Who actually owns your domain, and how to check in two minutes

A domain has a registrant: the legal person it belongs to. It also has an administrative contact, a technical contact, a registrar holding the record, and quite often somebody who pays the invoice. Those can all be different, and only the first one is ownership.

This matters for exactly one reason. When you want to move a domain — to a new registrar, a new host, or out of a relationship that has ended — the registrant is who has the right to authorise it. If that is somebody else, you are asking rather than instructing.

How to check, right now

Registration data is public, through a protocol called RDAP (the modern replacement for WHOIS). You do not need an account or a tool:

If a terminal is not your thing, lookup.icann.org does the same thing in a browser. What you are looking for:

• Registrar — the company holding the record. This should be a company you recognise, ideally one you have an account with.
• Registrant — the owner. Often redacted for privacy, which is normal and not itself a problem.
• Creation and expiry dates — the expiry is the one worth putting in a calendar.
• Status codes — clientTransferProhibited and similar, explained below.

The registrant being redacted is expected: after GDPR, registrars withhold personal data from public output. The question is not whether you can see the name publicly, it is whether you can see it when logged into the registrar's own account — and whether that account is yours.

The test that actually settles it

Public records tell you the registrar. Only one thing tells you whether the domain is yours: log into that registrar directly, with credentials in your own name, and find the domain in your account. Not your web designer's account with access shared to you. Not a reseller panel. The registrar's own site.

If you cannot do that, you do not control the domain, regardless of who has been paying for it. That is the whole test, and it takes two minutes to fail.

An invoice is not evidence of ownership. Paying somebody to register a domain for you, with no written agreement that you are the registrant, leaves them holding an asset you depend on. That is a contract problem rather than a technical one, and it cannot be fixed afterwards without their cooperation.

The free domain that comes with hosting

Website builders and hosts frequently include a domain with an annual plan. Sometimes that is a genuine registration in your name. Sometimes the domain is registered to the provider, and you have a licence to use it while you remain a customer.

The second kind is not a scam — it is usually disclosed somewhere in the terms — but it changes what you are buying. It means leaving the host means leaving the domain, which means leaving your email addresses and every link anyone has ever shared. For a business whose address is printed on invoices and vehicles, that is a far larger switching cost than the monthly fee suggests.

Check before you need to know. The RDAP lookup above shows the registrar; if it is the hosting company rather than a registrar you chose, read their terms on what happens to the domain when the plan ends.

Transfer locks, and the ones that are protecting you

Status codes in the RDAP output describe what the domain will and will not allow:

• clientTransferProhibited — a lock you can turn off in the registrar panel. It is on by default and should stay on; it is what stops somebody who gets into your account from moving the domain away. Turn it off only for the hour you are actually transferring.
• clientHold — the domain is not resolving at all. Usually non-payment or a failed contact verification. This is the state where the website and the email both simply stop.
• pendingDelete — the expiry was missed and the grace periods have run out. Recovery from here is expensive if it is possible at all.
• serverTransferProhibited — set by the registry rather than the registrar, often after a recent transfer or a dispute.

There is also a rule nobody mentions until it bites: after a transfer between registrars, and after certain changes to the registrant details, ICANN imposes a 60-day lock during which the domain cannot be transferred again. If you are planning a move, do it before you need to and not during a crisis.

What a transfer actually involves

Moving a domain between registrars is four steps, and the gaining registrar drives most of it:

1. Unlock the domain at the current registrar.
2. Obtain the authorisation code — variously called the auth code, EPP code or transfer key.
3. Start the transfer at the new registrar and pay, which normally extends the registration by a year rather than charging for nothing.
4. Approve the confirmation email, which goes to the registrant address on record. This is the step that fails when that address is an old mailbox nobody can open.

The thing to do before starting: write down every DNS record you currently have. A transfer can change which nameservers are authoritative, and a zone that does not come with you means the website and the mail both stop on a day of your own choosing. The records a small business needs is a reasonable checklist of what to capture.

Two things worth doing today

First, check the registrant email address on the domain and confirm you can read it. It is the address that receives transfer approvals, expiry warnings and the annual verification notice that triggers clientHold if ignored. An address on a domain that has since moved, or a departed employee's mailbox, is a time bomb with a date on it.

Second, put the expiry date in a calendar with a reminder a month out, independently of the registrar's own emails. Auto-renew fails when a card expires, and the notice about it goes to the address above.