It happens quietly. In 2016 an agency registers the domain "for convenience, so we can handle everything", the site goes live, and nobody thinks about it again. Ten years later the company wants to change supplier, rebuild the site, or simply move its email — and discovers that the name everything runs on is not theirs.
The good news: it is almost always recoverable. The bad news: the difficulty depends almost entirely on how good the relationship still is, and relationships tend to sour at exactly the moment the domain is needed.
First: work out what you are dealing with
Before writing to anybody, look at the domain's public record. For an .it, the Italian registry's whois lookup at nic.it tells you everything you need. You are looking for three things:
- Who the Registrant is. It is the only role that matters: the holder of the name.
- Which email address is attached to the Registrant. It determines practical control, and it is worth knowing straight away whose mailbox that is.
- Which registrar it sits with. That is who you will be talking to at the end.
Three different situations come out of this, with three different solutions.
Situation 1: you are already the Registrant
This happens more often than people expect: the agency registered the name correctly to the company, and what is missing is only the panel login.
That is the easy case. You are the holder, so you are entitled both to the credentials and to the authorisation code to move the domain elsewhere. If the agency does not respond, the registrar has to deal with you: for .it domains the authinfo code is, by rule, sent to the Registrant's email address, and if that address belongs to the company, the problem is already solved.
If instead the address belongs to the agency, the first step is not asking for the code. It is asking for the Registrant's email address to be changed.
Situation 2: the agency is the Registrant
Here the domain formally belongs to them. It does not matter who paid the renewal invoices for eight years: paying does not transfer title.
What is needed is a change of Registrant: an administrative procedure that changes the holder's details. It does not touch the site, it does not touch the email, and it causes no downtime. It does, however, require the consent of whoever holds the name today, which is why the order of moves matters.
The request, in writing and without drama, asks for four concrete things:
- the Registrant changed to the company's registered name, with the correct VAT number;
- the Registrant's email changed to a company mailbox;
- the management panel logins, or the transfer authorisation code;
- a date by which this will be done.
A normal agency does it in two days: to them it is a form, and holding a domain hostage is not a business. Complications arrive when there is an unpaid invoice in the mix, or when the relationship ended badly.
Situation 3: the supplier does not answer, or no longer exists
That road exists too, and it is less dramatic than people imagine.
If the supplier is unreachable or has ceased trading, your counterpart becomes the registrar. Registries provide procedures for reassigning a name when the formal holder can no longer be reached, and the position of somebody who can demonstrate use of their own company name or trademark is a strong one.
If the supplier exists but refuses, the question stops being technical. Registries run dispute resolution procedures for domain names, and at that point you want somebody who knows them: this is not the moment for do-it-yourself, and it is precisely why ownership is worth fixing while nothing depends on it.
Three things not to do
Do not register a similar domain and start again from there. It throws away your rankings, breaks every link pointing at the site, and confuses customers. It is the solution that looks fast and costs the most.
Do not let the domain expire as a strategy. An expired name does not come back free for you: it moves through recovery windows set by the registry and then, at the end, onto the expired-domain market, where whoever has been watching it takes it before you do.
Do not open with a threat. A change of Registrant needs the other side's signature. A cordial email asking for a routine procedure works nearly every time; a legal letter turns a form into a dispute.
Afterwards: close it for good
Once the domain is back, the thing to do straight away — while the subject is still fresh — is to make sure it cannot happen again:
- the Registrant set to the company, with a company email address somebody actually reads;
- auto-renewal on, and the expiry date recorded where more than one person sees it;
- transfer lock and two-factor authentication on the registrar account;
- logins documented inside the company, not in a supplier's memory;
- every company domain on the same panel, so that an inventory exists at all.
It is an afternoon of administrative work that removes, completely, a risk capable of stopping the website, the email and the invoicing at the same time.
If you would rather this conversation were had by somebody who has had it dozens of times — including the part where the supplier goes quiet — that is exactly what domain registration and management covers.