Who Really Owns Your Website's Domain? How to Check, and How to Recover It

Your domain name is the one thing your website, your email and your Google listing all depend on. If it expires, all three can stop working at once. If someone else controls it, they control all three.

The quick test of who really owns yours: can you log in to the registrar account yourself, and does it name your business as the registrant? This guide shows how to check in five minutes, and how to recover a domain name that has expired or that a former developer holds.

It goes wrong more often than you'd think. In our audit of 3,196 local businesses, 108 were still sending Google Maps visitors to a web address that no longer worked, usually because the domain or hosting had lapsed. We then checked the public registration records for the .com web addresses of the businesses in that Google Maps audit, 1,127 domains in all. 32 of them (2.8%) weren't registered to anyone at all, and two in three were paid up for less than a year ahead.

That's why, when we build a business website, the domain and every account stay in the client's name.

What we found in 1,127 domain records

We looked up the public registration (RDAP) record of each of those 1,127 .com domains on 13 and 14 October 2026.

A few things stand out:

• The 32 unregistered domains are businesses whose Google listing sends customers to a web address nobody owns, so anyone could register it and receive that traffic. One of them had 124 Google reviews.
• Most domains are paid up only a year or less ahead, which usually means renewing one year at a time. That's normal, but one expired card or one missed reminder email can take the website and email offline.
• Many domains are old. The median domain was registered about seven and a half years ago, and four in ten more than ten years ago. The person who registered it, and the email address the renewal reminders go to, may be long gone.
• The good news: nine in ten had the registrar's transfer lock on, which stops the domain being moved to another registrar without someone unlocking it first.
• One registrar dominates. 45% of the registered domains were with GoDaddy, so its account recovery process is the one owners are most likely to meet.

A note on method: we only checked .com domains, because their records are available in one consistent format. Percentages are of all 1,127 domains, including the 32 that weren't registered. The businesses come from the same Google Maps audit behind our local business website speed tests.

Check who owns your domain in five minutes

1. Look up the public record. Use ICANN's lookup tool at lookup.icann.org. Since January 2025, registration data for domains like .com comes through a system called RDAP, which replaced the old WHOIS service. You'll see the registrar (the company it's registered with), the expiry date and its status.
2. Don't expect to see the owner's name. For privacy reasons, many records now hide the registrant's name and email. So the real question isn't what the public record says, but:
3. Can you log in to the registrar account yourself? If the domain sits in an account you can open with your own email and password, you control it. If only your web developer, a former employee or an agency can log in, they control it, whatever your invoice says.
4. Check the registrant details inside the account. The registrant should be your business, with an email address on your own domain or one you'll always have access to. Not your developer's personal address.
5. Check renewal settings. Is auto-renew on? Is the payment card still valid? When does it expire?

If any of these answers is "I'm not sure", that's the thing to fix this week.

How to recover an expired domain name

Don't panic, and don't wait. Under ICANN's Expired Registration Recovery Policy, which covers domains like .com, .net and .org:

• Before expiry, your registrar must send renewal reminders about one month and one week before the date, and another within five days after it expires. They usually go to the registrant's email address, which is why an old or wrong address is dangerous.
• After expiry, the registrar must take the domain offline for at least the last eight days you can still renew it, and may do so from day one. The website and often email stop working, and any parked page it shows must say the domain has expired and explain how to renew. You can still renew during this period, at the registrar's post-expiry renewal price, which may be higher than the normal one. How long it lasts varies by registrar, so act on day one.
• If it isn't renewed, the registrar can delete it. For most domain endings, a 30-day Redemption Grace Period follows, when the original registrant can still get it back through the registrar, usually for an extra restore fee. Registrars must publish these fees on their websites.
• Once that period ends, the domain is soon released and anyone can register it, including services that automatically grab expired names with existing traffic.

What to do: log in to the registrar (or contact them if you can't), renew or restore immediately, then check that the website, email and DNS settings came back. If the reminders went to an old or wrong email address, update it now.

Country-code domains (like .uk, .com.au or .ae) follow their own registry's rules, which can be shorter or longer. Check with the registrar.

How to get your domain back from a web developer or agency

This often comes to light when a business changes web providers: the domain was registered in the developer's own account, sometimes in their name, "to make things easier".

