usual website and search domain records in its control panel.
Check who can sign in, who pays, and which email receives account recovery messages. Record the domain registration details, and save the original registration confirmation and recent invoices. If an agency bought the domain on your behalf, ask which account holds it and whose details appear as the registered name holder.
A paid invoice is useful evidence of an arrangement, but it doesn’t give you access to the registrar account.
Run a public registration lookup
Enter the domain name into ICANN Lookup and note the registrar, registration dates, expiry date, nameservers and any visible contact details. This shows registration data, not the domain availability of another name. Privacy protection services may conceal some registrant information, so a hidden name doesn’t mean nobody is registered.
You may still hear this called a WHOIS lookup. For most generic extensions, the RDAP protocol now provides public registration data held by the relevant domain name registry. ICANN’s RDAP and WHOIS update explains the change that took effect in January 2025. Rules for country-code domains can differ, so check the relevant registry or registrar if a result is unclear.
Check the registrant and contact details
Separate the four contact roles
Domain records have traditionally distinguished the registrant, or registered name holder, from administrative, technical and billing contacts. One person or organisation may fill several roles, and privacy rules can prevent those details appearing publicly.
Check the registrar account rather than relying on the lookup alone. For a business domain, confirm that ownership and contact information match the intended business arrangement. The administrative contact should receive account notices, the technical contact should receive technical messages, and billing notices must reach someone who can act on them.
If your web development agency is listed as the registrant, review the registration paperwork and service agreement. Ask the agency to confirm in writing what it holds on your behalf and how control can be handed over.
Keep the details reachable
An address nobody monitors can turn a routine verification request into an access problem. Check the business name, postal address, telephone number and email held by the registrar, then correct anything outdated.
For generic domains, ICANN’s contact-accuracy guidance describes verification requirements and the obligation to keep changed details current. Registrars also send annual reminders to review registration information.
Domain privacy services can hide eligible personal details from public results and reduce unwanted contact. Privacy protection services don’t remove your responsibility to keep the underlying information accurate with the registrar.
Secure registrar access and recovery
Protect the account that controls changes
The registrar login deserves the same care as your business email. Set a unique password in a password manager and enable multi-factor authentication. If the registrar offers a passkey or authenticator app, use an option your business can maintain when staff change.
Give staff and suppliers their own limited access where the registrar supports it. Remove former employees promptly. An agency working on web design, local SEO or email marketing may need a DNS change, but it doesn’t automatically need the main registrar password.
Be wary of unexpected renewal or security emails. Open the provider’s saved address yourself rather than using a message link. Never send passwords, verification codes or recovery details to someone claiming to be support.
Test the recovery route
Confirm the recovery email and phone belong to the business, not a contractor who left last year. Protect that mailbox with multi-factor authentication too, because it may reset the registrar password.
Store recovery codes securely and give an authorised backup person a way to retrieve them. If your only recovery address uses the domain you’re trying to restore, ask the registrar what alternative recovery options it supports. Record its support route and any account reference you would need during an outage.
Keep renewals and transfer locks under control
Review payment before the expiry date
In the registrar account, confirm the domain name, expiry date (the expiration date), renewal period and automatic renewal setting. Check the payment card and where receipts and failed-payment notices go. Put a separate reminder in a calendar owned by the business; it gives you a chance to catch a rejected payment.
Don’t assume every expired domain has the same recovery window or fee. Those terms depend on the extension and provider. If the domain is already close to expiry, resolve the renewal first and ask the registrar before starting a transfer.
Know what a lock does
A registrar transfer lock can stop an unauthorised move to another registrar. In a lookup, a status such as clientTransferProhibited indicates that transfer requests should be rejected. ICANN’s explanation of domain status codes helps you interpret what you see.
A lock is useful, but it doesn’t replace a secure login or correct contact details. Before an approved move, ask your registrar which lock must be removed and when. Changing the registered name holder can also trigger a 60-day restriction on moving between registrars, so plan the handover in the right order.
Audit DNS before changing a provider
Record what keeps the business reachable
DNS records send visitors to your website and route messages to your email provider. An A record points your website to an IP address, while nameservers identify where those records are managed. Neither tells you, on its own, who controls the registrar account.
Save a copy of the current nameserver information and DNS records before changing anything, including each A record’s IP address. Include website records such as A, AAAA and CNAME; MX records for email; and TXT records used for email authentication or service verification. Note who administers the DNS provider.
This matters beyond the homepage. A missing record can interrupt contact forms, booking notifications or the email used by your lead-generation systems.
Distinguish a site move from a domain transfer
Moving a site to new managed web hosting may require DNS changes without moving the domain to another registrar. Likewise, changing registrars doesn’t automatically move your website files or email.
Give your web hosting or web development provider the records they need, rather than sharing the master login by default. After a change, test the site, business inboxes and enquiry forms. Check that your Google Business Profile and other customer-facing links still point to working pages.
Resolve third-party control without breaking the site
Ask for a documented handover
If a former employee or digital marketing agency holds the registration, contact them with the domain name, invoices and relevant agreement. Request confirmation of the registered name holder, registrar and account contact. Then agree which details and access need changing.
An agency can manage a client’s website, SEO and DNS without being the sole holder of the domain account. Clear account roles make future work easier for both sides. See how we collaborate with creative agencies when your team needs technical delivery while keeping client responsibilities clear.
Changing the registered name holder, transferring the registrar and switching web hosting are separate actions. Decide which one you need before anyone changes DNS.
Plan the transfer sequence
If you intend to change registrars, ask the current registrar for its transfer instructions and authorisation code. Confirm that the destination account is ready and that the business can receive approval messages. Export DNS records first, even if you expect nameservers to stay unchanged.
Check the timing of any registered name holder change before submitting a transfer. ICANN’s change-of-registrant guidance explains when a 60-day inter-registrar lock may apply. If cooperation has broken down, keep correspondence and contact the registrar about its available account-recovery or dispute process.
Keep an ownership record you can use later
Record the domain, registrar, registered name holder, technical contact and recovery contacts in a protected business inventory. Include the expiry date, renewal method and authorised users, plus the DNS provider, web host and email service. Store access credentials in a password manager, not an open spreadsheet.
Review the inventory after staff changes, agency handovers and payment-card replacements. At least once a year, compare it with the live registrar account and test the contact routes. Include related accounts, such as analytics and your Google Business Profile, when you review who has access.
Domain checks sit alongside website care and maintenance. Backups and monitoring help protect the site, but they can’t renew a domain or recover an inbox controlled by someone else.
Frequently asked questions
Can I find out who owns a domain if the lookup hides the name?
You can usually identify the registrar and see some registration details through a public lookup. Registrant contact fields may be withheld, however. If it’s your business domain, check your registrar account and registration documents. If you have no access, ask the registrar what information it needs to investigate your request.
Does a developer paying for the domain mean they own it?
Payment alone doesn’t settle the question. Check the registered name holder, account control and your agreement with the developer. Where these don’t match what was agreed, request a documented correction and a handover plan before changing website or email settings.
Can a broker get a domain that’s already registered?
A domain broker service can approach the current holder and try to negotiate a sale. The holder doesn’t have to sell, and a broker can’t promise success. Check the broker’s fees and terms before committing. For a domain your business already registered, start with the registrar’s access and recovery process instead.
Final thoughts
A domain can keep working for years while its account details grow out of date. Clear control means the right business details, reachable recovery contacts, secure access and a reliable renewal method.
Check those points now, then keep the record current. You’ll have a much simpler handover when people or providers change.
