Who actually owns your domain? How to check in ten minutes

There is a discovery companies always make at the wrong time: the domain that runs their website, their email and their invoicing is not registered to them. It is registered to the agency that built the site in 2016, or to the cousin who "knew about computers", or to a supplier that has since closed.

While everything is fine, none of it matters. The problem arrives together with a change of supplier, a dispute or a bankruptcy — that is, exactly when you need to be able to act quickly.

Three roles that get confused

A domain has several roles attached to it, and only one of them counts.

The Registrant is the holder. It is the only party that can decide to transfer, sell or delete the name. If that is not you, the domain is not yours, no matter who pays for it.

The administrative contact can manage it on the holder's behalf. It sounds important and is not: it confers no ownership.

The registrar is the supplier through which the name is registered. It owns nothing; it provides a service.

Whoever pays the renewal invoice appears nowhere on that list, and that is not an accident: paying does not prove title. I have seen companies pay for years for a domain registered to somebody else.

How to check

For an .it domain the most direct route is the Italian registry's whois lookup at nic.it. For international domains the registry publishes equivalent data, often redacted for privacy, but the field you need stays readable or can be requested.

What to look at, in order:

• The Registrant's name. It should be the company's registered name, written out in full. Not the name of somebody who used to work there, and not the agency's name.
• The VAT or tax number attached to it. That is the field that makes ownership verifiable.
• The Registrant's email address. This matters more than it looks: for .it domains the transfer authorisation code is, by rule, sent to precisely that address. If it is a mailbox at the agency, practical control of the domain belongs to the agency, whatever the rest of the record says.
• The expiry date. If it is less than a year away and nobody in the company knows who renews it, you have found a second problem.

If whois is not enough because the data is redacted, ask the registrar: you are a legitimate interested party, and they are obliged to answer.

What to do when the ownership is wrong

The thing not to do is wait until the moment you need it.

Correcting ownership is a change to the Registrant's details, not a rebuild: it does not touch the website, it does not touch the email, and it causes no downtime. It is an administrative procedure that needs the consent of whoever holds the name today.

And that is the delicate part: you need cooperation from the current holder. Getting it while the relationship is cordial takes one email. Getting it after a falling-out can take a lawyer, and meanwhile the site is a hostage.

If the agency cooperates, the order is:

1. correct the Registrant's details, including the email address;
2. verify in whois that the change actually took effect;
3. take possession of the panel logins, or transfer the domain to a registrar you chose;
4. enable the transfer lock and two-factor authentication on the account;
5. put auto-renewal and the expiry date somewhere a human being looks.

If they do not cooperate, the road is longer but it exists: registries provide dispute procedures, and being able to demonstrate use of the trade name or trademark counts.

The rest of the inventory

While you are looking, look at everything. Nearly every company older than ten years produces the same untidy map:

• domains registered "to protect the brand" and never renewed since;
• variants with and without a hyphen, bought for an idea and forgotten;
• a .com registered to a person who no longer works there;
• two or three different provider panels, with credentials in somebody's file;
• a domain used only for email, that nobody connects to the website any more.

It is worth writing them all on one sheet with four columns: name, where it is registered, who the Registrant is, when it expires. That is the only document needed, and in ten years of doing this I have almost never found it already written.

Why this is a real risk, not a theoretical one

An expired domain does not switch off with a polite warning. The site stops answering and the email stops arriving: no orders, no confirmations, no invoices, and no error message anybody inside the company sees. Recovery after expiry runs through time windows set by the registry and through costs that rise with urgency — when it is still possible at all, because desirable names get picked up fast.

It is one of the few business risks that an afternoon of administrative work removes completely.