Domain Ownership: How to Check Who Controls Your Business Domain

Find out who can renew your business domain, manage its settings, and recover access without moving anything.

The short answer

ETC recommends checking three things: who holds the registration rights, which account manages the domain, and whether your business can access that account and recover it. Then identify who manages the settings that connect the name to your website and email.

Paying the renewal bill is a starting point, not a complete control check. Neither is seeing your business name on the website. Registration rights come from the registration arrangement; a paid invoice does not tell you who can sign in.¹

The practical question is simple: if the person who set this up became unavailable, could your business keep the domain renewed and get authorized help?

You do not need to become a website administrator to answer that. Start with your records, a public lookup, and an observation-only account review. If the records disagree, write down the gap rather than trying to fix it by moving the domain. A contractual dispute and a missing login need different kinds of help.

What does “owning a domain” actually mean?

A domain is a registered name, such as example.com. Registration gives a person or organization rights to that name under an agreement; it is not a permanent purchase without conditions. Fees, transfers, and renewals are governed by the registration agreements.¹

The person or organization holding those rights is called the registrant. The company handling the registration is the registrar. You may buy through a reseller instead of dealing with the registrar directly. ICANN's domain registration guide explains these roles.¹

For an owner, I would separate the check into two questions:

• Rights: who is recognized as the registration holder, and what do the agreements say?
• Control: who can access the account, renew the registration, manage permissions, and recover access?

Those answers should support each other. Do not treat a working login as a legal determination, or a contractual entitlement as proof that someone has tested your access.

You want to find that mismatch before a disagreement or missed renewal.

Are the registrar, DNS provider, and website host the same company?

They may be sold together, but registration and hosting are different services. ICANN describes resellers that offer both domain registration and web hosting.¹

Here is the useful distinction:

The table separates registration, DNS routing, and the services behind it; DNS address and mail-exchange records do not themselves contain your website or operate your mailboxes.¹²³

Those routing instructions are called DNS records. Some connect names to server addresses. Mail-exchange records, usually shortened to MX records, direct incoming email toward a mail server. Cloudflare's DNS record documentation describes the separate record types.²

For this review, do not accept “you can edit the website” as the answer to “who controls the domain?” Ask about each service separately, even if they arrive on one invoice.

How do you find the registrar?

Start with a public registration lookup, then compare it with your business records. ICANN Lookup provides a browser-based way to query registration data through a system called RDAP, the replacement for the older WHOIS protocol.⁴

For a first pass:

1. Open ICANN Lookup using the link above.
2. Enter the domain itself, without a page path.
3. Record the registrar, listed nameservers, status, and expiration information where available.
4. Compare the results with renewal notices, invoices, and the provider's explanation. Confirm your actual renewal deadline with the registrar or reseller rather than relying only on the public date.

A public lookup is not a complete ownership check. Registrant details may be redacted under applicable rules. A hidden name is not, by itself, evidence that someone has taken your domain. ICANN's Registration Data Policy sets out publication and redaction requirements.⁵

Nameserver records identify the authoritative DNS servers, not the person who can sign in to manage them.² Treat them as clues and confirm the account arrangement. Country-code domains can have different registration arrangements; consult the relevant operator rather than assuming every ICANN process applies.¹

What should you check inside the account?

ETC's recommendation is to inspect before changing anything. Use your existing authorized login at the provider's official website. Do not ask someone to email you their password.

If you lack access, ask whether the provider supports an invitation, delegated role, or another domain-specific handoff. During this first review, ask:

• Registration holder: does the underlying registration information accurately reflect the intended person or business?
• Your permissions: can your business manage the registration, or only view billing?
• Renewal: what date, renewal setting, payment method, and notification contacts are recorded?
• Recovery: who controls the recovery email, phone, and authentication methods?
• DNS management: where are the active records managed, and who has authorized access?
• Responsibility: who will address an unanswered question, and by when?

Keep supporting agreements and invoices. Do not change nameservers, delete records, unlock the domain, or start a transfer as a test. This is an inventory, not a migration.

What does a control gap look like?

Consider a hypothetical repair shop, not an ETC client example. Its owner pays a web company for the website, email, and domain renewal. The owner can edit opening hours, but the registration sits in an account controlled only by the web company.

The website works. The bill is paid. The owner still cannot independently check renewal or recover the registration account.

That does not automatically mean misconduct. In this example, it means the arrangement needs a clearer handoff.

I would ask the provider to identify the registration holder, explain the account structure, and propose supported business-controlled access. If the domain is inside a shared agency account, do not request access to other customers' information. Request a domain-specific solution.

A modest service business does not need to operate its own technical department. It needs an arrangement it understands and can continue when the people involved change.

Your domain-control worksheet

Use the three separate checks above to keep rights, access and recovery distinct.

Start this week by filling in one private record for your main domain. An incomplete record with honest gaps is more useful than “the web person handles it.”

Write unknown where necessary. Keep the completed worksheet private. Do not put passwords, full payment-card details, recovery codes, or domain transfer authorization codes in it. Record where approved instructions are stored, not the secrets themselves.

If the records conflict or the provider disputes your rights, preserve the documentation and ask the registrar about its process. Consider legal advice for a contractual dispute. This article is an operational checklist, not a determination of legal ownership.

ETC's view: you do not need to become the person who maintains every setting. You need enough visibility and authority to choose who does.

Explore another question

• Domain vs. Hosting vs. Email: How Your Business Systems Connect
• Questions to Ask an IT Provider Before You Hire Them

Sources

1. ICANN: The Domain Name Registration Process. Registrants, registrars, resellers, agreements, renewals, and country-code registration arrangements.
2. Cloudflare: DNS record types. Address records, MX mail routing, and NS nameserver records. Product documentation, not a recommendation to move providers.
3. MDN: What is a web server?. Website files, hosting, and serving content to browsers.
4. ICANN: Information for RDAP Users. Registration-data access, WHOIS replacement, and ICANN's browser-based lookup tool.
5. ICANN: Registration Data Policy, section 9. Publication and redaction of registration data; the linked official URL redirects to the current policy page.