Who Controls Your Domain? Registrar and DNS Security for Small Businesses
Your domain name is the root of your business’s online identity. It decides where your email goes, what your website shows, and it proves to Microsoft 365 that your company is who it says it is. Yet many small businesses could not say who holds the registrar login — a former web designer, an ex-employee’s personal account, an agency that went out of business. Whoever controls the domain controls your email. Making sure that is you takes an afternoon.
Find out where you stand
- Identify the registrar. A public WHOIS or RDAP lookup on your domain shows which company it is registered with and when it expires.
- Find the account. Which login at that registrar owns the domain, and what email address receives its notices? If the answer is a personal Gmail or someone who no longer works with you, that is the first fix.
- Find where DNS is hosted. DNS is often hosted somewhere other than the registrar — a web host, Cloudflare, or a former IT provider. Both logins matter.
- Check the expiration date and auto-renew. Domains lapse because the renewal card expired or the reminder went to a dead inbox.
- List who has access. Everyone with a login to the registrar or DNS host can take your email offline with one change.
Lock it down
- Use a company-owned account. Register the domain in an account owned by the business, with a role address like a shared admin mailbox for notices — not a personal inbox.
- Turn on MFA at the registrar and the DNS host. These accounts are as sensitive as your email admin account, and attackers know it.
- Enable the transfer lock. A registrar lock prevents the domain from being moved to another registrar without an explicit unlock. Some registrars offer a stronger registry lock for business-critical domains, which requires manual verification for any change.
- Renew for several years with auto-renew on. Keep a current company card on file and calendar a check a month before expiration anyway.
- Store the credentials in the company password manager. So the login survives staff changes and is never kept in one person’s head.
The DNS records that keep the business running
A few DNS records do most of the work: MX records route your email, SPF, DKIM, and DMARC records protect it from spoofing (see our explainer), A and CNAME records point to your website, and TXT records verify your domain with Microsoft 365 and other services. One mistaken edit can stop email for the whole company. Treat DNS changes like any other change to a critical system: one person or provider responsible, a record of what changed and why, and an exported copy of the zone so you can put it back.
Watch for lookalike domains
Attackers register domains that differ from yours by a letter — an extra hyphen, a swapped character, a different ending — and use them to impersonate you to customers and vendors in business email compromise schemes. Registering the most obvious variations is inexpensive, and lookalike monitoring can alert you when new ones appear.
When a vendor holds your domain
It is common for a web designer or marketing agency to register a client’s domain in their own account for convenience. The domain is still your property. Ask for it to be transferred into your company account, get your DNS host login, and make domain ownership part of any future contract. Most vendors are happy to do this; the ones who are not are the reason to do it now.
If you have already lost access
If the person who holds the account will not respond, or the login is gone for good, contact the registrar’s support team directly. Registrars have ownership-recovery processes that accept proof the domain belongs to your business — formation documents, a business license, invoices showing you paid for it, or the domain in use on your company email and website for years. If the domain was transferred away without your permission, the registrar can also start a formal transfer dispute. Act quickly: a domain that lapses can be deleted and re-registered by someone else, and recovering it after that is far harder.
Get your domain under control
Equal Tech Solutions audits domain and DNS ownership as part of our cybersecurity services, and our web team manages DNS changes for the websites we build so email keeps flowing when the website changes. Contact us if you are not sure who holds the keys to your domain.