If your website disappeared tomorrow, could the business still sign in to the account that controls its domain name? Check three things first: who holds the registration, whether an authorised second person can get access, and whether recovery depends on email using that same domain.
A website login doesn't answer those questions. The domain is the name customers use to find you, but registration, DNS settings, website hosting and email may sit with different suppliers. DNS is the set of instructions that sends visitors and messages to the right services.
Draw four boxes before changing anything
For your main domain, write down:
- Registration: the registrar, whose name the domain is registered in and the renewal date.
- DNS: where the records are managed and which account can change them.
- Website: the hosting service and who can administer it.
- Email: the mail service and where its administrator signs in.
One supplier may fill all four boxes. You still need to know which account controls each part. A designer who can edit a page may have no way to renew the domain. A registrar login may allow changes that affect both the website and email.
The NCSC's domain guidance recommends keeping domain control with your organisation, protecting access and giving more than one trusted person secure access. Ask your existing supplier to establish the current arrangements before starting a transfer or changing live records.
Find the recovery dead end
Imagine Fern Workshop, a fictional joinery business. Its domain account sends password resets to an address ending in its own domain. The only person with the second authentication factor left last year. If email stops working, the usual reset route may fail at exactly the time it's needed.
Fern's useful next step is to check the registrar's supported recovery process. It needs an authorised way to prove ownership and regain access if the usual person or mailbox is unavailable. An alternative recovery address, where the registrar supports one, needs its own strong protection and business control. A private inbox belonging to the old designer would move the problem elsewhere.
Check the second person's access while the normal administrator is available. That might be a separate supported account or another arrangement the registrar provides. Enable supported MFA for the registrar and DNS accounts. Don't copy passwords or recovery codes into the four-box record. Keep them in approved secure storage, with access limited to the people who need them.
Make renewal survive a staff change
Automatic renewal is helpful only while its payment and contact details work. Check whether the saved card belongs to the business, who receives notices and whether an expired card would be noticed before the domain expires.
You can use this short question in a handover:
If the usual administrator is away for a month, who will see a renewal failure and how will they fix it?
The ICANN guide to protecting registration accounts also discusses account protection and locking arrangements. It dates from 2010. Use it for the underlying risks, then check your registrar's current instructions. Registrar and registry locks differ in availability and operation.
Decide whether an old domain can go
An old trading name can still receive invoices, forward email or appear in account recovery details. Before deciding not to renew it, search your own approved records for those uses and confirm that each dependency has moved.
Keep the domain while an important dependency remains unresolved. Consider retiring it only after the business has assessed what happens when someone else can register that name. Removing a website redirect doesn't remove every email or login dependency.
For live DNS changes, first identify the affected services, retain the current configuration securely and agree how a failed change will be reversed. Treat an unexplained request to redirect email as a reason to verify the request through an established contact route.
The four boxes are complete when they describe access the business can actually use. Finding an inaccessible registrar account is a useful result too. Resolve that gap before relying on a website supplier's reassurance that everything is covered.