Who owns your domain name? Registrar, DNS, locks and transfers explained

Your domain name belongs to its registrant: the person or business named as the holder at the registrar, the company you renew it through. Public lookups now usually hide the registrant’s name, so check inside the registrar account itself: the registrant should be your business, the login should be yours, and the renewal should be on your card. If a web designer registered the domain for you, ask for all three, in writing.

This guide is for any business whose domain was set up by someone else, or set up so long ago that nobody remembers how. It explains who does what, how to check who owns your domain name, how registrar locks and transfer codes work (including the change coming to .uk in February 2027), what happens at renewal and expiry, the two locks on the name itself, DNSSEC and CAA, and what to ask a web designer who holds it.

Registrant, registrar, registry and DNS host: who does what

Four parties are involved in every domain, and the confusion between them is how businesses lose control of their own name.

Who	What they are	For a .co.uk or .uk	What they control
Registrant	The owner on the record	Your business, if it is set up properly	The right to renew it, move it, and change its details
Registrar	The company you rent the name through	One of many accredited companies, such as 123-reg, GoDaddy, IONOS or Namecheap	The account, the renewals, the lock and the transfer
Registry	The organisation that runs the whole ending	Nominet (Verisign runs .com)	The master list of names and who holds them
DNS host	Whoever runs the records that point the name somewhere	Often the registrar, or a DNS provider such as Cloudflare	Where your website and your email go

Whoever holds the registrar login and the DNS login runs your business’s address on the internet, whatever the paperwork says. Ownership is the registrant field. Control is the two logins. You want all three.

How to check who owns your domain name

1. Look it up. For .com, .net, .org and the other generic endings, use ICANN Lookup. Since 28 January 2025, ICANN says the Registration Data Access Protocol (RDAP) is “the definitive source” for that registration data, in place of WHOIS. For .uk domains, Nominet says its old .uk WHOIS is at end of life and provides an RDAP lookup at rdap.nominet.uk. The result shows the registrar, the registration and expiry dates, the domain’s status and its name servers.
2. Do not expect the owner’s name in the result. For .uk, Nominet lists finding a registrant’s details as possible only “if the registrant has opted in”, and for the generic endings personal details are often withheld from the public. What the lookup does tell you is which registrar holds the domain, and that is where to go next.
3. Check inside the registrar account. Log in and find the registrant or owner details. For a limited company, the registrant should be the company, under its name as registered at Companies House; for a sole trader, your own name. The account’s email address should be one the business controls, and two-step login should be on; our guide to security basics puts the registrar on the short list of logins to protect first.
4. If you have no login, find out who has. The lookup names the registrar. Ask whoever built your website, or whoever pays the renewal, whose account it sits in.

Our free domain checker asks each registry over RDAP whether a name is free, if you are choosing a new one.

Registrar lock and transfer codes

A registrar lock is a status on the domain called clientTransferProhibited. ICANN explains that it “tells your domain’s registry to reject requests to transfer the domain from your current registrar to another”, which helps prevent a transfer through hijacking or fraud. Keep it switched on. When you do want to move, ICANN’s advice is that “you must first contact your registrar and request that they remove this status code”; many registrars let you do it yourself in the account.

Moving a .com or other generic domain

To move to a new registrar, you unlock the domain, get its transfer code (also called an auth code or EPP code) from the current registrar, and give it to the new one. ICANN’s Transfer Policy, as published in November 2026, sets the rules registrars must follow:

• Five days for the code. A registrar that does not let you generate the code yourself must give it to you, and remove the lock, “within five (5) calendar days” of your first request.
• No holding it over a bill. The registrar “must not refuse” to remove the lock or release the code “solely because there is a dispute” with you over payment.
• Some waiting periods. A registrar may refuse a transfer within 60 days of the domain being registered or of a previous transfer, and must refuse one within 60 days of a change of owner, unless you opted out of that lock before the change.
• Silence counts as yes. If the current registrar does not respond to the transfer within five calendar days, the transfer is approved by default.

The policy has been under review, so your registrar’s own help page is the final word on timings.

Moving a .uk domain, and the change on 9 February 2027

For now, a .uk domain changes registrar by a tag change: the domain is moved onto the new registrar’s tag, usually by your current registrar at your request. A new registrar can choose to approve each change onto its tag, and Nominet’s registrar documentation says a change it has not approved within five days is automatically rejected.

That is changing. Nominet has announced that .uk moves to the same transfer-code process as other domains on Tuesday 9 February 2027. From then, your current registrar generates a Transfer Authorisation Code and gives it to you, the new registrar enters it, and “if the domain is unlocked and the Transfer Authorisation Code is correct, the transfer will complete immediately”. A code is “valid for 14 days from the time it is generated”. Nominet also says it will stop taking registrations direct, and “will however act as an escalation point for registrants should a registrar fail to comply with the relevant registry policies”.

