What It Actually Means
It is worth thinking of as a lease on the most important piece of property your business has online, because everything else depends on it: the website, every email address, every login that uses one, every link anybody has ever shared.
The Check Worth Doing Today
Whose account is it registered in, and who receives the renewal notice?
An uncomfortable number of businesses cannot answer. The domain was registered years ago by a developer, an agency, or an employee who has left, in their own account, on their own card, with notices going to an address nobody monitors.
That is fine until it is not, and the situations where it stops being fine are ordinary: a relationship ends badly, a supplier goes out of business, a card expires, or nobody sees the renewal email.
The consequences are severe out of proportion to the cause. An expired domain takes down the website and, more damagingly, every email address. Recovery is possible during a grace period and gets rapidly more expensive and less certain after it. Domains that lapse fully can be picked up by someone else within minutes, and there is frequently no route back.
What Should Be True
The domain registered in an account your business controls, in the business’s name, with billing on a company card that is not close to expiry.
Renewal notices going to a monitored address, ideally a shared one rather than an individual’s. Auto-renew switched on, and checked once a year rather than assumed.
Two-factor authentication on the registrar account, because whoever controls the domain controls your email, and whoever controls your email can reset most of your other passwords. This is the single account most worth protecting properly.
Registrar lock enabled, which prevents transfers away without an explicit unlock.
The Related Trap
Your domain is where your email lives. Losing control of it means losing control of email, which is the recovery route for nearly everything else.
That makes the sequence clear: secure the registrar account first, then email, then everything else. Businesses frequently harden a dozen applications while the domain sits in an account with a shared password and no second factor.
What To Ask
- Which account holds the domain, and do we have the login? If a supplier holds it, ask to be made the registrant.
- When does it renew, and who gets the notice?
- Is auto-renew on, and is the card valid?
- Is two-factor authentication on the registrar account?
- Do we hold the common variations? The obvious misspellings and the .co.uk and .com pair, if both matter.
When You Are Moving Away From A Supplier
Sort this before the relationship ends rather than during.
Transferring a domain requires cooperation from whoever currently controls it, and cooperation is easier to obtain while things are amicable. A supplier holding your domain during a dispute holds your website and your email, and no contract resolves that quickly enough to matter.
It is a fifteen-minute job at any calm moment and a serious problem at the wrong one.
More terms are in the glossary.
