Own your domain registration

The web designer who built your site five years ago has stopped answering email. The domain renews in March.

That's the version people notice. The quieter version is that everything is fine, the designer is perfectly nice, and you simply have no idea whose account your domain is sitting in — which means you also have no idea what happens if they retire, sell the business, or lose a password.

Your domain is not a line item on a website invoice. It's the root of trust for your entire business online, and it should be in an account you control.

What the registrar account actually controls

Whoever can log in to your registrar can, without asking you:

Point your website anywhere. The A record is theirs to change.
Redirect your email. Change the MX records and every message customers send you goes somewhere else. You get no bounce, no error, no signal at all — just silence and a sales slump nobody can explain.
Reset your passwords. Almost every service you use sends account recovery to an email address at your domain. Control the mail flow, control the accounts. Your bank, your payment processor, your hosting, your accounting software.
Prove they're you. Certificate authorities validate domain ownership through DNS records or an email to the domain. Control the DNS, get a valid certificate for your name.
Let it expire. Which is the one that actually happens most.

That's not a vendor relationship. That's a key to the building.

Finding out who really holds it

WHOIS is where people start, and it's the wrong place to stop. Privacy protection — which is on by default at most registrars now — replaces the contact details with the proxy service's own. Even where you can see a name, the name on the record is not the same thing as the credentials that open the account. A domain can list you as registrant while living entirely inside your designer's dashboard, on their credit card, tied to their email.

The only question that matters is: can you log in right now? Not "can you email someone who can." Go and try it. If you can't produce a username, a password, and the account's registered email address, you don't hold your domain, whatever the paperwork says.

Two other things worth checking while you're in there. Whether auto-renew is on. And what address the renewal notices go to — because if the registrant email is you@yourdomain.com, and the domain lapses, the warnings about the lapse are being delivered to a mailbox that stopped existing when the domain did.

Here's the order that catches people

Say you get access, or the designer hands it over. The instinct — everybody's instinct — is to immediately update the registrant contact details to your own name and your own email. It feels like the responsible first step.

Do that and you may not be able to move the domain for the next sixty days.

Changing the registrant contact is treated as a change of ownership, and registrars commonly apply a 60-day transfer lock afterward. Some let you opt out of it, but only if you choose to opt out before you make the change — you cannot go back and remove it once it's applied. So the natural sequence, contact details first and transfer later, locks you into the exact account you were trying to leave, for two months, at the moment relations with the outgoing vendor are least warm.

The right order is the counterintuitive one: transfer first, tidy up second. Unlock the domain, get the authorization code, move it into your own registrar account, and only once it's landed do you correct the contact details. There is also a 60-day lock after any transfer, so plan on the domain staying put for a while either way — but it will be sitting still in your account rather than someone else's.

What to do

Log in to your registrar. If you can't, that's your answer, and the task is recovery rather than housekeeping.
Open a registrar account in the business's name, paid on the business's card, with an email address that does not depend on the domain itself.
Unlock the domain at the old registrar and request the authorization code. Watch for the transfer confirmation — it goes to the registrant address on file.
Transfer it. Then fix the contact details, enable auto-renew, and turn on two-factor authentication.
Give the account credentials to exactly one more person who isn't you.

You can change web designers, hosts, and mail providers without much drama. You cannot easily change who holds your domain if they decide not to cooperate — so that's the one thing you make sure of first.

If you don't know where your domain lives and would rather someone worked it out and moved it properly, start here.