You paid for your website. You can log in and change the text, so you assume the whole thing is yours. Then a renewal notice goes to a developer who left two years ago, and one quiet morning your site and your email go dark together. The login that brings them back isn't in your hands.

This is the part of domain ownership almost no owner-operated business checks until it's an emergency. You can own every line of your site's code and still not control the address it answers to, or the records that route your email. Those are two different things. You can check who really controls yours in an afternoon. Most owners never do.

TL;DR: You never fully own a domain — you lease the right to use it, and real domain ownership comes down to two questions: whose name is on the registrar account, and who controls the DNS. Code ownership is separate. Check both before you ever need to.

You don't own your domain — you rent the right to use it

Nobody buys a domain outright. The registry that runs each extension owns the names; a registrar like Namecheap, GoDaddy or Cloudflare lets you reserve one for a set period, and you become the registrant, the party with the right to use it. The maximum you can register for at once is ten years (quape, Thompson Coburn LLP).

That sounds like pedantry until a renewal lapses. "Buy" is the wrong mental model, and it's the one that lets a domain slip away. You are a tenant on an annual lease, and the lease has a record: the WHOIS entry names the registrant and the registrar managing it. If your business is not the registrant, you are paying rent on something held in someone else's name.

Owning your code is not owning your domain

You can have full ownership of your website's code and content and still not control your domain. The two live in different places. Your code sits in a CMS or a repository; your domain lives in a registrar account; the connection between them lives in DNS. Win one, lose the others, and you have a beautiful site you cannot point anywhere.

This is the gap a senior engineer checks first. On any handoff, the question isn't whether the design is good. It's whose name is on the domain and who holds the DNS. We build conversion-first websites our clients own outright, code and content, and can take with them the day they leave. But ownership of the build is only the floor. If the address it stands on belongs to someone else, the rest is decoration. You don't own your website. You own a login to it — and you should know whose name is on that login before the day you need it.

Whose name is on the registrar account?

Open this question and most founders go quiet. A web developer or agency often registers the domain in their own account during the first build, because it's faster than waiting for the client to set one up. Unless a contract assigns it to you, they hold it — and that holding is what bites later (community reports collected by OneUpWeb and We Create Digital).

The pattern is always the same. The relationship sours, you ask to move, and the answer is a delay, a fee, or silence. The forums are full of owners locked out of their own address, unsure who registered it, watching a renewal date approach with no way to act. None of it is exotic. It's the predictable result of never asking, on day one, a single question: can I log into the registrar account myself, right now, without going through anyone? If the answer is no, that is your finding.

Why you can't just look it up anymore

A WHOIS lookup won't settle this for a European business. Since GDPR took effect on 25 May 2018, ICANN's rules redact the registrant's name and contact details from public WHOIS; what stays visible is the registrar, the status, and the creation and expiry dates (DNSimple, ICANN Registration Data Policy).

So the old trick of typing the domain into a lookup and reading off the owner no longer works the way people remember. The data still exists; registrars keep collecting it. It's just not public, and getting at it now runs through ICANN's request service for verified parties with a legitimate reason. The practical takeaway is blunt: don't try to prove control with a lookup. Prove it by logging into the account that holds the domain. Access is ownership in every way that matters. A name on a redacted record you can't reach is not.

DNS is the switch for your site and your email

DNS is where control actually lives, and it does two jobs at once. The A record points your domain at the server your website runs on; the MX records direct your email to your mail provider (Mailtrap, MX record, Wikipedia). Whoever can edit those records can move your site to a new server, and can redirect or switch off your email.

Most owners never connect this: the domain that runs your website also runs your email. Lose control of the domain and you don't just lose the site. Every address at yourco.com stops delivering, including the one you'd use to ask for the domain back. A founder who has never opened the DNS panel often discovers it the hard way, trying to add a record for a new email tool and finding they have no access to the switch their whole business runs through. The site is the visible asset. The DNS is the one that can take everything offline at once.

What happens when a domain expires

An expired domain doesn't vanish on the expiry date — it falls down a ladder that gets more expensive at each step. For most common extensions there's a grace period of up to about 45 days where a normal renewal fixes it, then a redemption period of roughly 30 days where you can still recover it but pay a restore fee on top, commonly in the €50–200 range, then a short pending-delete window, and then it's gone and anyone can register it (OpenSRS, DNSimple).

That ladder is only a problem if nobody is watching the renewal. And nobody is watching when the renewal notice lands in a freelancer's inbox who stopped reading it the day the project ended. One more wrinkle: changing the registered owner of a domain has historically triggered a 60-day lock that blocks moving it to another registrar, an anti-hijacking measure ICANN agreed in 2025 to shorten, though the change is still rolling out. The lesson holds regardless of the exact number. Sort ownership while things are calm, not in the middle of a dispute when a clock is running.

A 20-minute domain ownership audit

You can close most of this risk in one sitting. Run these five checks today, not the week you need them:

• Log into the registrar yourself. Go straight to the registrar's site and sign in to the account that holds your domain, not through your developer or a shared link. If you can't get in alone, that's the finding, and fixing it is the priority.

• Confirm the registrant is your business. Check the account's registrant or organisation field reads as your company, not a person's name or an agency. A domain registered to "Jane's Web Studio" is Jane's, contract permitting.

• Switch on auto-renew and 2FA, and use an address you control. Put the renewal on a calendar as a backstop, turn on two-factor authentication, and make sure billing and renewal notices go to a role address you own, like billing@yourco.com, never a freelancer's personal inbox.

• Open the DNS panel. Find your A record (the site) and your MX records (the email) and confirm you can see and edit them. You don't need to change anything. You need to know you could.

• Get it in writing. In any vendor contract, state that you own the domain and the DNS and that both transfer to you on request. Ownership you can't prove on paper is a favour, not a right.

None of this is glamorous, and that's the point. The few hours of admin are the trade you make to remove a single point of failure that can otherwise take your business offline overnight. The alternative, assuming someone else has it handled, costs nothing until the day it costs everything.

Your domain is the foundation everything else stands on: your website, your email, your reputation when someone types your address. We keep every client's domain, code and DNS in their own hands — and visible in the SharpOS workspace bundled with every plan — so leaving is always a choice, never a hostage situation. If you don't know who controls yours, that's the first thing worth fixing.

Plan. Build. Iterate. Book a 30-min call — get an honest read on your digital growth.