1. Ask first, in writing. Many developers will hand it over when asked. Ask them to either move the domain into an account you own at the same registrar, or give you the transfer code (also called an authorisation or EPP code) so you can move it to your own registrar.
2. Know the rules. Under ICANN's Transfer Policy, the registrar must provide the transfer code to the registered name holder within five calendar days of a request. If the developer is listed as the registrant, the request has to come from them, which is why their cooperation matters.
3. Expect a possible 60-day lock. After a change of registrant, registrars must normally lock the domain against moving to another registrar for 60 days, unless the registrar offers an opt-out and the registrant used it beforehand. Domains registered or transferred in the last 60 days can also be refused a transfer. In June 2026 ICANN's Board approved changes that would drop the lock after a change of registrant and set a 30-day wait after registration or a transfer, but they only apply once ICANN has implemented them. Until then the 60-day rules stand, so check your registrar's current terms.
4. If they refuse, gather evidence that the domain is yours: invoices showing you paid for it, your contract, emails about it, and the fact that it carries your business name. Contact the registrar's support team with this; some registrars will help with ownership disputes. If that fails, it becomes a contract matter, and a letter from a lawyer is the usual next step.

There's also a formal ICANN dispute process (the UDRP), but it's designed for domains registered in bad faith to copy a trademark (cybersquatting), not for disagreements with a former supplier. It's rarely the right tool here.

If nobody knows the registrar login

A former employee set it up, the email address no longer exists and nobody has the password. Registrars have account recovery processes for this. Expect to prove your identity and your business's connection to the domain with documents such as business registration papers, ID and payment records. Each registrar sets its own requirements, so start early.

A checklist so it never happens again

• Register the domain in the business's name, in an account the business owns, using an email address that will outlive any one employee.
• Give two trusted people access through the registrar's team or delegate access, if it has one, rather than sharing one password.
• Turn on two-factor authentication on the registrar account.
• Switch on auto-renew and keep the payment card up to date. Renewing for several years at a time is cheap insurance.
• Keep the registrar lock on (often called "transfer lock").
• Put the expiry date in your calendar 60 days before, even with auto-renew.
• Write down your DNS settings: email records, website settings and any verification records, so you know how things looked if something breaks. If you're changing platform or domain as part of a redesign, our website migration SEO checklist covers how to keep your search rankings through the move.
• When you hire a developer, let them work through delegated access to your account, not their own.

Your domain also controls your email security. Our study of 1,728 local business email domains shows what to set up there once you're in control.

Frequently asked questions

The bottom line

A domain is cheap to keep and painful to lose. Make sure it's registered to your business, in an account you can open, with auto-renew on and more than one person who can get in. If something has already gone wrong, act on day one. An expired domain can usually still be renewed or restored, but the options shrink every week.

Not sure who controls your domain, DNS and hosting? Book a free consultation and we'll help you check, and move everything into your name if it isn't already.

Sources

• ZNova Studio, public RDAP lookups of 1,127 .com domains of the local businesses in our Google Maps audit (13 and 14 October 2026)
• ZNova Studio, audit of 3,196 local businesses on Google Maps (October 2026): /insights/local-business-website-statistics
• ICANN, Expired Registration Recovery Policy: https://www.icann.org/resources/pages/errp-2024-02-21-en
• ICANN, Transfer Policy: https://www.icann.org/en/contracted-parties/accredited-registrars/resources/domain-name-transfers/policy
• ICANN Board, approved resolutions of 7 June 2026 (resolution 2026.06.07.04, Transfer Policy Review recommendations): https://www.icann.org/en/board-activities-and-meetings/materials/approved-resolutions-regular-meeting-of-the-icann-board-07-06-2026-en
• GNSO, Transfer Policy Review PDP Final Report (February 2025): https://gnso.icann.org/sites/default/files/policy/2025/correspondence/tpr-team-to-gnso-council-04feb25-en.pdf
• ICANN, Registration Data Lookup Tool: https://lookup.icann.org
• ICANN, "ICANN Update: Launching RDAP; Sunsetting WHOIS" (27 January 2025): https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en
• ICANN, Registration Data Policy (section 9.2, redaction): https://www.icann.org/en/contracted-parties/consensus-policies/registration-data-policy
• ICANN, Uniform Domain-Name Dispute-Resolution Policy: https://www.icann.org/resources/pages/policy-2024-02-21-en