Who Controls Your Business Domain? A Renewal Checklist

Before you sign off on next year's IT renewals, ask a smaller question: can you prove who controls your domain, and who will keep it renewed? "The web company handles it" is where the question starts.

If you're doing a fourth-quarter review, make this a short item on the agenda for operations, finance, and IT. The point isn't to switch providers. It's to confirm that something your business can't run without has an owner, working access, and a renewal you've actually checked.

Start With What Would Break

Frame the review around one question: if your domain went dark tomorrow, which customer emails, website pages, and staff workflows would you check first? Ask IT to write those dependencies down instead of treating renewal as a stray invoice.

Don't build your plan on an assumed grace period. Ask your registrar to confirm the deadlines and recovery process for your actual domains, and treat those answers as a fallback, not permission to renew late.

List your main domain and any others still used for email, customer links, or redirects. Before you cancel one that looks unused, have IT confirm that no service or account-recovery address depends on it.

Confirm Who Holds the Registration and Access

Ask your internal owner and your provider to look at the registration and account records together. If they don't match, sort it out. The person who pays the invoice may not be the person who controls the domain.

Your checklist should answer:

• Is the registrant information accurate for the business?
• Which registrar account holds the domain?
• Who is authorized to approve a renewal, transfer, or contact change?
• Can the business get in through a documented recovery route without relying on one former employee or contractor?
• Is the account protected with MFA, if the provider supports it?

Where it's available, prefer individual, role-appropriate access. If a provider only allows a shared account, agree on how the credential is protected and recovered, and don't send the password around by email.

Keep Registration Separate From Other Services

Record the responsible provider for each of these on its own line:

• Domain registration and renewal
• DNS hosting and record changes
• Website hosting and maintenance
• Business email administration

Ask each provider to confirm what it covers. If one company does everything, still write the responsibilities down separately. When something breaks, you'll know whom to call without having to reconstruct the arrangement mid-outage.

Don't change nameservers, mail records, or providers just to finish this checklist. Any change should go through its own impact review, approval, and testing.

Check the Renewal Evidence

Auto-renew is fine, as long as someone verifies the rest of the process:

• Is auto-renew on for every domain you mean to keep?
• Is the payment method current, and who owns a failed payment?
• Do renewal notices reach a mailbox someone monitors?
• Is there a backup owner for vacations and staff changes?
• After payment, does the registrar show the new expiry date you expected?

Set a calendar reminder early enough to fix an account or billing problem. Record the confirmed expiry date and the date you checked it. An invoice alone shouldn't close the task.

Review Recovery Without Creating a New Risk

Ask how the authorized owner would reach the registrar if business email weren't available. Confirm there's an approved recovery contact and a secure place where the supporting account records are kept.

Keep passwords, recovery codes, and identity documents out of the renewal spreadsheet. It should hold owners, dates, status, and pointers to protected records, nothing more. Have IT review any recovery test before you run it, so a check doesn't end in an accidental lockout.

Finish With a Decision

Mark each domain verified, needs correction, or needs an ownership decision, and give each open item an owner and a target date.

Begin with the domain behind your main business email. Ask for a short record of who controls it, when it expires, how the renewal gets verified, and how an authorized backup person can get help. That's a worthwhile result from a short review, and it won't turn into another spreadsheet nobody updates.

Related Reading

Our IT documentation and outage runbooks guide covers the wider set of recovery information a business needs. This post is narrower: domain registration control, renewal evidence, and provider handoffs.