Who owns your domain name? A one-hour check for small businesses

Your domain name is the address of your website and, usually, of your email too. If you lose control of it, customers land on someone else's page and your inbox goes quiet. Yet for many small businesses the domain is the least looked-after asset they own. It was bought years ago by a web designer, a cousin or an ex-employee, and nobody has logged in since.

This post covers who should own your domain, what the National Cyber Security Centre (NCSC) says about protecting it, and how to spot the fake renewal emails that arrive in a steady trickle. None of it needs technical skill. It needs about an hour and a few honest answers.

Why the registrar account is the weak point

A registrar is the company you pay to hold your domain. The NCSC's advisory on DNS hijacking, first published in July 2019 and still hosted on its site, is blunt about where attacks usually land: "The most common DNS hijacking takes place at the registrar level, simply by gaining unauthorised access to a registrant's account."

The NCSC lists the familiar ways those accounts are taken over:

• Phishing, where a convincing message tricks someone into typing their password into a fake page.
• Credential stuffing, where passwords leaked from other websites are tried against your account.
• Social engineering, where someone persuades a person (or a support desk) to hand over access.

The consequences it describes range from a defaced or offline website to attackers creating phishing pages inside your own domain, or redirecting traffic so they can intercept log-ins. In the worst case, the NCSC says, an organisation "may lose total control of their domain" because attackers often change the ownership details, which makes recovery harder.

The NCSC also published guidance for registrars themselves in March 2025. Help Net Security's summary says it asks registrars to offer multi-factor authentication and change detection and notification, so customers hear when something about their domain changes. That is aimed at the industry, but it tells you what to look for when choosing or reviewing a provider.

Who is the registrant?

The registrant is the legal owner of the domain. It should be your business, not a person. A common trap is a domain registered in a freelancer's name or on a personal email address, with the relationship long since ended.

The NCSC makes the same point. Domain registrations typically have four contacts: registrant, technical, administrative and billing. It recommends you make sure all of them are up to date, because details are "often overlooked when organisations grow, shrink, move, or are acquired", and a registrar may send certain messages to only one of those roles. It also notes that in some disputes the registrant contact usually takes precedence.

It specifically advises against using individuals' email addresses for domain contacts, as that gives effective control to someone who may leave or be absent. Its suggestion is a role account such as hostmaster@ that goes to the right people and is itself kept secure.

A one-hour domain audit

Work through these in order. Finding out which company holds your domain is often the hardest part; your latest website invoice is a good place to begin.

• Find the account. Know which registrar holds each domain you own, including old ones you no longer use but would not want a stranger to buy.
• Check who can log in. The NCSC advises regularly auditing who can access the registrar control panel and make changes. Remove anyone who has left.
• Put the business in charge. Registrant name should be your company. Contacts should be role addresses, not a former colleague's inbox.
• Switch on multi-factor authentication. The NCSC says to follow its password guidance and to deploy multi-factor authentication (MFA) when it is available. Use a strong, unique password in a password manager as well.
• Turn on the lock. More on this below.
• Keep evidence. If a domain is fully hijacked you will need to appeal to the registry. The NCSC says to keep extensive records that prove ownership, such as invoices, registration emails and screenshots of your settings.

Locks and monitoring

For .uk domains, the NCSC points to a Nominet service called Domain Lock. According to the advisory it prevents the nameservers being changed, prevents the registrant or contact details being changed, and prevents the domain being transferred to another registrar. Ask your registrar whether they support it and how to switch it on. Some registrars offer their own "registrar lock", which the NCSC describes as preventing a transfer to a new owner until the lock is removed. Check which protection your provider actually gives you, because the two are not identical.

The NCSC also suggests that for a critical domain you consider monitoring for domain transfers, changes to the registration data and nameserver changes, and for changes to records for key services such as MX records, which control where your email is delivered. Your registrar or DNS provider may offer this. If yours does not, a simple habit helps: once a quarter, log in and look at the nameservers and email records, and compare them with a screenshot you saved earlier.

That habit matters because attacks are not always loud. The NCSC explains that an attacker who controls your DNS can quietly point a service such as your webmail address at their own server and capture log-ins, while your site looks normal.

What practitioners say

On Hacker News, a developer shared a post-mortem after their domain's nameservers were changed without their say-so and their production site went down. Their advice was to check DNS early, enable two-factor authentication, monitor for DNS changes, keep screenshots of your settings and not to trust your registrar completely. Other commenters argued about whether keeping your registrar and DNS provider separate helps or just doubles your exposure, and some pointed out that a transfer lock would not have stopped a nameserver change. That last point is useful: a transfer lock and a lock that also covers nameservers are different things, which is why it is worth reading what your provider's lock actually covers. The mood was frustrated, with several people unhappy at how support handled it.

Fake renewal and "protection" emails

The other risk is a bill that should never be paid. In January 2026 the registrar Blacknight warned its customers about unsolicited emails sent by scammers rather than by any reputable registrar. They come in two forms: fake renewal invoices claiming your domain is about to expire, and warnings that someone else wants a similar domain name, urging you to pay for "protection".

Blacknight lists the red flags:

• The sender is not your actual registrar.
• The price is inflated. Its example was a charge of €89 for a one-year .ie renewal.
• The domain is not actually due for renewal.
• The email claims an interested buyer is based in China or elsewhere in Asia.
• There is false urgency. As the post puts it, "Scammers rely on panic, not accuracy."

Its advice is simple: do not reply, click links or pay from an unsolicited notice. Open your registrar's website yourself by typing the address into your browser, log in, and check the real status of your domain. Blacknight notes scammers may gather your address from public sources such as your website contact page.

The NCSC lists phishing as one of the main ways registrar accounts are compromised, so never log in through a link in an email you did not expect.

What to do this week

• Write down every domain you own, its registrar, its expiry date and who the registrant is.
• Change registrant and contact details to the business and a role email address if they point to a person.
• Turn on multi-factor authentication and set a unique password on the registrar account.
• Ask your provider about Domain Lock or an equivalent, and note exactly what it covers.
• Take dated screenshots of your nameserver and email settings and store them somewhere safe.
• Tell whoever handles invoices that renewal notices only count if they come from your real registrar, and that anything else goes to you first.

If your website was built by an agency, ask them in writing who owns the domain and hosting accounts, and make sure you hold the log-ins. Our cloud and security work often starts with exactly this tidy-up, and it is far cheaper to do before something goes wrong than after.