Most business owners find out whose name their domain is in about two weeks after it would have been useful to know.
The question of who holds the keys is the most uncomfortable one a small business has about its website. It almost never gets asked at a calm moment. It gets asked when somebody has stopped answering emails. And at that point it is suddenly the only question that matters.
A small warning before you read on: this article is not legal advice. We are not lawyers and we do not know what your contract says. It is a list of the things we see in practice, together with how to check them yourself.
Four things that get treated as one
When someone says "I have a website", they mean one thing. There are actually four of them, and they do not depend on each other. They can have four different owners, and surprisingly often they do.
- The domain name. The address itself. You do not buy it, you rent it: it has to be renewed every year. Whoever is written down in the registry as its owner decides where that name points.
- The hosting. The server your files sit on, and the account with the provider. It has nothing to do with the domain beyond a single line of configuration.
- The site itself. The files, the database, the text, the photos, the design. This is the part people are usually asking about when they ask "is it mine", and the only part that can be picked up and carried somewhere else whole.
- The accounts around it. The Google business profile, analytics, search console, the ads account, the email mailboxes. Separate accounts with separate owners, and the ones most often forgotten.
The most common misunderstanding sounds like this: "I pay for it every month, so it must be mine." An invoice does not tell you whose name the account is in. An invoice only tells you who pays. Those are two different lines, and they can quietly drift apart for years without anyone noticing.
How to check today who holds what
Each of the four is checked separately. It takes about half an hour in total, and you can do all of it without asking anyone for permission.
The domain
The registry for Estonian .ee domains runs a public lookup where you type in a domain name and see whose it is. Searching for "ee domain whois lookup" will get you there. Enter your domain and read four lines.
- The registrant is the owner. This is the only line that finally counts. It should carry your company name and your registry code.
- The administrative contact is the person allowed to handle the domain's paperwork. They are not the owner. An agency often sits here, and that is perfectly fine.
- The technical contact configures where the domain points. Also not the owner.
- The registrar is the company the domain was registered through, and the one that sends the renewal invoice. You can change registrars without the owner changing at all.
If the domain is registered to a private person, the public lookup will not show the name, because a private person's details are hidden. Then there are two ways round it: ask the registrar, or read the renewal invoice, which usually states whose name the domain stands in.
If the registrant turns out to be your agency's trading name, that is not yet a disaster. In most cases one email fixes it.
The hosting
Open your most recent hosting invoice. There are two different things on it: who issues the invoice, and whose name the account with the provider is in. If the agency buys hosting in bulk and resells it to you, then the invoice is theirs and so is the account.
An honest test is easier than reading an invoice: try to log into the hosting control panel. If you have no user there, and you do not even know which company provides it, then that account is not in your hands. Check as well which email address the warning notices go to.
The site itself
This question has two halves. Whether you have a full-rights user on the site, and whether you can get a copy of the content out.
You can see the first one immediately: can you reach the place where users are added and removed. If your user can change text but cannot see the settings, then you are a guest on your own site. The second one you do not know until you ask. Ask for a copy of the files and the database. The answer to that request is very informative, including when no answer arrives.
The accounts around it
The Google business profile and analytics both have roles, and the difference between them is large. An "owner" can do everything, including removing other people. A "manager" or a "user" can do the work, but cannot throw the owner out.
Open the user list on every account and look at whose name sits on the owner row. If it is an agency employee's personal mailbox, that is the row you want to change before that person moves jobs.
Why the keys end up with the agency in the first place
It is worth being honest here, because the reader's first thought is usually darker than the reality.
It is almost never a plan. It is convenience at the start of a project. The agency already has an account with a registrar and the client does not. The agency already has a Google account and the client does not have one yet. The domain is needed right now, because nothing can happen without it, and nobody at that moment is thinking about what this looks like in five years. Three years later it is simply the way things are.
And most agencies hand everything over calmly when they are asked. We say so plainly, because an article that leaves you suspicious of a partner who is doing nothing wrong has done you a disservice. Taking a site hostage is rare. Sloppiness is ordinary. The consequence is the same in both cases once that person stops picking up the phone.
Where it actually goes wrong
Four situations that reach our desk.
- The agency stops answering. Usually not out of malice. First they are busy, then they are tired, and then they are not doing websites any more.
- The one person who set it all up leaves. The passwords were in their head and the accounts were under their personal mailbox. The company is still there, the knowledge is not.
- The company is sold or shuts down. Your domain is on somebody else's asset list, and you are not at that table.
- The renewal invoice goes to an inbox nobody reads. An address that belonged to a person who left two years ago, for example.
An expiring domain is the worst of these
If a domain is not renewed, it does not vanish immediately. First it goes dark: the site and the email stop working, and you usually hear about it from your customers. After that there is a period during which the owner can still take it back. How long that period runs depends on the registry and on the registrar, so do not rely on memory here - ask straight away.
Once that period is over too, the name is released and anyone at all can register it. Older domains do not usually stay free for long, because they are watched automatically. After that there is no longer any sum of money that reliably gets it back for you. The new owner does not have to sell it to you. They can put whatever they like at your address.
That is why this is the one item on the whole list we ask people to do today rather than next week: check where the renewal invoice goes, and switch renewal to automatic if that is on offer. A domain's yearly fee is one of the smallest invoices your company has. The cost of losing it is not small at all.
