Who Owns Your Website Domain? Find Out Before You Move

A salon owner calls to say she's switching web people. Simple enough. Then we ask for the domain registrar login and she says she doesn't have one — the guy who built the site in 2019 "handles all that." He's not answering email. The domain renews in four months, on his credit card.

That's the whole problem in one paragraph. The website is rarely the hard part. The accounts underneath it are.

Nothing here means your current agency is dishonest. Most of the time this happens because someone set everything up quickly on their own accounts to get you live, and nobody ever went back to clean it up. But intent doesn't matter when you need access and the person who has it is on vacation, annoyed, or out of business.

The accounts that must be in your name

Five things. If you control these, you can fire anyone, hire anyone, and move anything without asking permission.

The domain registrar account. This is where yourbusiness.ca is registered — GoDaddy, Namecheap, Rebel, Cloudflare, whoever. The domain is the one asset you cannot rebuild. A website can be remade in a few weeks. A domain with ten years of links, printed menus, van decals, and Google history pointing at it cannot.

DNS. Separate from the registrar, sometimes. DNS is the switchboard that tells the internet where your website lives and where your email goes. Whoever controls DNS can point your domain anywhere — or, by accident, nowhere.

Hosting or the platform account. Shopify, Squarespace, WordPress hosting, your online ordering system. If the subscription is billed to the agency and sits under the agency's login, your site lives on someone else's lease.

Your Google Business Profile. The listing with your hours, photos, and reviews. This is the one owners forget, and it's arguably worth more than the website — see why your Google Business Profile is your real homepage. You should be the Owner. Everyone else is a Manager.

Google Analytics and Search Console. Less urgent, but if the agency owns the analytics property, your traffic history leaves with them. You lose your before-and-after when you redesign.

Two more worth adding: your business email (if it runs on your domain) and your payment processor. Stripe or Square should be connected to your bank account, under your login, always.

How to check tonight, in ten minutes

Start with a public lookup. Go to lookup.icann.org and type your domain. You'll see the registrar — the company the domain is registered through. Registrant details are usually hidden behind privacy, so this tells you where, not who. Still useful: now you know which company to log into.

Then try the password reset. Go to that registrar, click forgot password, enter your own email address. If a reset email arrives, the account is yours. If it says no account found, the domain is registered under someone else's email, and that's your answer.

Next, check your credit card statements for the last year. Search for the registrar name, your host, and your platform. If none of those charges are on your card, you are not the customer of record anywhere.

Finally, open your Google Business Profile from your own Google account. If you can edit hours directly, you have some level of access. To check whether you're the Owner and not just a Manager, open the Users or People panel and look for your own role.

Write down what you find. Five lines. That's your audit.

The polite ask

Ask before there's a conflict. The request lands very differently when you're happy with the work than when you're on the way out the door.

Frame it as housekeeping, not suspicion. Something like:

"I'm tidying up our business records for the accountant and our insurance. Can you make sure the domain, hosting, and Google profile are all registered under my name and my business email? Happy for you to keep full access — I just need to be the account owner on paper."

That does three things. It gives a reason that has nothing to do with trust. It explicitly says they keep working access, which removes the fear that you're firing them. And it names the specific accounts, so "you have access" isn't an acceptable answer.

A reasonable agency says sure and does it that week. Hesitation is information. If the answer is "it's easier if we keep it," ask what specifically gets harder. There's no technical task that requires the agency to be the legal registrant.

Give them access the right way

You're not trying to lock your web person out. You're trying to be the landlord instead of the tenant. Every platform worth using supports this.

• Domain registrar: your account, your email, your card. Add the agency as a delegate or share credentials with a password manager if they need day-to-day access.
• Hosting and platform: billed to you, agency added as an admin or collaborator.
• Google Business Profile: you're Owner, they're Manager. Managers can edit everything except ownership and deletion.
• Analytics: property under your Google account, agency added with edit access.

This costs nothing and changes nothing about how the work gets done. It only changes what happens the day you part ways.

What a real handoff looks like

If the domain needs to move to your own registrar account, expect a few mechanics.

The current registrar has to unlock the domain and release an authorization code — the EPP or transfer code. You give that to the new registrar. The transfer itself usually completes within a week. Note the lock: after a transfer, and after some registrant changes, the domain can't be transferred again for 60 days. So don't plan a move the week before a big campaign.

For your Google Business Profile, if someone else holds ownership you can request access from inside Google's interface. Google emails the current owner and gives them a window to respond. If they ignore it, you can usually claim it. If they decline, you're into an appeal, which is slower and more annoying.

The risk point in any move is email. If your email runs on your domain and the new host copies the website records but not the mail records, mail stops. Before you change anything, screenshot the full DNS record list. All of it. That screenshot is your undo button.

If they won't hand it over

First, read your contract or your original proposal. Many say, in plain language, that deliverables transfer on final payment. Pay any outstanding invoice — you don't want a fee dispute tangled with an access dispute.

If the domain is genuinely registered to them and they refuse, your options get worse: a formal demand letter, or a dispute process that's built for trademark conflicts and is not fast. Weigh that against the cost of a new domain. Sometimes moving to a slightly different domain and redirecting energy into your Google profile and your signage is less painful than a six-month fight. It is a real loss, but it's a bounded one.

The better move is to never be in that room. When you pick your next web partner, ask on the first call: who's the registrant, whose card pays the renewal, and what does a handoff look like if this doesn't work out. The answer tells you a lot. More questions worth asking are in how to choose a web agency in Toronto after a bad one.

For what it's worth, this is how we set up every build on our services side: domain and platform in the client's name from day one, our team added as admins. It makes leaving easy. That's the point. A client who can walk out the door at any time and chooses to stay is the only kind worth having.

Do this week

Run the ten-minute audit. Send the polite email. Save the logins somewhere that isn't a sticky note — a password manager, or a sealed envelope in the safe with your business licence and your lease. Treat the domain like a lease, because that's what it is: the address customers use to find you, and you want your name on it.