Owning and renewing a domain name without losing it

Here is a useful test for any business with a website: if the person who set up the domain disappeared tomorrow, could someone else log in and renew it? If the answer is unclear, the domain is at risk, whatever the website looks like.

This note explains who holds what, which account settings matter, and what a renewal timeline looks like. Where it describes ICANN policy, that applies to generic endings such as .com. Country endings have their own registries and rules, covered briefly near the end.

Who holds what

In ICANN's terms, whoever holds the rights to a name is the registrant. You get the name through a registrar, an accredited company that may sell directly or through resellers, and the agreement you accept with the registrar governs fees, transfers and renewals. A separate registry runs each ending, and you never deal with it directly.

Your web host and your email provider are different again. A site can be running well on a host while the domain it depends on sits in another account, close to expiry. Know which login manages which service.

ICANN's statement of registrant responsibilities includes keeping your contact information accurate and promptly updated, answering your registrar's enquiries within 15 days, and keeping payment details current if you rely on auto-renew. It also says the registrant takes sole responsibility for the registration and use of the name. That is a reason to make sure the registrant is you.

Settings to check

The account owner. Log in and read the registrant name. It should be the business, or you personally, and not a developer, a former employee or a reseller's master account. If a freelancer registered the name for you, ask them to transfer it into an account you control, and keep the confirmation.

The notice address. Pick a mailbox that more than one trusted person can read. Avoid an address on the domain itself, because if the name lapses, that mailbox stops working just as the final warnings go out. Switch on two-step sign-in for the registrar account and record who holds the recovery method.

Auto-renew and the card. Auto-renew only works if the card on file is valid. Check its expiry date against the domain's.

The registrar lock. Many registrar panels show a transfer lock, technically a status that prohibits transfers. It prevents the name from being moved to another registrar without your action. Leave it on. Under ICANN's Transfer Policy, the registrar must give the holder an authorization code for a transfer, and must provide the code and remove the lock within five calendar days of a request if it offers no self-service way to do so. Registrars may also deny transfers within 60 days of a name's creation, and the policy requires a 60-day transfer lock after a change of registrant unless the holder opted out beforehand. Unlock only when you mean to move the name, then lock it again.

The public record. For generic endings, ICANN announced that RDAP became the definitive source of registration data from 28 January 2025, in place of the older WHOIS service. Personal details in public lookups are often masked, and a privacy service can show its own details instead. None of that changes who the registrant is in the registrar's records, so look at the registrar account, not at the public lookup, to confirm ownership.

The name servers. Note where the DNS records are kept. They may be at the registrar or at a separate host, and a copy of them belongs in your backups.

A renewal timeline

Use this as a calendar, not a hope.

• About 60 days before expiry. Confirm the date, the card and the auto-renew setting. Renew early if anything looks wrong.
• About one month before. ICANN's Expired Registration Recovery Policy requires registrars to send an expiry notice about now. If you have seen nothing, find out why.
• About one week before. The second notice is due. Treat it as the last easy chance.
• Just after expiry. A further notice is due within five days if the name has not been renewed or deleted. Where the registry permits it, the registrar must also stop the name from resolving, for at least the last eight days you can still renew, so the website and email go quiet while recovery is still possible.
• After deletion. Generic registries other than sponsored ones offer a 30-day Redemption Grace Period, during which the name can still be restored through the registrar. Restoring typically costs more, and the site stays down.

Do not plan around the later stages. They are a safety net with a hole in it, and fees and details depend on your registrar.

Names ending in .ca

CIRA runs the registry for .ca and publishes its own rules, including Canadian Presence Requirements for registrants. Before you register or transfer a .ca name, read CIRA's pages on those requirements and on the domain life cycle, and your registrar's terms. Grace periods and fees can differ from the generic rules above.

A one-page domain record

Keep this where the business can find it, and update it after every change:

`` Domain: Registrar and account email: Registrant name on the account: Expiry date: Auto-renew on? (yes/no) Card on file expires: Registrar lock on? (yes/no) Name servers / DNS host: Who holds the login and two-step recovery: Backup contact who can renew: Reminder set for (date): ``

Treat the registrar account like the lease on the shop. The website is what customers see; the domain is the right to keep showing it.

Prepared with AI assistance. Examples are fictional unless stated.