Notes
Check who owns your domain. It takes about fifteen minutes.
You do not need to ask anyone, and you do not have to take anyone’s word for it. Almost all of this is publicly readable.
The uncomfortable part of a website ownership question is usually that asking it out loud feels like an accusation. It is not, and in any case you mostly do not have to. Domain records are public by design, DNS is public by necessity, and the rest is visible from inside accounts you already hold.
Work down this list in order. Write the answers somewhere permanent, with the date. The goal is not to catch anyone. It is to replace an assumption with a fact, once, so you never have to wonder again.
Step 1. Find out who your registrar is
The registrar is the company the domain is rented from. This is the single most important fact on the page, because whoever controls the registrar account controls where your website and your email point, and can move both in minutes.
Go to ICANN’s public lookup at lookup.icann.org and enter your domain. You want three fields from the result.
- Registrar. The company holding the registration. Note the name exactly.
- Registry expiration date. When the domain lapses if nobody renews it. Put it in a calendar today.
- Registrant organisation and email, if they are shown. Frequently they are not, and the next step explains why.
Step 2. Try to log in yourself
Go to the registrar you just identified and use the password reset flow with your own business email address. This is the real test and it takes two minutes.
- A reset email arrives at your address. Good. The account is reachable by you.
- No account exists for your address. The domain is held under someone else’s login, and that someone is almost certainly whoever built the site.
- An account exists but you are a user rather than the owner. Check whether you can change the account email and delete other users. If you cannot do both, you have access and not control.
The account recovery email address is the thing to look at hardest. Whoever receives password resets can restore their own access at any time, no matter what any other setting says. If the address on file ends in someone else’s domain, change it to yours before you do anything else on this list.
Step 3. Separate the registrar from the DNS
These get confused constantly, and they are two different levers held by two potentially different parties. The registrar controls who owns the name. DNS controls where the name points. You can hold one and not the other.
Look up your domain’s nameservers, which the ICANN lookup shows and any DNS lookup tool will confirm. If they read like your registrar, DNS is likely at the same place. If they read like a different provider, DNS is delegated there, and you need an account check at that provider too, using the same password-reset test.
Step 4. The accounts nobody thinks to check
The domain is the emergency. These are the ones that quietly turn out to matter more over a few years, because they hold history that cannot be rebuilt.
| Asset | Where to check | What ownership looks like |
|---|---|---|
| Google Business Profile | business.google.com | Your account is listed as Owner, not Manager. Reviews live here and cannot be moved. |
| Google Analytics | analytics.google.com, Admin, Account access | Your account has Administrator on the account, not just the property. |
| Search Console | search.google.com/search-console, Settings, Users | You are an Owner. Verification via DNS beats verification via a file someone else can delete. |
| Source code | The repository host | The repository sits in an organisation you own, and you can remove other members. |
| Your mail provider admin console | The tenant is registered to your business. Email is usually more urgent than the website. | |
| Ad accounts | The ad platform business settings | Your business owns the account and grants access, rather than a partner account granting you access. |
For each row, the test from the ownership piece applies unchanged: can you remove their access without asking them? If yes, you own it. If no, you have been given access to it, and access is granted by someone who can also ungrant it.
Step 5. Write it down
Put the results in one document. Asset, provider, account owner of record, recovery email, renewal date, who else has access, date checked. It is a boring document and it is the single most valuable page of internal paperwork a small business can hold, because it turns a panicked afternoon into a lookup.
Then set two calendar reminders. One a month before the domain expires. One a year from now to run this list again. Access drifts. People leave, agencies change hands, a contractor adds a colleague and never removes them. A record with a date on it is the only way to notice.
What to do if the answers are bad
Do not open with an accusation, because in most cases there is nothing to accuse anyone of. The usual cause is that a supplier set things up the fastest way at the start and nobody revisited it. A short, unemotional message asking for accounts to be moved into your name is normal housekeeping and is usually met with cooperation.
If it is not met with cooperation, stop improvising and change the nature of the conversation. Take a written record of what you have asked and what was refused, secure whatever you can still reach, and get advice before you escalate. The one thing not to do is start deleting or moving things in a hurry, because a half-finished migration is how a website and its email go down together.
Questions
Can I find out who owns a domain if the details are private?
The public record will not tell you, because privacy protection substitutes a proxy contact. You find out at the registrar instead: attempt a password reset with your own business email. Whether an account exists for you, and whether it is an owner account, is the answer the public record cannot give.
What is the difference between the registrar and the DNS host?
The registrar is who the domain is registered with and controls who holds the name. The DNS host controls where the name points, which is to say your website and your email. They are often the same company and do not have to be. Whoever holds DNS can redirect your traffic without owning the domain.
My agency says I have full access. Is that enough?
Check whether you can change the account recovery email and delete their user. Control of the recovery address is control of the account, because a password reset restores access regardless of any other permission. If you cannot do both of those things, you have access rather than ownership.
How often should I check this?
Once a year, and any time a supplier relationship changes. Access drifts quietly: staff leave, contractors add colleagues, agencies are acquired. A dated record is the only way to see the drift, because nothing about it generates a notification.
What is the most urgent thing to fix first?
The domain registrar account, and specifically the recovery email address on it. Everything else can be rebuilt or moved given time. Losing the domain takes down your website and your email simultaneously and turns an operational problem into a legal one.