Your Domain Is the Most Important Thing You Own Online. Here Is How to Own It Properly.

Confusion between these three is behind most domain problems.

• The registrar is where the domain name is registered and renewed: Cloudflare, 123-Reg, GoDaddy, IONOS, Namecheap and so on. The registrar's records name the registrant, the legal holder of the domain. That should be your business, at your address, with an email address that will still exist in five years.
• DNS hosting is where the records live that say which server handles your email, which handles your website, and which services are allowed to send mail as you. DNS can live at the registrar or somewhere else entirely, and often does.
• Web hosting and email are the services those records point at: your website host, Microsoft 365 or Google Workspace.

Any of the three can be with a different company. The dangerous pattern is when the registrar or the DNS is in someone else's name: a web agency that registered the domain in 2016, a former director's personal account, an IT provider that put it under its own reseller login. Our article on why you should never let outside agencies control your DNS is a catalogue of how that ends.

1. The domain expires. The renewal email went to an address nobody reads, the card on file expired, and one morning email and the website stop. Domains can be recovered for a few weeks after expiry, at a price; after that they are sold to whoever wants them.
2. Nobody can get into the registrar. The person who set it up left, the password is lost, and the recovery email is theirs. Changing a DNS record now needs a scanned passport and a fortnight of correspondence.
3. An agency holds it. They will usually hand it back, eventually. If the relationship has soured, or they have gone out of business, your domain is a bargaining chip.
4. DNS in two places. The registrar has one set of records, an old host has another, and which one is live depends on nameservers nobody has looked at. A change made in the wrong place does nothing, and the next change breaks email.
5. The domain is hijacked. A weak password and no two-factor authentication on the registrar account, and someone changes the nameservers, redirects your email and reads it. Our guide to DNS hijacking covers the mechanics.
6. Email records that let anyone send as you. No SPF, no DKIM, DMARC left on monitoring or absent. Invoice fraud starts here. Run our free domain security audit and it will show you in thirty seconds.

Whoever the registrar is, these should be true:

• Registrant is the business, with a role mailbox as the contact (for example [email protected]) that more than one person can read, and a current postal address.
• Two-factor authentication on the registrar account, and on the DNS account if it is separate. This is the single most important item on the list.
• Transfer lock (also called registrar lock or clientTransferProhibited) switched on, so the domain cannot be moved to another registrar without it being deliberately unlocked first.
• Auto-renew on, with a payment card that is a company card and that someone will notice expiring. Renew for several years at a time where the registrar allows it.
• DNSSEC enabled where the registrar and DNS host support it, so DNS answers cannot be forged.
• A documented list of every DNS record and why it exists. Dead records for services you stopped using in 2019 are how attackers take over a subdomain.
• SPF, DKIM and DMARC set correctly and DMARC at enforcement. Our email security guide explains each and how to get there without breaking your own email.
• More than one person with access, and a break-glass note of where the domain is held, in the same place you keep the other things that would matter if the IT person was hit by a bus.

We are a Cloudflare partner, and Cloudflare is where we put client domains for DNS and, where the domain ending supports it, for registration too. The reasons are practical: DNS that answers fast and does not go down, DNSSEC and registrar lock that actually work, at-cost renewal pricing on registrations, and a proper audit log of every change.

The part that matters more than the platform is how the account is set up:

• The account is yours. We create a Cloudflare account in your business's name, with your role mailbox as the owner, not a domain sitting inside our account. If we disappeared tomorrow, nothing about your domain would change.
• You have access. The directors, or whoever you nominate, have their own logins with two-factor authentication. You can see every record and every change.
• We manage it with you. We hold administrative access through Cloudflare's partner arrangement, make the changes day to day, keep the record documentation current, and set the security settings above. Changes that matter, such as a new mail provider or a nameserver move, are agreed with you first.
• Moving is planned, not rushed. DNS records are copied and checked before nameservers change, email records first, with the old host left running until everything is proven. Registrar transfers happen after the DNS move, never during it, and a domain that is close to expiry is renewed first.

A domain that was registered by an agency, a former provider or an individual is moved into the business's name as part of onboarding. It is often the first thing we fix, because everything else depends on it.

1. Look up your domain on a WHOIS service (Nominet's for .uk names, or any public WHOIS for others). Who is the registrant? When does it expire? Which nameservers does it list?
2. Log in to that registrar. Can you? Does it have two-factor authentication? Is transfer lock on? Is auto-renew on, and to which card?
3. Run our free domain security audit for the email records and the score.
4. Write down where the domain is, who has access, and when it renews, and put it where a second person can find it.

If any step fails, that is the thing to fix this week.