Who Owns Your Domain? Check Before Your Designer Leaves

A domain is not something you buy once. It is a registration, held in someone’s name, that has to be renewed, and the name on it decides who can move it, renew it or let it lapse. We wrote this page because the question is cheap to answer while the designer is still answering email and expensive after they stop. If you are already past that point, start with Your Web Developer Disappeared, which covers recovering the domain, the hosting and the WordPress login in order; this page is the check you do before that day, and the three neighbors listed at the end cover the scams, the email and the moves that come with owning a domain.

What "owner" means for a domain

ICANN’s pages do not use the word owner. They use registrant, and they give the registrant the responsibilities and the authority. ICANN’s list of registrants’ responsibilities says the registrant takes sole responsibility for registering and using the domain, keeps contact information accurate and up to date, keeps payment information current if automatic renewal is used, and responds to the registrar’s inquiries within 15 days³. The transfer policy names the party listed on the record the Registered Name Holder, and says that the Registered Name Holder and the Administrative Contact are the only parties with the authority to approve or deny a transfer; where they disagree, the Registered Name Holder’s authority supersedes the administrative contact’s.

For a business, the practical reading is short. Whoever is the registrant on the record is the one the system treats as holding the name. If that is the business, the business controls the domain. If it is a designer, a former employee or a hosting company, they do.

Look it up in five minutes

ICANN runs a free public lookup, lookup.icann.org. Its updated version, launched in 2019, uses RDAP, the protocol the IETF developed as an eventual replacement for WHOIS, and each query also shows the raw data from the registrar and the registry operator⁴. To use it:

1. Type your domain, with no www. The tool returns the registration data it can find.
2. Read the registrar first. The registrar is the company where the registration lives, and its name tells you where a password reset or a transfer request has to go.
3. Read the dates. The record carries a creation date and an expiry date; the transfer policy refers to the creation date shown in the registry record.
4. Read the registrant, if it is shown. Per ICANN, results containing personal data associated with the domain may be redacted for privacy, and redaction can vary across registrars and registry operators. A redacted name is not an empty one; the redaction hides the data from the public result, not from the registration.
5. Check that the email on the record is one you read. Registrars must send the registrant expiry notices by a method that needs no action to receive, such as email.

If the registrant is redacted and you do not know the registrar’s account, ask the designer in writing which registrar holds the domain, in whose name, and under what email. The answer, or the lack of one, is information.

The roles on a record

Four roles come up when you look at a domain. ICANN’s documents define the first three; the fourth is how it works in practice.

The login holder is the one most owners forget. The registrant on the record can be you while the registrar account sits under the designer’s email, which means a transfer or a renewal has to go through them, or through the registrar’s identity process. When we check a domain, we check both rows.

The common failure: the designer is the registrant

Designers register domains for clients because it is quick: they have a registrar account, they enter their own details, and the site goes live. The domain works, the site works, and nothing signals that the registrant is wrong until one of four things happens: the designer stops answering, the card on the account expires, the relationship ends badly, or the designer closes the business.

The consequence is in the policy. At expiry, the party eligible to renew is the registered name holder immediately before the expiry. If that is the designer, you cannot renew on your own. And a transfer to a registrar account of your own needs the registrant’s authorization code.

Fixing it while you can

The fix is a change of registrant, or a transfer, and the order matters because of one rule.

1. Ask in writing for the change of registrant. Ask the designer to change the registrant to the business’s legal name and an email address the business controls, or to transfer the domain to a registrar account in the business’s name. Date the request.
2. Know what counts as a change. ICANN defines a Change of Registrant as a material change to the prior registrant’s name, organization or email address, or to the administrative contact’s email address if there is no registrant email. A fix for a typo is not material; a change of name together with an address or phone change is.
3. Plan the 60 days. The registrar must impose a 60-day inter-registrar transfer lock after a Change of Registrant¹. The registrar may let the registrant opt out of the lock, but only before the change request, and the policy advises the prior registrant to request any transfer before the change to avoid the lock. If you want the domain at a different registrar as well, ask for the transfer first, or ask the registrar about the opt-out.
4. Get the authorization code. The registrar must provide the code, and remove the transfer lock where it has no self-service tool, within five calendar days of the registrant’s request¹.
5. Start the transfer from the gaining registrar. If the losing registrar does not respond within five calendar days to the registry’s notification of a transfer request, the transfer is approved by default¹.
6. Do not let a money dispute hold it. A registrar may not deny a transfer for nonpayment of a pending or future registration period, and may not use the transfer process as a way to secure payment, except for nonpayment of a previous period or the current period under the conditions the policy sets out.

The policy protects the registrant on the record. If the designer is the registrant and will not act, these rights are theirs, not yours, and what remains is the registrar’s own dispute process and, where money or rights are at stake, a licensed professional’s advice on your own case.

