What the standard says
A domain is registered through a registrar, the company you pay to hold the name, usually for one to ten years at a time [1]. The person or organization listed as the registrant is the one the rules treat as the holder, and registrars must let that registrant renew it [2]. ICANN, the nonprofit that sets the rules for domain names, also says registrants must keep their contact information accurate and take sole responsibility for the registration [3].
Three things matter most.
Renewal. Registrars must send renewal reminders about one month and one week before a domain expires, and another notice within five days after [2]. Those reminders go to the registrant’s email, so an old or personal address can mean nobody sees them. After expiration, the registrar must stop the domain from working for at least the last eight days it can still be renewed, which means website and email go dark [2]. ICANN suggests asking your registrar whether you can renew for more than one year at a time [1].
Transfer lock. A status called clientTransferProhibited, often shown as “registrar lock” or “transfer lock,” tells the registry to reject requests to move the domain to another registrar [4]. ICANN says it helps prevent unauthorized transfers from hijacking and fraud [4], and its security committee encourages registrants to make sure it is set [5]. When you do want to move the domain, you ask your registrar to remove it [4].
Ownership of record. ICANN’s security committee advises listing the business entity as the registrant, so the business keeps its tie to the domain [5]. It also recommends contacts by role, like a shared admin mailbox, rather than one employee, which helps avoid disputes over ownership when people leave [5]. Its guidance adds that offboarding should check whether a departing employee has access to the registrar account [5].
Your report may also list:
An old subdomain still resolving. A subdomain is a name like portal.yourbusiness.com. If its DNS record still points at a service you’ve shut down, Microsoft calls it a “dangling DNS” entry, and someone else may be able to claim that service and put their own page on your subdomain [6]. Microsoft’s fix is to remove the DNS entry whenever a service is retired and to review DNS regularly [6].
What you’ll hear
“Our web developer registered the domain for us, so it’s ours.”
Usually the arrangement works fine, and many businesses rely on a developer or IT provider to handle registration. The developer is often doing the business a favor. The catch is in the record itself. Whoever is listed as the registrant is the one the transfer rules recognize, and to transfer a domain you must be the registrant of record or the administrative contact [7]. If the developer’s name or email is on the record, renewal reminders go to them [2], and moving the domain later depends on reaching them. Changing the registrant name can also block a transfer to a new registrar for 60 days [7].
The fair version: someone else can manage the domain for you, but the business should be the name on the registration.
What the numbers say
We couldn’t find a reliable public statistic on how many small-business domains expire by accident or are registered to the wrong person. Instead, here are the numbers ICANN publishes:
1 to 10 years: the typical length of a registration term [1].
About 1 month and 1 week before expiration: when registrars must send renewal reminders [2].
At least 8 days: how long a renewable, expired domain must stop working before the registrar can delete it [2].
30 days: the Redemption Grace Period after deletion, when the domain can usually still be recovered [1][2].
5 days: the pending delete stage after that, before the name is released to anyone [1].
60 days: how long a domain can’t move to another registrar after a change to the registrant name, unless the registrar offers an opt-out [7].
5 calendar days: how long a registrar has to give you the transfer code (Auth-Code) after you ask [7].
What we’ve seen
We haven’t run into this yet.
Putting it together
A domain stays yours only while it is renewed and registered to you. Put the business’s name and a shared email on the record, renew well before the deadline, and keep transfer lock on. Then clean out old subdomains so nothing points at a service you no longer run.
What good looks like
The business, not a person or vendor, listed as the registrant.
Contact emails on the record that go to a shared business mailbox.
Auto-renew on, with current payment details, or a multi-year registration.
An expiration date at least several months out.
Transfer lock turned on at the registrar.
The registrar login held by the business, with more than one person able to get in.
A list of subdomains in use, with old ones removed when a service is retired.
Questions for your IT resource
Which registrar holds our domain, and when does it expire?
Who is listed as the registrant, and which email gets the renewal notices?
Is auto-renew on, and is the card on file current?
Is transfer lock on?
If the registrant needs to change, how do we handle the 60-day transfer lock?
Do any of our subdomains point at services we no longer use?
Related learning
Who holds the keys to your domain and website?
Your domain registrar, DNS provider and web host each have a login, and whoever holds those logins controls your website and where your email is delivered. Give each one its own strong password, turn on MFA, and know who has access.
What is a lookalike domain, and how does it lead to fake invoices?
A lookalike domain is a web address registered to look like yours, such as one letter swapped or a different ending, and it can send email that passes normal checks. The best defense is a habit: confirm every payment change by phone, using a number you already trust.
How we put together your Free Security Assessment
The Free Security Assessment is a review of what’s already public about your business: your email setup, domain, website, phone listings and anything left open to the internet. We make one ordinary visit to your home page and never scan, log into or test anything.
Sources
ICANN, FAQs for Registrants: Domain Name Renewals and Expiration. (checked 2026-10-08)
ICANN, Expired Registration Recovery Policy, updated 21 February 2024. (checked 2026-10-08)
ICANN, Registrants’ Benefits and Responsibilities. (checked 2026-10-08)
ICANN, EPP Status Codes: What Do They Mean, and Why Should I Know?. (checked 2026-10-08)
ICANN Security and Stability Advisory Committee, SAC044: A Registrant’s Guide to Protecting Domain Name Registration Accounts, 5 November 2010. (checked 2026-10-08)
Microsoft, Prevent dangling DNS entries and avoid subdomain takeover, Microsoft Learn, updated July 2026. (checked 2026-10-08)
ICANN, FAQs for Registrants: Transferring Your Domain Name. (checked 2026-10-08)
How we rate these. Our judgment from real setups, applied the same way on every page. Cost: $ = no new spend or under $25/month · $$ = a modest monthly tool or a short project · $$$ = new hardware, licensing, or a larger project. Effort: Light = one sitting · Moderate = setup plus follow-up over days or weeks · Heavy = planning, testing and staff changes. Outlined marks show how far it can go for some businesses. N/A = doesn’t apply to this topic. Time to fix: how long the first useful step takes, then how long until it’s fully done. Ratings are typical averages, not quotes. Time to fix: the filled dot is when the first useful step lands, the hollow dot is when it’s fully done. Who can do it: highlighted chips are who can reasonably handle it.