Who Owns Your Domain? How to Check, and Why It Matters
Your domain is your email, your website and your identity with every vendor and customer. Whoever controls the registrar account controls all of it. In a surprising number of small businesses, that person is a web designer from 2016 or an email address nobody checks.
We run a free domain-ownership check for businesses that aren't sure, and the results are occasionally alarming: a domain registered to a designer who has since retired, a renewal notice going to an address that stopped existing two internet providers ago, an auto-renew tied to an expired card. All of it fixable, and all of it much cheaper to fix before the expiration date than after.
The Short Version
Paying the invoice doesn't make you the owner. The registrant on record and the login to the registrar account do. Look up the domain, find the registrar, and ask two questions: do I have the login, and is the account's contact email one I control? If either answer is no, fix it this month, before it expires or before that person leaves.
Three Different Things
| Piece | What it does | Who usually has it |
|---|---|---|
| Registrar | Holds the registration itself: ownership, renewal, transfers | GoDaddy, Namecheap, Cloudflare, Squarespace, or a reseller inside a hosting bundle |
| DNS host | Holds the records that point the domain at your website, your email, and your SPF, DKIM and DMARC | Often the registrar, sometimes the web host, sometimes Cloudflare |
| Web host and email host | Serve the website and the mailboxes | Your hosting company; Microsoft 365 or Google Workspace |
They can be three companies, set up by three different people over ten years. Losing the host loses a website you can rebuild. Losing the registrar loses everything.
How to Check
- Look the domain up at lookup.icann.org, or any WHOIS tool. Privacy services hide the name, and that's fine. What you want is the registrar's name and the expiration date.
- Ask: do I have a login to that registrar? Not the web designer, not the hosting company. You.
- Ask: is the account's contact email one I read today? Renewal notices and password resets go there. A dead address means the first warning you get is the website going dark.
- Check the expiration date, and whether auto-renew is on with a card that works.
- Check that the domain is locked against transfer at the registrar. It usually is by default.
- Check that two-factor authentication is on for the registrar account. A phished registrar login is how domains get stolen.
The Bad Situations We See
- The designer registered it under their own account “to make it easy.” Easy until they retire, get sick or stop answering.
- The contact email belongs to a former employee, or to an internet provider you left years ago.
- Auto-renew is on, attached to a card that expired.
- The domain lives inside a web-hosting bundle, and cancelling the hosting cancels the domain.
- The “free domain with hosting” that turned out to be registered to the host.
- Two partners, one login, and a disagreement.
Fixing It
- Get the registrar login handed to you, or have the domain moved into an account in your name. Change the password and the account email the same day.
- Turn on two-factor authentication, the transfer lock and auto-renew with a company card. Renew for several years at once if the budget allows.
- Add a second person with access, and write down where the login lives: the company password manager, not a sticky note.
- Know the 60-day rule. After a change to the registrant contact, most registrars lock transfers to another registrar for 60 days. Update the contact first, wait, then move if you're moving.
- If the holder won't cooperate: an expired domain has a grace period and then a redemption period, roughly a month each, before it goes to auction, so watch the date. A domain that's your trademark can be recovered through a dispute process, which is slow and costs money. A domain sitting in someone else's account is a conversation with an attorney, not the registrar.
Moving Registrars Without Breaking Email
Copy every DNS record before you touch anything. Unlock the domain and get the transfer code from the old registrar. Start the transfer at the new one; it takes up to five days and adds a year to the registration. Don't change nameservers at the same time. Move the registration first, confirm email still flows, then move DNS if you want to. Most email outages during a domain move come from doing both at once.
How We Do It
Domains in our domain, hosting and email packages are registered in the client's name, with the client's contact email, and we're listed as the technical contact. When an employee who held any of these logins leaves, the offboarding checklist includes moving them.
Quick Self-Check
| Question | If “no” or “not sure”... |
|---|---|
| Can you log into your registrar right now? | Find out today |
| Is the contact email one you read? | Change it |
| Is auto-renew on, with a card that works? | Check the card |
| Does a second person have access? | Add one |
Free Domain-Ownership Check
Tell us the domain. We'll tell you who holds it, where it lives, when it expires and what needs to move, with no obligation.
Frequently Asked Questions
WHOIS privacy hides my name. Does that mean I don't own it?
No. Privacy hides the public listing. Ownership is the registrant on file with the registrar and the login to the account. Check the account, not the public record.
My web designer has disappeared. What now?
Start with the registrar. With proof of the business identity, some will help move a domain to its rightful owner. If not, it's the attorney route, and watch the expiration date closely; an expired domain is easier to recover than a contested one.
Can someone steal my domain?
Yes, by phishing the registrar login or taking over the account's email address. Two-factor authentication on the registrar account and the transfer lock stop nearly all of it.
How long do I have after it expires?
Typically a grace period and then a redemption period of roughly a month each, with rising fees, before the domain is auctioned or released. Don't test it; the fees climb and the auction is final.
Should I also register the .net and .org, or common misspellings?
For a business that depends on its email, the obvious variants are cheap insurance against lookalike fraud; see our wire fraud guide. Register them and point them at the main domain.
More Guides
Domain in your name, static hosting and managed email as one package.
SPF, DKIM and DMARC explained, and the mistakes that break them.
Disable first, capture the mailbox, revoke access, wipe the devices.
How business email compromise moves real money, and the callback rule that stops it.
Setup, migration, deliverability and security for Microsoft 365, Google Workspace and Proton Mail.
The sign-in method a fake login page can't steal, and how to set one up.
📞 727-579-4335 · ✉️ support@baygeeks.com · Privacy Policy · Terms of Service