What "I can edit my own site" actually means
People tell us this often, and it is true about half the time.
Run a simple test. Take three things that really need changing in ordinary life: change one price, add one new page, swap out one photo. And then publish them. Today, yourself, without having to write to anyone.
If that works, you genuinely have access. If you get to a place where you can see the text but cannot create a new page, then you have editing rights, not access. If you have to email somebody who will do it within three days, then you have a service, not the keys. That third option can be an entirely sensible choice if you made it deliberately. It is only bad when you thought you had the first one.
What to put in writing
Before the project starts
This list fits in one email and saves weeks later. Ask for these points as part of the quote, not verbally.
- The domain is registered to my company name and registry code. I am the registrant.
- The renewal invoice and the renewal notice come to my address too, not only to yours.
- The hosting account is in my name. If it stays in yours, it is written down what happens when we part ways.
- I have a full-rights user on the site the whole time, not only once the project ends.
- The Google business profile and analytics are created under my account and you are added as a manager.
- I can have a copy of the files and the database on request, without having to explain what for.
- The handover is described: what is in it, and how many days it takes.
None of these is a rude question. We do not charge extra for any of them; if a supplier does, let them say exactly what for. If one of them comes back with a long explanation, that is a good place to keep asking.
If the project was finished long ago
Then the email is shorter. Ask for a single document stating whose name the domain is in, where the hosting is, who owns the accounts, and where a copy of the site can be obtained. No accusation, just a list. Most people send it within a week. If no answer comes for three weeks, you have already had your answer.
How to leave well
Leaving does not have to be a fight. Most of these turn into a fight only because nobody said at the start what they expected.
A proper handover contains five things:
- The domain is in your name and moves to a registrar of your choosing, if that is what you want.
- A copy of the files and the database, with a couple of sentences about what it needs in order to run somewhere else.
- Ownership of the accounts transferred, and the old team's access removed.
- One document saying what lives where, and who gets billed for what.
- An agreed date from which the old side manages nothing, so that no month is left in the middle where nobody knows who is responsible.
And one thing worth hearing: asking for this is not an accusation. We have received that email ourselves and it was not offensive. The best moment to ask is when everything is fine and nobody is upset. Then it is simply administration.
Our own side of this
It is only fair to say where we stand. We register domains to the client's company name and registry code, even when the client asks us to just do it whichever way is quicker. We are the administrative contact, not the owner. If a client tells us tomorrow that they are leaving, they leave: they get the domain, a copy of the files and the database, and ownership of the accounts, and nobody needs a meeting for it. We are not doing it to be virtuous. We do it because a client who is held in place by a technical obstacle is not a client, but a problem waiting for its moment.
Where to start
Start with the domain, because it is the only one whose loss is final. Five minutes in the registry lookup will tell you more than an hour of discussion.
If it turns out the hosting is in somebody else's name and you want it in yours, the hosting page shows what moving actually involves. If your real problem is that somebody ought to be keeping an eye on the site and watching the renewals, that is what web management is. Prices for both are on the pricing page, because this is exactly the sort of thing you should not have to puzzle over.
And if you are in the middle of it right now, with nobody answering and no idea what you actually have, write to us. We will go through it with you, including when the outcome is that you stay exactly where you are. That happens, and it is a perfectly good outcome.
Frequently asked questions
Estonia's .ee registry runs a public lookup where you type in a domain name and see whose it is. Read four lines there. The registrant is the owner and the only line that finally counts: it should carry your company name and registry code. The administrative and technical contacts and the registrar are not owners - an agency often sits on the administrative row, and that is perfectly fine. If the domain is registered to a private person the lookup hides the name, so ask the registrar or read the renewal invoice.
An invoice does not tell you whose name the account is in. It only tells you who pays, and those are two different lines that can quietly drift apart for years. A website is actually four separate things: the domain name, the hosting, the site itself with its files and database, and the accounts around it such as the Google business profile and analytics. They do not depend on each other and they can have four different owners. Each of them has to be checked separately.
A domain does not vanish immediately. First it goes dark: the site and the email stop working, and you usually hear about it from your customers. After that there is a period during which the owner can still take it back, and how long it runs depends on the registry and the registrar, so ask straight away rather than rely on memory. Once that period is over, the name is released and anyone can register it. After that no sum of money reliably gets it back: the new owner does not have to sell it to you.
Run a simple test. Change one price, add one new page, swap out one photo, and publish all three today, yourself, without having to write to anyone. If that works, you genuinely have access. If you can see the text but cannot create a new page, you have editing rights rather than access. If you have to email somebody else to get it done, you have a service rather than the keys - which can be an entirely sensible choice, as long as you made it deliberately.
Five things. The domain is in your name and moves to a registrar of your choosing if that is what you want. You get a copy of the files and the database, with a couple of sentences about what it needs in order to run somewhere else. Ownership of the accounts is transferred and the old team's access removed. One document says what lives where and who gets billed for what. And there is an agreed date from which the old side manages nothing, so no month is left where nobody knows who is responsible.
Read next
You nodded through a meeting about A records and TTL. The invoice says "unlimited", the report shows a red LCP. Here are those words back, in groups and a sentence apiece, every abbreviation written out. Including the three that actually cost money when they go wrong.