When the domain expires

An expired domain is not an immediately lost one. ICANN’s Expired Registration Recovery Policy sets a floor for what a registrar must do:

• Notices before expiry. The registrar must notify the registrant at least twice, about one month and about one week before expiry, and send at least one more notice if the registration is not renewed or deleted within five days after it expires².
• Renewal after expiry. The registrar must let the registrant renew during the expiry and interruption period, and must restore the domain’s DNS immediately or as soon as is commercially reasonable after renewal. Registrars may delete a registration at any time after it expires, so waiting is a risk.
• The site goes dark first. Where the registry permits, the registrar interrupts DNS resolution from the expiry until deletion, or for at least the last eight consecutive days the holder can still renew; a page shown to visitors while the name is renewable must conspicuously indicate the expiry and give renewal instructions².
• The redemption period. Generic top-level domain registries, except sponsored ones, must offer a 30-day Redemption Grace Period right after deletion, in which DNS is disabled and transfers are blocked, and registrars must let the former holder redeem the name where the registry offers it².
• Fees must be visible. Renewal, post-expiration renewal and redemption fees must be clearly displayed on the registrar’s website.

The policy has applied since August 31, 2013, and ICANN’s page notes an update published on February 21, 2024². Renewal comes first; redemption fees are listed separately on the registrar’s site, and each period ends. If you see your site disappear, check the expiry date in the lookup before anything else.

Renewals and auto-renew

Renewal is where ownership turns into a dated obligation. Three habits cover most of it:

• Turn on auto-renew, with your card. ICANN’s responsibilities for registrants include keeping payment information current if you use automatic renewal. An expired card is one way for a domain to lapse even with auto-renew on.
• Put the renewal date where you will see it. The two notices the policy requires go to the registrant’s email², so that address has to be one that a person reads.
• Keep the contact data accurate. ICANN lists accurate, current contact information among the registrant’s responsibilities. The email on the record is how the registrar reaches you, and the registrar’s inquiries have to be answered within 15 days³.

Notices that arrive from companies you do not recognize are a separate subject, covered in Fake Domain Renewal Notices.

A checklist before you sign with any designer

Put these in the contract or the first email, and ask for the answers in writing:

1. The domain is registered in the business’s legal name, with an email address the business controls.
2. The registrar account is the business’s own, or the business has the login.
3. The designer, if listed at all, is a secondary contact, never the registrant.
4. Auto-renew is on and the card is the business’s.
5. The business is given the renewal date and the registrar’s name.
6. On the day the work ends, the designer hands over any account that was theirs.
7. A designer who hosts the site also hands over a full backup on request.

Fifteen Questions to Ask a Web Designer goes through the same ground for the rest of the contract.

What we do about it

We register every client’s domain in the client’s name, with an email address the client controls, so the question on this page does not arise at the end. A site can outlive the relationship with the designer who built it, and the domain has to outlive both. We keep the registrar, the renewal date and the backup location on the one page the owner holds. For a new client, the first hour is this check, and when the domain is in someone else’s name we say so on day one and fix it before the build, not after. The service is website management.

When to get help

If the domain is in your name and you can log in, you do not need us; the checklist above is enough. If the designer is the registrant and has gone quiet, if the domain is about to expire in someone else’s name, or if the registrar will not move, get help early, because the periods after expiry end. The consultation is free. For a dispute over who is entitled to the name, ask a licensed professional about your own case.

Frequently Asked Questions

How do I find out who owns my domain?

Use ICANN’s lookup at lookup.icann.org, which queries registration data using RDAP and also shows the raw registrar and registry data. The registrant’s personal data may be redacted, in which case the registrar named in the result is where to ask.

Is the person who paid for the domain the owner?

Not on the record. ICANN’s transfer policy gives authority to the Registered Name Holder, the party on the record, and to the administrative contact for transfers. Payment is a separate matter from registration.

Can my designer refuse to transfer my domain?

If the designer is the registrant, the authorization code and the transfer approval are theirs to give, and the policy requires the registrar to provide the code within five calendar days of the registrant’s request¹. If you are the registrant, the registrar must give you the code within the same period, and a transfer may not be denied for nonpayment of a future period.

How long is a domain locked after I change the registrant?

The registrar must impose a 60-day inter-registrar transfer lock after a Change of Registrant, unless the registrant opted out before the request¹.

What happens if my domain expires?

The registrar must notify the registrant before and after expiry, must let the registrant renew during the expiry period, and may delete the name at any time after expiry. A deleted name enters a 30-day redemption period in most generic top-level domains².

Does hiding my name in the lookup mean I have no registrant?

No. Redaction hides personal data in the public result; the registration itself, and the registrant on it, remain.

Sources