Who really owns your domain name?

Your domain connects people to services such as your website and business email. Its registration may have been arranged by an employee, an agency or another provider. Knowing who originally set it up is useful, but it does not confirm the current registration details or who is authorized to manage the account today.

A gap in that record can cause difficulty during a website rebuild, provider change or renewal. Reviewing the arrangements while services are working gives you time to clarify responsibilities and resolve access issues without an immediate deadline.

Three parties, and why people confuse them

A domain involves more parties than most people realize, and the confusion between them causes real problems.

The registry operates the top-level domain — the .com or .org part — and maintains the authoritative record. The registrar is the company you register through and hold an account with. The registrant is the party the domain is registered to. Separately, and often at a completely different company, the DNS host holds the records that point traffic where it should go, and the web host runs the actual site.

Those roles can be held by one provider or several. When somebody says "our host has the domain", it is worth finding out which of those five things they mean.

What a lookup will and will not show you

Registration data for generic top-level domains is now published through RDAP, which ICANN designated as the definitive service for gTLD registration data at the start of 2025. Some contracts still carry WHOIS obligations alongside it — .com, .name and .post among them — and country-code domains follow their own rules.

A lookup can identify the sponsoring registrar. That gives you a starting point, although you may also deal with a reseller or agency that manages the customer relationship.

The registrant's name, email and address, however, are commonly redacted from public output for privacy reasons. This surprises people who expected a domain lookup to work like a property record. It does not, and it was never designed to: registration data is a directory for technical and administrative contact, not a title register. Even where a name is visible, it is a record entry rather than legal proof of entitlement, and a disputed claim may require contracts, company records and advice about the applicable process.

Access gaps to look for

Consider a hypothetical company preparing to launch a redesigned website. The new agency needs a DNS change. Nobody can find the registrar account. The domain turns out to be registered under the personal account of a contractor who built the original site, using his own email address and his own card, and he has since moved abroad and stopped answering. The company now needs to establish who is authorized to manage the registration and follow the relevant recovery process before proceeding. That can delay the launch even when nobody intended to create a problem.

Other possibilities include a domain Registered on a departed employee's personal email, so recovery messages go nowhere. Registered under an agency's bulk account, where the client is a line item rather than an account holder. Paid on a card that has since been cancelled, with renewal notices going to a mailbox nobody reads. Or held correctly, by the right company, with the password known to exactly one person who is currently on a plane.

Establishing control, in the right order

• Identify the registrar from a lookup of every domain you use, including redirects and old brand names.
• Find the account: search accounting records for payments to that registrar, then search mail archives for renewal notices.
• Have an authorized company representative verify access. If that fails, contact the account holder or registrar through its official process; do not try to bypass another party’s access controls.
• Confirm the contact and recovery addresses are company-approved, monitored and accessible to authorized staff. Use named delegated access where supported, and review recovery options if the domain itself becomes unavailable.
• Confirm the agreed payer, renewal settings and billing details. Record who checks renewal notices and payment failures.
• Turn on multi-factor authentication. CISA's small-business guidance treats MFA as an essential layer, and a registrar account is exactly the kind of high-consequence login it exists for.
• Confirm the transfer lock is in place for domains you are not actively moving.
• Write down who is responsible, who the backup is, and where the credentials are held.

If an agency or contractor manages the registration, ask them to explain the arrangement and document the next steps together. Check contracts and registrar requirements before changing the registrant, account holder or provider. Those changes are different operations and may have different consequences.

What this does not resolve

Getting into the registrar account does not by itself mean your DNS is correct, that your mail authentication is configured, or that your website is being hosted somewhere you know about. Those are separate layers, and a domain can be perfectly held while pointing at infrastructure nobody in the business can identify.

It also does not settle a genuine ownership dispute. If two parties disagree about entitlement to a domain, that is a matter for the registrar's processes, your contracts, and where appropriate professional advice — not for a lookup tool.

Keep registration changes separate from service changes

Moving a registration does not necessarily require changing the website or email provider. Before any approved change, record the current nameservers and identify who manages the DNS zone. A nameserver change can affect several services at once, including email and verification records that are not obvious from the website.

Use a planned change window where appropriate, preserve a record of the existing settings and decide how you will verify the result. Afterward, check the account arrangements as well as the working services. A successful website visit alone does not confirm that renewal notices, recovery access and every related domain have been addressed.

Your next step

Watch the training walkthrough, then run the lookup on your own primary domain while it is in front of you. Record what you can verify and which details still need confirmation from the account holder or registrar.

If the records span several providers, ALCO USA Inc can help you document the technical dependencies and plan the work alongside hosting, development and IT support. Unclear ownership or contractual entitlement needs to be resolved through the appropriate parties before a transfer proceeds.

Sources and further reading

ALCO training on domain ownership: https://alcohq.com/training/domain-ownership
Video walkthrough: https://youtu.be/vPLz6TuYsuE
ICANN on the move from WHOIS to RDAP: https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en
ICANN Lookup FAQ on redacted registration data: https://lookup.icann.org/en/faq
CISA on requiring multi-factor authentication: https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication