Guide

Who owns the domain: registrar accounts, DNS and how a small business loses its own website

October 25, 2026

Domains registered in a developer's or ex-employee's name, renewals that fail, registrar logins without 2FA: real cases from Marketo's $35 lapse to a nonprofit's domain held over a $1,500 invoice. ICANN's expiry rules and 30-day redemption period, what nine registrars charge to restore a .com ($45 to $200) and when GoDaddy auctions it, what a UDRP case costs, and an eight-step handover checklist.

A shop owner in an orange beanie types on a laptop at the counter of a small clothing store

In December 2012 a small Alaskan nonprofit hired a web developer. He built the site and registered alaskahealthfair.org, in his own name. In April 2013 there was a disagreement over an invoice of about $1,500, and he took the site down until he was paid. The nonprofit got its domain back two months later, through a dispute panel that found he had only ever held it as the client's agent. Most businesses in that spot never file the case; they pay, or they start again on a new name and lose every link, listing and printed card that pointed at the old one.

The domain is the one piece of a small business's online presence that everything else hangs off: the website, the email, the sign-in to every other account that sends its password resets there. And it is very often held by someone else: the agency that built the first site, a former employee, the owner's nephew. This is how a business loses its own name, what the rules and fees are once it has expired, and the checklist to make sure it's yours.

Two different things: the registrant and the account

Every domain has a registrant, the "registered name holder" in ICANN's words, which is the person or company that legally holds it. Separately, someone logs in to the registrar account where the domain lives and can renew it, point it elsewhere or move it. They are often not the same. ICANN's own advice is blunt: listing a web designer, hosting provider or other third party as the registrant "is generally not considered a good practice" because "this might allow that third party to challenge the registration". The business should be the registrant, and any agency's role should be in a contract, not in the domain record.

So there are two questions to answer for your domain: whose name is in the registrant field, and who has the login. If the answer to either is a person who doesn't work for you, you have a problem that hasn't happened yet.

How businesses actually lose it

text

When         Who                    What happened
-----------  ---------------------  -------------------------------------------------------------------------
Oct 2003     Microsoft              hotmail.co.uk not renewed; registered by a private person the same day;
                                    returned after the press called
Mar 2010     Foursquare             foursquare.com expired; the registrar put up a placeholder page
Nov 2010     Dallas Cowboys         dallascowboys.com lapsed; a for-sale page went up the night the coach was
                                    fired
2010         DSPT International     A helper registered the company's domain in his own name and withheld it
                                    over commissions; jury found cybersquatting, about $152,000 (9th Cir.)
Jun 2013     Alaska Health Fair     Developer held the domain over a ~$1,500 invoice; panel ordered it returned
Jul 2017     Marketo                marketo.com expired over a ~$35 renewal; auto-renew had been set up by
                                    someone who had left; a stranger paid $73.98 to renew it; ~2 days down
Sep 2017     Fox-IT                 Registrar password unchanged since 2013, no 2FA offered; attacker changed
                                    DNS, read email, ran a fake client portal for 10 hours 24 minutes
2020-2021    perl.com               Taken from Network Solutions with forged documents; moved twice, pointed
                                    at a malware address; recovered in February 2021
Jul 2024     Squarespace customers  Accounts migrated from Google Domains taken over by email address alone
                                    before owners had set them up; sites redirected to phishing pages

Three patterns, in order of how often they hit small businesses. The domain sits in someone else's name or account and that relationship ends badly. The renewal fails because the card on file expired or the reminder went to a mailbox nobody reads anymore; Marketo's auto-renew was set up by someone who had left. Or the registrar login is weak and someone takes it. Big companies get their domains back because they are big. You'd be relying on the rules below.

What happens after a domain expires

For .com, .net, .org and the other generic domains, ICANN's Expired Registration Recovery Policy sets the floor. Your registrar must send at least two reminders before expiry, about a month and about a week out, and one more within five days after. At some point after expiry the website and email must stop working for at least eight days while you can still renew, with a page saying the domain expired; that is the last warning, and it takes your email down with it. After the registrar deletes the domain, the registry holds it for a 30-day Redemption Grace Period in which only you can restore it, for a fee, and then 5 days of pending delete before anyone can register it.

What ICANN does not set is how long you can renew at the normal price. That is each registrar's own policy, and the gap between them is large:

text

Registrar          Renew at normal price after expiry   Site and email stop      Restore fee in redemption
-----------------  -----------------------------------  -----------------------  --------------------------------
GoDaddy            to day 17 (auto-renew tried day 0,   day 5 (parked)           "additional fee", amount not
                   day 12)                                                       published; day 18 to 71
Namecheap          about 30 days                        at expiry (parked; mail  about $88 for .com, incl. renewal
                                                        to the domain is lost)
Squarespace        30 days (40 if held at Tucows)       not stated               $45 (.com/.net/.org), no waiver
Cloudflare         40 days                              day 30 (parked)          varies by TLD, shown before you pay
Porkbun            to about day 37                      after day 10             $200 + renewal
Network Solutions  up to 30 days, + $35.99 late fee     not stated               $99
IONOS              10 days after cancellation           not stated               $90 (mailboxes not restored)
Hover              about 34 days                        not stated               $175 + renewal, not guaranteed
Wix                about 30 days (may be auctioned in   at once                  varies, shown in the account
                   the last 10)

Read on each registrar's help pages, 25 October 2026. Namecheap's price converted from its
rupee display using another price on the same page.

The trap is the auction before the redemption period. At GoDaddy, an expired domain is listed on GoDaddy Auctions from day 26. Until day 29 you can still renew even with bids on it; from day 30 to 36 you can't if someone has bid; on day 43 a winning bidder becomes the registrant. Wix's registrar reserves the right to auction a domain privately in the last 10 days of grace. Domains at Network Solutions, Register.com, Bluehost, HostGator and other Newfold brands feed the NameJet and SnapNames auctions. A domain with traffic and links can be sold to a stranger before ICANN's 30-day redemption window ever starts.

If it does reach the public drop, the drop-catchers are waiting. DropCatch says 60,000 to 85,000 .com and .net names drop every day, starting at 12:00 UTC and taking about 45 minutes; a backorder there costs $59, charged only if it catches the name, and its software fires hundreds of registration attempts the moment a name frees up. You will not beat it by refreshing a registrar's search page.

Getting it back from someone who won't hand it over

If an ex-agency, developer or employee holds the domain and won't release it, ask in writing first, with the registrar's account-move steps attached (below), and say that the domain was registered for your business and paid for by it. If that fails, the Uniform Domain-Name Dispute-Resolution Policy is the standard route for .com and other generic domains. At WIPO it costs $1,500 for one to five domains with a single panelist and $4,000 with three, and a standard case normally finishes within about two months; since March 2026 WIPO also offers an expedited case for $4,000 and a one-month priority service. WIPO handled 6,168 cases in 2024 and over 6,200 in 2025, a record.

The catch is that UDRP needs a trademark, registered or common-law, and registration and use in bad faith. A business that has traded under the name for years usually has common-law rights; a plain payment dispute can still fail, which is why the Alaska Health Fair panel's finding that the developer was only an agent mattered. In the US, the Anticybersquatting Consumer Protection Act is the court route, as in the DSPT case, and courts have treated a domain as property (Kremen v. Cohen, 2003). Both cost far more than the ten minutes it takes to fix ownership now.

Locks, 2FA and the other protections

text

Protection                 What it does                                      Cost
-------------------------  ------------------------------------------------  ---------------------------------
Registrar lock             Registry refuses transfer requests; on by default  Free at most registrars
(clientTransferProhibited)  at many registrars; ICANN: "not a fail-safe"
2FA on the registrar       Stops the Fox-IT kind of takeover                  Free; use an authenticator app,
account                                                                       passkey or security key, not SMS
Auto-renew + a card that   Stops the Marketo kind of lapse                    The renewal (.com about $11-23 a
won't expire soon                                                             year depending on registrar)
Multi-year registration    Fewer renewals to miss; maximum 10 years           10 x the yearly price up front
Registry lock              Changes need out-of-band confirmation between      Not offered by most registrars;
(.com via Verisign)        registry and registrar                             reported from about $12 a month
                                                                              to several hundred a year
DNSSEC                     Stops forged DNS answers; does NOT stop someone    Free at most registrars
                           who has logged in to your account

Every registrar we checked offers app-based 2FA: GoDaddy, Namecheap, Squarespace, Cloudflare, Porkbun, Network Solutions, IONOS and Hover, and most accept passkeys or hardware keys. Turn it on, and put the registrar login in the company's password manager rather than one person's head (our password manager rollout covers who should see which login). For a business whose site is how customers find it, a ten-year registration is cheap insurance: about $110 to $230 for a .com depending on the registrar. Verisign raises the .com wholesale price from $10.26 to $10.97 on 1 November 2026, so prices nudge up from next week.

Use an email address for the registrar account and the registrant contact that the company controls and that is not on the same domain. If the domain lapses, its email stops, and the renewal reminders go nowhere. A shared mailbox on a different domain (or a company-owned Gmail or Outlook account kept just for this) means the warnings reach someone even when the main domain is down.

The handover checklist

text

1. Look up the domain at lookup.icann.org. Note the registrar, the expiry date and the status
   codes (clientTransferProhibited = locked; redemptionPeriod or pendingDelete = act today).
   The registrant's name is usually hidden since GDPR; the registrar will tell the account
   holder, or ask whoever has the login to screenshot the contact page.
2. Find out who has the registrar login. If it isn't someone on your payroll, ask them to move
   the domain into an account the business owns, at the same registrar:
     GoDaddy:    "Transfer my domain to another GoDaddy account"; you accept within 10 days.
     Namecheap:  Domain List > Manage > Sharing & Transfer > Change Ownership; link valid 7 days.
     Cloudflare: account-to-account move; approve within 5 days; locked 30 days afterwards.
   This keeps DNS working, needs no auth code and doesn't add a year. Website and email
   products at GoDaddy don't move with the domain; check them separately.
3. Set the registrant to the company's legal name and a company-controlled email. Changing the
   name, organisation or email is a "change of registrant" under ICANN's 2016 rule and locks
   the domain against moving registrar for 60 days unless you opt out first. That's fine if
   you're staying put.
4. Turn on 2FA with an app or passkey. Store the login and recovery codes in the company's
   password manager. Give a second person in the business access.
5. Turn on auto-renew with a company card, and renew for several years now. Put the expiry
   date in the company calendar a month ahead anyway.
6. Check the registrar lock is on. Turn on DNSSEC if your DNS host supports it.
7. Write down where DNS is hosted (often a different company from the registrar) and do steps
   2 and 4 for that account too. Whoever controls DNS controls your email.
8. If you're moving registrar instead: unlock, get the auth code (the registrar must give it
   within 5 days), start at the new registrar. Not possible within 60 days of registration or
   a previous transfer, and usually not once the domain is in redemption.

ICANN adopted new transfer rules on 7 June 2026: a mandatory 30-day lock after registration and after each transfer (instead of the optional 60 days), transfer codes that expire after 14 days, and no more 60-day lock after a change of registrant. No effective date had been published when we checked, so the 2016 rules above still apply.

If you're setting up a business online for the first time, buy the domain yourself, in the company's name, before anyone builds anything; our guide to setting up a small business online in an afternoon walks through the domain, email and the rest in order.

The domain, a business email on it, a simple site and the accounts around them, set up in the right order and in your own name. A free kit for a small business, with the tools in one place.

Open the small business kit

Sources

ICANN: Expired Registration Recovery Policy and registrant guide; auto-renew grace period; renewal and expiration FAQ; EPP status codes; Transfer Policy (2016); Board resolution of 7 June 2026 and the Transfer Policy Review final report (Feb 2025); ICANN blogs on domain portfolios (2017) and what registrants need to know (2018); RDAP replacing WHOIS (Jan 2025); Registration Data Policy.

Registrars (read 25 Oct 2026): GoDaddy expiration timeline, GoDaddy expired auctions, GoDaddy account move; Namecheap after expiry, grace periods, redemption prices, account move; Squarespace grace and redemption fees; Cloudflare Registrar FAQ; Porkbun; Network Solutions; IONOS; Hover; Wix domain life cycle; renewal prices from domainoffer.net and Porkbun; Namecheap on registry lock; Verisign Q1 2026 call (.com price).

Drops and disputes: DropCatch; Domain Name Wire on NameJet and SnapNames sources (Aug 2025); WIPO fees, new expedited services (Mar 2026), 2024 caseload and 2025 caseload; Alaska Health Fair v. Jacobson (2013); DNAccess on DSPT v. Nahum and Kremen v. Cohen.

Cases: The Register on hotmail.co.uk (2003), Marketo (2017) and perl.com (2021); CMSWire on Marketo; TechCrunch on Foursquare (2010); Techdirt on the Dallas Cowboys (2010); Help Net Security on Fox-IT (2017); perl.org log; KrebsOnSecurity on Squarespace (Jul 2024).