Renewals and expiry: what happens if it lapses

A renewal nobody is watching is the most common way a business loses its own name. The card on file expires, the reminders go to a former employee or a designer’s inbox, and the first sign is the website and email going quiet.

For a .uk domain, Nominet’s renewal process for registrars, as published in November 2026, sets out what happens if it is not renewed by its expiry date:

After expiry	What happens
Day 1	Nominet emails the registrant, naming the registrar to contact
Day 23	A warning that the domain will be suspended in 7 days
Day 30	The domain is suspended, and can still be renewed
Day 83	A warning that the domain will be cancelled
Day 90	The last day it can be renewed
Day 95	It is dropped, and anyone can register it

From 9 February 2027, when .uk moves to its new registry, Nominet’s .UK Registry-Registrar Lifecycle Policy replaces these timings, with a 45-day auto-renew grace period after expiry and a 30-day redemption grace period after deletion.

For .com and the other generic endings, ICANN’s Expired Registration Recovery Policy requires the registrar to remind you at least twice before expiry, “approximately one month prior to expiration” and “approximately one week prior”. After expiry the registrar may delete the domain at any time. Until it does, it must let you renew, and it must interrupt the domain’s DNS, so the website and email stop, for at least the last eight days you can still renew it (or from expiry, if it deletes the domain sooner). Once deleted, most generic domains have a 30-day redemption grace period in which they can still be restored; ICANN’s status page says that if you want to keep it, “you must immediately contact your registrar”.

The fix is dull and reliable: renewal on your own card with automatic renewal on, reminders sent to an address the business reads rather than one person’s inbox, and a renewal of more than one year if your registrar offers it.

DNSSEC and CAA: the locks on the name itself

A registrar lock protects the registration. Two more records protect what the domain does.

DNSSEC signs your domain’s DNS records, so a computer looking up your domain can check the answer is genuine. Cloudflare’s documentation says it “prevents anyone else from issuing false DNS records on your behalf and redirecting traffic intended for your domain”. Switching it on is a two-step job: enable it where your DNS is hosted, then add the matching DS record at your registrar. It needs care in one situation. Cloudflare warns that before you move DNS to a new host, you must turn DNSSEC off at the registrar first, or “your domain will experience connectivity errors when you change your nameservers”. Ask anyone moving your DNS whether they have.

CAA is a DNS record that says which certificate authorities may issue the certificates that put the padlock on your website. RFC 8659 defines it: it “allows a DNS domain name holder to specify one or more Certification Authorities (CAs) authorized to issue certificates for that domain name”, which reduces the risk of a certificate being issued for your name by someone it should not be.

Neither one helps if someone else holds your registrar login, which is why ownership and the logins come first.

Where the DNS lives, and why it matters as much as the name

Your domain’s name servers, shown in the lookup, tell you where its DNS is hosted. If they belong to your registrar, the DNS is in your registrar account. If they belong to a DNS provider such as Cloudflare, the next question is whose account at that provider. Whoever controls the DNS controls where your website and your email go, so that account should be in the business’s name too, with your designer or developer added as a user you can remove. Our guide to the checks before you sign off a new website puts the DNS on its list of keys to collect.

The DNS also holds your email records. Those belong to whoever runs your business email; for our clients that is our sibling practice Dacros. When we point a domain at a new website, we change only the website’s records and leave the email ones alone.

What to ask a web designer who registered your domain

If a designer, developer or agency registered the domain for you, these are the questions to ask, by email so the answers are in writing:

1. Which registrar is it with, and who is the registrant? You want your business, not theirs.
2. Can it move into an account in our name, with our own login? Their reseller account, where you cannot log in, is not ownership.
3. Where is the DNS, and whose account is that? The same rule: your account, with them as a user.
4. Who pays the renewal, and who gets the reminders? Your card, and an address you read.
5. If we part ways, what do you need from us to hand everything over? A good supplier answers this in a sentence.

Our free guide, 5 questions before letting an agency host your domain, goes through each question with the acceptable and walk-away answers, and what to do if a domain is being held against you. Our guide to choosing a web designer covers the rest of what you should own when the work is done.

Two practical points when you take a domain over. For a generic domain, changing the registrant can start a 60-day lock on moving registrar, so if you plan to change both, ask the registrar about opting out of that lock before the owner is changed. And for any domain, once it is yours, change the account password, turn on two-step login, and check that the renewal and the reminders now come to you.

How we look after domains

When we look after a domain, it is registered in your own name, on your own registrar account, under your own email, and you pay the registrar directly, at cost, with no markup from us. We manage the website’s DNS on Cloudflare, put DNSSEC, CAA and HTTPS in place, and remind you before each renewal. If you leave, the domain goes with you, because it was always yours.

If your domain is in someone else’s account, or you are not sure whose it is, our domains and DNS service checks what is there and puts it right in your name: tell us the domain and we will send a written quote.