Who actually owns your domain?

Your domain is the part of your business that everything else depends on. It carries your website and your email, and every account that sends a password reset to that email relies on it as well. It is also the part most often registered in someone else's name.

It usually happens with the best of intentions, when a web designer, an agency or a helpful friend registers the domain under their own account to save time and nobody thinks about it again. Years later that person moves on or stops replying, and the business discovers that it doesn't control its own address.

Check who the registrant is

Log in to the account at your registrar, which is the company you pay to keep the domain. Public lookup tools now hide most owner details, so the registrar account is the only reliable place to check. The registrant, meaning the legal owner, should be you or your business.

Look at the email address on the account as well. It should be an address you control, and ideally it should sit on a different domain from the one you're checking. That way, if the domain ever stops working, you can still receive the messages you need to fix it.

If you can't log in at all, start the recovery process now. Registrars can return a domain to its rightful owner, but they ask for proof, and that proof is much easier to gather on a quiet day than in the middle of an outage.

Turn on two protective settings

• Auto-renew renews the domain automatically. Pair it with a payment card that won't expire soon, since a lapsed domain can be registered by anyone once it is released.
• Registrar lock, sometimes called transfer lock, prevents anyone from moving the domain to another registrar without your approval.

The rules for .ca domains

Anyone who registers a .ca domain must meet CIRA's Canadian Presence Requirements. Canadian citizens, permanent residents and Canadian businesses all qualify, along with several other groups. CIRA audits registrations from time to time, and when it can't confirm that a registrant is eligible, it can ask the registrar for proof. That is one more reason the registrant should be you rather than a contractor.

Check your email records while you're logged in

Your domain's DNS settings also decide whether other mail servers trust your email. Look for three records called SPF, DKIM and DMARC. Gmail and Yahoo require every sender to use at least SPF or DKIM, and anyone who sends email in bulk must meet stricter rules. If none of the three records exist, setting them up should be your next job.

A worked example

Consider a two-person landscaping company whose domain was registered by the freelancer who built its first website. Three years later the freelancer has moved on, the domain renews on the freelancer's credit card, and that card expires in March. In April the domain lapses, the website goes offline and email stops arriving. Every password reset for the bank, the accounting software and the social media accounts goes to that inbox, so the owners struggle to get into anything else either.

Repairing the damage in April means proving ownership to a registrar while the business is offline. Preventing it takes a single afternoon, during which the freelancer moves the domain into an account in the company's name and the owners switch on auto-renew with their own card.

How to move a domain into your own name

There are two common routes, and the right one depends on who holds the account today.

1. Change the registrant at the same registrar. If the current holder is cooperative, they can update the registrant details to your business or move the domain into an account that you own at the same company.
2. Transfer the domain to your own registrar account. The current holder unlocks the domain and sends you its authorization code, which some registrars call an EPP code. You start the transfer at your registrar, confirm it by email, and the move completes after a short waiting period.

Whichever route you take, keep invoices or emails that show your business has been using the domain. If the person holding it refuses to cooperate, the registrar will ask to see that evidence.

Common mistakes

• Using an address on the same domain as the registrar login, which leaves you unable to receive the recovery email if the domain lapses.
• Letting an employee's personal email own the account, so that your access leaves with them.
• Switching off auto-renew to save a little money, when a domain costs very little to keep and a great deal to lose.
• Assuming that your web host and your registrar are the same company, when they often are not.
• Leaving the registrar account without two-step login, even though it is one of the most valuable accounts your business has.

A short checklist

1. Log in to your registrar and confirm that the registrant is you or your business.
2. Make sure the account email is an address you control on a different domain.
3. Turn on auto-renew and registrar lock, and update the card on file.
4. Confirm that SPF, DKIM and DMARC records exist for your domain.

Frequently asked questions

Is a .ca or a .com domain better?

Both work well for a Canadian business. A .ca signals that you are Canadian and requires you to meet CIRA's eligibility rules, while a .com is recognized everywhere. Many businesses register both and point one at the other, so that customers find them whichever one they type.

What is WHOIS privacy, and do I need it?

WHOIS privacy hides the registrant's personal contact details from public lookup tools. It is useful if you work from home and would rather not publish your address, but it does not change who owns the domain.

What if my former web designer won't hand the domain over?

Contact the registrar and share your evidence that the business has been using the domain. If the dispute continues, a lawyer can explain your options, and you will have more of them the earlier you start.