Domain registration, DNS, website and email may have different owners
- DOMAINRegistrar and registrantWho controls the account? When does registration expire, and who verifies renewal?
- DNSZone operatorWho can change records and name servers? Where are the current export and rollback instructions?
- WEBSITEHosting and applicationWhere does the website run? Who maintains files, certificates, configuration and backups?
- EMAILMailboxes and sending servicesWhere is mail delivered? Which systems send for the domain, and who manages them?
Separate registration, DNS, hosting and email
A business address usually depends on several services. The registrar handles domain registration and renewal, the DNS operator publishes records, the web host runs the website and the email provider maintains mailboxes. One supplier may perform several roles, but changing one service does not necessarily require moving all the others.
Record the registrar, registrant details shown in the account, name servers, website and email providers, and responsible person for each domain. Compare this with business records. An invoice for building the website does not establish that the business controls the registrar account or can make required changes.
Make access part of a business process
Verify that authorised people can sign in to the registrar and DNS accounts. Use individual identities or delegated roles where available. Protect access with MFA and store recovery codes in a controlled location. Do not put them in an ordinary handover document or a public repository.
Provide a recovery route that does not depend entirely on the same domain working. If account recovery goes only to email disrupted by a DNS failure, regaining control becomes harder. Name a substitute and check which evidence and contact channels the supplier accepts when normal sign-in is unavailable.
Automatic renewal still needs verification
Record the expiry date, renewal method and person responsible for confirming success. Automatic renewal does not replace current payment details, working notification addresses and a successful transaction. Set reminders early enough to resolve problems without last-minute pressure. Include cover for the responsible person’s absence.
Do not assume that every domain extension and registrar offers identical recovery periods. Check the relevant operator’s terms. After renewal, confirm the new date in the account. Track related services separately: a renewed domain does not automatically mean that hosting, certificates or email subscriptions remain active.
Treat a DNS change as a deployment
Before changing anything, save the current zone or a readable export of its records. Explain the purpose of each entry affected: website, email, service verification or another integration. Do not remove an unfamiliar record merely because it does not open in a browser. Agree the scope, timing and rollback procedure.
When moving DNS providers, prepare the complete required zone before switching name servers. Include existing DNSSEC arrangements in a plan agreed with the operators. Cached responses mean different users may temporarily receive different information. Record the expected checks instead of promising an exact universal switching time.
When the website or email suddenly disappears
Start by defining the scope: website only, email only, one location or the entire domain. Check service status, domain expiry and recent changes. Compare DNS responses from independent locations and record observation times. Avoid repeatedly switching records without preserving previous values and understanding the effect.
If registration details or DNS changed without permission, consider possible account compromise. Contact the registrar through an established channel, secure accounts and preserve notifications and logs. The team should already know who is authorised to report the incident and approve emergency work, including outside normal office hours.
Verify control, not just paperwork
During handover, perform a controlled access test: an authorised person signs in, sees the correct domain and locates renewal and DNS settings. Do not change production records merely to prove access. Separately confirm the support channel and account-recovery route.
After an actual deployment, test the website, certificate, inbound and outbound email, and important integrations. Record results, final configuration and responsibility for continued observation. Complete the handover only after the business confirms practical control, not simply when someone supplies a password list. Keep the accepted record where the responsible team can reach it during an outage.
Sources: ICANN SSAC — A Registrant’s Guide to Protecting Domain Name Registration Accounts (SAC044) · ICANN — FAQs for Registrants: Domain Name Renewals and Expiration · ICANN — About Lost Domain Names