Who actually controls your domain name, website and business email?
Your website and email depend on several accounts, often spread across different companies and different people's logins. Here's how to find out who controls each one, what to look for, and what to fix while nothing is on fire.
Ask a business owner who owns their website and the answer is often "we do." Ask who controls the domain, the DNS, the hosting account and the email admin, and the answers get less certain. Often they're four different companies, and sometimes the logins belong to a developer, a former employee or an agency that's long gone.
That's rarely a problem until the day it is: a renewal fails, a developer stops answering, or you need to change something quickly. The time to sort it out is now, while everything still works.
The pieces, in plain English
A business website and its email depend on a handful of separate accounts. They can all be at one company, but they often aren't.
| Piece | What it does | Who usually holds it |
|---|---|---|
| Domain registration | Your name on the internet, renewed every year or few years at a registrar | A registrar account, which may or may not be yours |
| DNS | The directory that points your domain at your website, your email and other services | Often the registrar, the host or Cloudflare |
| Hosting | The server your website runs on | A hosting account, in your name or someone else's |
| Website admin | The login that controls the website itself, such as WordPress's administrator | Whoever set the site up, unless you added yourself |
| Business email | The service that receives and sends your mail, such as Google Workspace or Microsoft 365 | An administrator account at that provider |
| Google and other accounts | Business Profile, Analytics, Search Console, ad accounts, payment and booking services | Whichever Google or company account created them |
The registrant is what really matters
For your domain, three different things can get mixed up: who pays for it, whose registrar account it sits in, and who it's registered to. The last one is the registrant, and it's the one that counts. Under ICANN's transfer rules, the registrant is the only party who can approve moving the domain to another registrar.
It matters for renewals too. Registrars send the required renewal reminders to the contact details on the registration, so if those belong to a developer or a former employee, the warnings go to them and not to you.
Ideally all three are your business. A common arrangement that causes trouble later is a domain registered in a developer's or agency's name, in their account, with you paying them for it each year. Everything works until the relationship ends, and then you're asking someone else for permission to use your own name.
If you use a privacy or proxy service, check which kind it is. A privacy service keeps you as the registrant and just hides your details. A proxy service becomes the registrant of record itself, and your rights then depend on its terms.
How to check each one
Domain. ICANN's free lookup at lookup.icann.org shows the registrar for .com, .net, .org and other generic domains, the expiration date, and the domain's status codes. Public lookups usually hide the registrant's name and contact details, so log in to that registrar to confirm who the domain is registered to, and that the account is in your business's name with an email address you read.
DNS. The same lookup shows the domain's nameservers, which tell you which company answers for its DNS. Make sure you have a login there too, because that's where the records for your website and email live.
Hosting. Check which company you're paying for hosting, if any. If you're not paying anyone, someone else is hosting the site, and you should know who.
Website. Log in to the site's admin and look at the list of users. You should have your own administrator account, under your own email, and you should recognize every other administrator on the list.
Email. Your domain's MX records, which Google's free Dig tool can show you, name the provider that handles your mail. Then confirm who the administrators are at that provider.
Everything else. In your Google Business Profile, Analytics and Search Console, check the list of owners and users. If an old marketing agency still owns your Business Profile, fix that while the agency is still answering email. Do the same for payment, booking and form services connected to the site.
Warning signs worth fixing now
- The domain is registered to a person rather than your business, or to a company you no longer work with.
- The registrar or email admin account uses a personal address, or the address of someone who's left.
- Your email provider has only one administrator.
- Auto renew is off, or set to charge a card that's about to expire.
- Nobody at your business can log in to the hosting or DNS.
- The domain shows a "client transfer prohibited" status and you can't get into the registrar account to change it. That lock is normal protection against theft, but only if you can unlock it yourself.
Keep a one-page record
Write down, for each piece above: the company, the account's owner, who has access, the renewal date if there is one, and how to reach support. Keep the passwords themselves in a password manager the business owns, not on the page. Review it once a year, and whenever someone with access leaves.
It's a short document, and it's what makes an outage, a staff change or a change of developer an inconvenience instead of a crisis. If you're already in the middle of one of those, our guide to regaining control when a developer stops responding covers the order to take things back in.
When someone else manages it for you
It's normal, and often sensible, for a web company to run your hosting and DNS day to day. Under our own Website Care, we host the sites we look after. What matters is that the domain is registered to your business, that you know where everything lives, and that the terms for getting a full copy of your site are written down before you ever need them.