Short answer: legally, a domain belongs to whoever registered it, meaning the person or company entered as the registrant at registration. Not to whoever pays the invoices, and not to whoever holds the login to the panel. If a friend, a business partner or an IT contractor "on the side" registered the domain in their own name, then legally it is theirs, even if the money has been leaving the company account for fifteen years. Checking takes five minutes. Unpicking it can take months, and sometimes ends with losing the domain.
The problem is always the same
The previous IT person or the company that looked after the domain usually does one of three things:
- Hands the client a login and password to the panel. The client thinks they have been given the domain. They have only been given access to the settings.
- Keeps the domain on their own bulk account, together with the domains of all their other clients. They will not give anyone the password to that account, because other people's domains sit there too.
- Sets up a separate account for the domain but enters their own details on it. The client's company is given only as the invoicing details. So the invoices arrive in your company's name and everything looks right, while the owner of the domain is still whoever registered it: a friend or the company that looks after you.
In each of these cases the registrant is them, not the company that pays for the domain.
The trouble shows up when the domain has to be handed over. Technically it is a few clicks, but two sides have to make them. The predecessor clicks a link in an email to agree to the change of registrant or to the transfer. The people who now look after the website click their own confirmation that they are taking it over. It is enough for one side not to find the email, not to know which link is meant, or to click too late, and the domain stays where it is.
I have already had ten such cases this year
It always looks the same. I take over a website from a typical "IT guy" who has been tied to the company for twenty years, or from a firm that kept the domain on its own side.
The IT guy is reluctant to lose the client, because the domain is what ties him to them. He has to hand it over anyway, because he can see where things are heading. So he hands it over, but clumsily. He does not click the links that arrive in his inbox. Or the change of registrant itself turns out to be awkward, because it needs printed forms, signatures and stamps. That depends on the company the domain is kept with.
I often meet goodwill. What is missing is know-how. The domain registry asks for confirmations and so does the operator, and the right links in the emails have to be clicked within 48 hours. Someone who does not know what to look for in their inbox will simply miss the deadline.
A worse example: my own
When I was 15, I registered a domain for a vet who is very popular today. And I made this beginner's mistake myself: I registered it to my teenage address at the free email service tlen.pl.
Years later the operator holding the domain raised its price by 500 percent, so I was moving it to a cheaper one. For the transfer and for the change of registrant, the confirmation link arrived at exactly that old address.
Now think what would have happened if I no longer had access to it.
A disaster. A company loses its main domain because of a schoolboy error. Literally a schoolboy error, because I was still at school. Those were the early days of the internet and we were all still learning.
Sometimes there is no bad faith in it
A recent case: a company changes its IT provider. Everything goes normally until the domain has to be taken over. It turns out it is registered to the previous company, not to the client. They registered it quickly so the website would be ready on time, on their own account, because that was five minutes more convenient.
The result is the same as with bad faith: nothing can be done without the predecessor's involvement.
And when a company changes its IT provider, even helpful people from the previous one can trip up. Nobody does such transfers every day, and you do not always remember every step.
Why this hurts more than it seems
Far more than a website hangs on a domain: all the company email, addresses on invoices and business cards, accounts in services registered with those addresses, search rankings, the Google business profile. A domain is the company's identity on the internet, not "the website address".
The worst scenario is not malicious at all. The renewal reminder goes to the private address of someone who left the company long ago. Nobody reads it. The domain expires. On Monday morning, email stops working.
What an honest contractor should do
This is the part I would like people in my own industry to see too.
Register the domain to the client from the outset. Their details as registrant, their company contact address, their account, even if the contractor does the clicking and invoices for it. It takes five minutes longer and closes the subject for good.
Registering a domain "to yourself, because it is quicker" is explained only by haste while selling a website. It is also sometimes a deliberate hook: a client whose domain sits with the contractor finds it harder to leave. That is not technical convenience, it is shifting risk onto the client.
