Your Domain Name Is Your Business Identity: Who Actually Controls It?

Your domain name is not just your website address. It is the name on your email, the anchor for your logins, and the identity your clients recognize. Lose control of it and you do not lose a web page. You lose your email, and with it the ability to reset any password.

Almost every business owns one. Very few can say who holds the account, whether it renews automatically, or who could move it tomorrow. This guide explains the four pieces involved, in plain English, and the settings worth locking down.

The four pieces, in plain English

Four separate things get confused with each other constantly.

The domain is the name itself: whoodentech.com. Think of it as a listing in the global phone book. You do not own it forever; you hold the exclusive right to use it, renewed annually.

The registrar is the company you rent the name through: GoDaddy, Namecheap, Cloudflare, Network Solutions. Your registrar account is the master key to everything below.

The nameservers answer questions about your domain. When someone emails you, their mail server asks where mail for whoodentech.com goes, and your nameservers answer. Whoever controls your nameservers controls those answers.

The records are the answers themselves: small entries that say where your website lives, where your mail goes, and which services may act in your name.

One clarification saves a lot of confusion: your registrar and your nameservers are often two different companies. You might rent the name from GoDaddy while Cloudflare answers the questions. Both need to be secured.

Who actually owns your domain?

This is the single most common problem we find, and it is not technical.

Domains get registered by whoever was handy at the time: a web designer during the site build, a marketing agency, an employee who has since left. The name works, so nobody looks again for eight years. Then the relationship ends, or the agency folds, and the business discovers it does not control its own identity.

Two questions worth answering this week. Whose name is on the registration? It should be the company, not an individual and not a vendor. And whose email is on the registrar account? Password resets go there, and if that address belongs to a former employee or an old agency, they hold the keys.

Recovering a domain from an uncooperative former vendor can take weeks and sometimes a lawyer. Fixing it while everyone is still friendly takes an afternoon.

The registrar account is a master key

Treat the registrar login the way you treat your bank login, and for the same reason. An attacker inside your registrar account does not deface your website. They redirect your mail, then request password resets on your bank, your payroll system, and your Microsoft 365 tenant. The reset links arrive in their mailbox, not yours.

Four settings do most of the work here:

• Multi-factor authentication on the registrar account. Non-negotiable. Use an app or a passkey, not a text message: Microsoft is already retiring SMS codes because of how easily they are intercepted.
• Registrar lock (sometimes called transfer lock or clientTransferProhibited). This blocks a transfer to another registrar unless you explicitly unlock it. It is free and usually on by default. Confirm it is still on.
• Auto-renew, paid by a card that will not expire. More domains are lost to a dead credit card than to hackers.
• A shared company mailbox as the contact, not one person’s inbox, so renewal and transfer notices reach someone who still works there.

WHOIS privacy is worth a line too. The public registration directory shows who registered the domain and how to reach them; privacy services replace those details with a proxy, which cuts spam and the raw material for a convincing impersonation. Most registrars now include it free. It hides your details from the public, not from the registrar or from law enforcement.

The records that run your business

A handful of record types matter to a normal business.

• A record points your name at a web server. This is what makes whoodentech.com load your site.
• CNAME record points one name at another name, used for things like gmb.whoodentech.com or a hosted booking page.
• MX record says where your email goes. Change this and your mail goes somewhere else. It is the highest-consequence record you have.
• TXT record holds plain text used for verification and policy. Microsoft uses one to confirm you own the domain, and your email authentication records live here.

Those authentication records decide whether criminals can send mail in your name and whether your own mail reaches the inbox, and they have a guide of their own.

Two more records handle a different job: proving your DNS answers are genuine. DNSSEC signs your answers cryptographically, so a forged answer pointing a visitor at a fake login page fails a signature check. The honest caveat is that DNSSEC is unforgiving of sloppy changes, and a botched key rotation takes your domain offline entirely, so it belongs in competent hands. CAA records name which certificate authorities may issue HTTPS certificates for your domain. Without one, any of dozens can; with one, you have named the two or three you actually use. It is a cheap, low-risk record that very few small businesses have published.

What happens when a domain lapses

An expired domain does not vanish. Most common extensions give you a recovery window of roughly 30 days, then a short pending-delete period, and then the name is released to the open market.

It does not sit there. Specialist services register expiring names within milliseconds of release. Research published by Infoblox in August 2026 found roughly 65,000 previously registered domains being re-registered every day, nearly one in five of all new registrations, and 76% of them put to work within a week. Some buyers are legitimate investors. Infoblox also tracked one criminal operation that had spent close to $7 million buying more than 10,000 expired domains, including names abandoned by General Electric and Procter and Gamble. Attackers pay for used names because an aged domain inherits trust: history, backlinks, and a clean reputation that security filters still respect.

For a business that let a name lapse, the harm is specific. Mail sent to the old address now arrives at the new owner: old invoices, old contracts, old password resets. An expiry notice sitting unread in a departed employee’s mailbox is a real risk, not a clerical one.

Dangling records and subdomain takeover

One more failure mode, common in businesses that try lots of tools. You point blog.whoodentech.com at a hosted service, cancel it two years later, and nobody removes the record. Someone else signs up for that service, claims the name, and now controls a page that loads under your domain: their content, your brand, your HTTPS padlock.

It is called subdomain takeover, and the fix is unglamorous record hygiene: when a service is cancelled, the record comes down. The same applies to every marketing tool, form builder, and status page that ever got a subdomain. Old records are open doors.

What a well-run domain looks like

The end state is short enough to check against.

1. Registered to the company, with a shared company mailbox as the contact.
2. Multi-factor authentication on the registrar account, using an app or passkey.
3. Registrar lock and auto-renew on, with a payment card that is current.
4. Expiry date known and monitored by more than one person.
5. WHOIS privacy enabled.
6. SPF, DKIM, and DMARC published and enforcing.
7. DNSSEC enabled, managed by someone who understands key rotation.
8. A CAA record naming your certificate authorities.
9. No dangling records. Every subdomain points at a service you still use.
10. A written record of where all of it lives, stored somewhere other than one person’s head.

Nine of the ten cost nothing. They are configuration, not purchases, which is our usual finding: the gap is rarely what you bought.

How to check where you stand

Most of this takes about ten minutes to verify yourself. A public WHOIS lookup shows the registrar, the expiry date, and whether transfer lock is set. Free tools like MXToolbox show your MX, SPF, DMARC, and DNSSEC status in seconds.

Then answer the two questions no tool can. Who can log into the registrar account? And is the contact address on it a mailbox someone still reads? If the answer to either is “I would have to ask the person who built our website,” that is worth resolving now rather than during an incident. Domain and DNS management is part of the baseline in our managed IT service, not an extra. Get in touch and we will tell you where your domain stands and what it would take to bring it under proper control.