Check both the registered name holder and your practical control of the domain account. Public lookup data may be redacted, and a working login alone does not settle contractual rights. Confirm recovery access, DNS management, hosting and renewals with the relevant providers. Before changing registrant details, ask about transfer locks and whether a prior opt-out is available; plan the handover with the registrar.
Original research dated September 21, 2026; text revised September 21, 2026. Claim-specific rechecks are identified in Sources and method. This article contains no affiliate links.
Who this is for
An agency, a freelancer or a relative set up your website, and you have never logged in to whatever holds the domain.
Why this matters more than it sounds
A domain can be central to your email and website continuity. If a supplier controls its account, document recovery and handover arrangements before they are needed. Possible problems include a supplier closing, a disputed handover or an obsolete renewal address. These are illustrative risks, not cases observed or measured for this article.
What ICANN’s policy actually says
For generic domains, ICANN’s current Transfer Policy uses the Registered Name Holder and registration data as the basis for transfer authority. It notes deferred enforcement of the gaining registrar’s Form of Authorization requirement. A change of registrant triggers a 60-day inter-registrar lock unless the registrar offers an advance opt-out and the holder uses it. Other transfer restrictions can apply. Earlier policy reference; current Transfer Policy.
Verify registration details privately with the registrar where needed. ICANN’s RDAP guidance explains the move from WHOIS; missing public contact fields do not prove someone else owns the domain.
The ownership checklist
| Asset | Evidence to verify | Warning sign |
|---|---|---|
| Domain registration | The registered holder and contractual rights are correct; you control authorized account and recovery access | You have never seen the registrar’s name |
| Registrant contact | The registrar confirms the correct holder and a contact you control; public data may be redacted | The contact email is the developer’s |
| DNS | You can administer the DNS zone at its provider | You do not know where DNS is managed |
| Hosting | The account is yours, with your payment method | Agency billing without documented continuity or handover terms |
| Website platform | You are an owner-level user, not a contributor | You cannot add or remove users |
| The mailbox provider account is yours | Email “just works” and nobody knows why | |
| Analytics and search tools | You are the property owner | Only the agency can grant access |
| Code and design files | You have a copy, and the contract says they are yours | Files exist only in the builder’s account |
How to check in fifteen minutes
Use fifteen minutes for an initial inventory, not a guarantee that recovery or ownership verification will finish in that time.
- Use ICANN Lookup or an RDAP service. Note the registrar and available dates; verify redacted holder information directly with the registrar.
- Verify account recovery through the registrar’s official process. A missing reset email can reflect another login address, SSO, filtering or security controls; it is not proof of ownership.
- Check the nameservers in the same record, which identifies nameserver infrastructure, not the person or account controlling the DNS zone.
- Log in to your website platform and look at the user list. Confirm your role is owner or administrator.
- Check who receives the renewal notices. An expiring domain nobody is warned about is the classic disaster.
Getting control back, politely
- Ask plainly and in writing. “Please transfer the domain registration into an account in my business’s name, and confirm who currently holds DNS and hosting.” Ask the supplier to confirm the handover steps and any contractual restrictions.
- Create your own registrar account first, so there is somewhere for it to go.
- Agree the appropriate transfer route with the registrar. An account handover and a change of registrar are different processes; request codes and unlocking only as the authorized holder when required.
- Plan for the 60-day lock. A change of registrant can trigger the lock unless a registrar-offered opt-out was used beforehand; do the sequence with time to spare, not the week a contract ends.
- Do not change DNS and registrar on the same day. Move the registration first, confirm mail still flows, then touch DNS.
- Update the contact email to an address you control and will keep, ideally not one hosted on the domain itself.
If email runs on the domain, our email authentication checklist covers the records you must not break during a move, and our Workspace billing guide covers owning the mailbox subscription itself.
Clauses worth having in the next contract
- The client owns the domain registration and it is registered in the client’s name from day one.
- All accounts created for the project are in the client’s name, with the supplier added as a user.
- On termination, the supplier provides files, credentials and an export within a stated number of days.
- Hosting is billed to the client directly, or the contract says what happens if the supplier stops paying.
- Nothing here is legal advice; have a professional in your country draft the wording.
Keep a one-page ownership record
List each asset, the provider, the account email, where the credentials live, the renewal date and who else has access. Store it in your password manager, review it every six months, and update it when a supplier changes. This is the document that makes a bad week survivable.
Frequently asked questions
Can my developer refuse to release my domain?
That depends on the registered holder and your agreement with the developer. ICANN’s restrictions on registrars do not themselves resolve a developer’s contractual handover duty. Section I.A.5.4 prevents a registrar withholding AuthInfo or unlocking solely over its payment dispute with the holder, but other transfer restrictions remain. Confirm the holder and obtain appropriate advice if rights are disputed.
How long does a transfer take?
It varies by registrar, and a 60-day lock can apply after a registrant change or a previous transfer. Plan weeks, not days.
What about country domains like .co.uk or .de?
Those run under their own registry rules rather than ICANN’s generic policy. Check the registry’s documentation for your extension.
Should I move hosting too?
Plan hosting separately once account control and handover rights are clear. Keep DNS, email and backups working during any move; changing registrar does not require changing hosting.
Sources and method
Original research: September 21, 2026. Text revision: September 21, 2026. For this revision, the current ICANN Transfer Policy was rechecked. RDAP guidance comes from the September 21 editorial review. Sources used across the original research and this revision: ICANN’s current Transfer Policy and RDAP transition guidance linked above. The earlier policy URL is retained as a historical reference, not the authority for current administrative-contact wording. Account control, registration rights and contracts are distinct; the checklist is editorial guidance, not legal advice. Country-code rules and registrar-specific recovery remain case-specific.
Read next