I do the opposite. The domain is registered to the client, in their name, and I hold only as much access as I need to look after it. When a client leaves me, they do not have to recover anything.
Check your own situation in five minutes
- Enter your domain in a WHOIS lookup. For
.pldomains it is run by the NASK registry. You will see when the domain expires, which operator maintains it and whether the registrant is a company or a private individual. WHOIS usually does not show the registrant's name. - Ask the operator who exactly the registrant is. Only the operator can confirm it. If you have your own account with the operator, the registrant details are in the panel. If you only have a login someone emailed you once, or nothing at all, ask whoever runs the domain for a screenshot of the registrant details.
- Check which email address the renewal reminders go to. If nobody in the company can reach it, you have a problem, you just do not know it yet.
- Put the expiry date in the company calendar, not in one person's head.
If WHOIS shows a private individual on a company's domain, or the registrant details show somebody else's name or another company, fix it now. Not next year.
How it gets straightened out
When there is goodwill, there are two routes. Both need a click from the predecessor.
- Change of registrant. The company's details are entered in the panel as the new registrant. The current registrant gets an email with a link and clicks it. Some operators also ask for a form with signatures and stamps from both sides.
- Transfer to your own account. The predecessor provides the
authinfocode, and the new side orders the transfer with it at their own operator. The confirmation also arrives by email with a link.
The whole thing usually takes a few days. What matters most is that the predecessor knows which email to look for and clicks straight away, because they usually have 48 hours to do it.
Two notes from practice.
A transfer alone does not change the owner. I had a case where, after a transfer with the authinfo code, the registrant was still the same person. The domain had changed operator, not owner. The registrant details then have to be changed, carefully, at the new operator.
Sometimes it is quicker to stay with the same operator for a moment. That is how I recovered a domain for one company. I quickly opened an account in the client's name at the same company where the domain was sitting. After that, a change of registrant from one account to the other, inside a single operator, was enough. Only from there, with the correct owner in place, did I transfer the domain to a cheaper company.
When there is no goodwill, it starts with talking and negotiating. Court is the last resort: it takes long, costs a lot and guarantees nothing.
When contact is lost completely and the domain is expiring, the most important thing is that it gets paid for, even by the current registrant. Expiry is worse than the wrong registrant. Expiring domains with history are snapped up by bots seconds after they are released, and buying such a domain back can cost many times its value, if it is possible at all.
How I help
I establish the facts: who the registrant is, when the domain expires, where the notifications go. I run the change of registrant and the transfer into the company's name, including when the person on the other side does not know where to click. Along the way I tidy up the costs, because such moves usually reveal how much was going on surcharges nobody needed. I take those apart in a separate article: how registrars milk you on domains.
Not sure whose name your domain is in? Write to me with the address. I will check who formally controls it, when it expires and what to do to bring it back to the company. I charge nothing for the check, and if everything is in order, I will simply say so.
Frequently asked questions
I have the login and password to the domain panel. Am I the owner? No. The panel gives technical control. Legally the domain belongs to the registrant, meaning whoever registered it in their own name. Changing the registrant requires their confirmation.
I pay the invoices for the domain. Does that make it mine? No. What counts is who is entered as the registrant, not whose account the payment came from. That also holds when the invoices are issued to your company.
My contractor keeps my domain on their account together with other clients' domains. Can they hand it over? Yes. They will not give you the password to that account, but they can put the domain in your company's name or provide the code to transfer it to your own account. In both cases they have to click a confirmation in an email.
Does a change of registrant need a paper contract? It depends on the company that keeps the domain. With some, clicking a link in an email is enough. Others ask for a printed form with signatures and stamps from both sides.
The contractor has vanished and the domain expires in two weeks. What now? First make sure it gets paid for, even by them. An expired domain with history disappears within seconds. In parallel, chase contact and prepare the change of registrant.
I am commissioning a website. What should I ask to avoid this problem? One sentence in an email: "please register the domain in my company's name, as the registrant". If the contractor hedges, that is an answer in itself.