The Domain Account Nobody Checks: A Registrar Review for Small UK Firms

Most small firms have a mental list of logins that matter: banking, email, payroll, maybe the alarm system. The domain registrar sits somewhere near the bottom, filed under "web stuff" and left alone until something breaks. That's the quiet problem. Your domain is the address customers type, the thing printed on the van, the link in every quote and invoice. If it lapses or gets hijacked, the shopfront doesn't close with a bang. It just quietly turns into a 404.

The good news is that a sensible registrar review takes about the length of a coffee break, and most of it involves clicking buttons you already have access to. Here's what to check, in plain English, plus a short rehearsal for the day it goes wrong.

Start with the boring question: who actually holds the account?

Before you touch a single setting, find out who owns the domain. Not the web designer, not the marketing agency, not the person who set it up in 2019 and has since moved to Spain. The registrant. For a .co.uk, that's the record held by Nominet. For a .com, it's whoever is listed with the registrar.

Log in and check the registrant contact details. Are they a company email address or a personal one? If it's a personal address belonging to someone who no longer works with you, that's a problem waiting to happen. Update it to a shared, monitored mailbox — something like [email protected] — and make sure more than one person can get into it.

While you're there, check the administrative and technical contacts too. A surprising number of small firms discover their domain is registered to a former IT contractor's Hotmail account. Fix that now, while it's a housekeeping task rather than an emergency.

Switch on the transfer lock (and leave it on)

The transfer lock — sometimes called registrar lock or clientTransferProhibited — stops anyone moving your domain to another registrar without your say-so. It's the equivalent of a deadbolt, and it should be on by default. Check it. If it's off, turn it on.

The only time you need to unlock it is when you genuinely want to move registrars, and then you should lock it again the moment the transfer completes. If you're not planning a move, there is no good reason for it to be off.

Auto-renew: yes, but not blind

Auto-renew is your friend. A lapsed domain can be snapped up within hours, and getting it back is rarely cheap or quick. Make sure auto-renew is enabled for every domain you own — including the ones you'd forgotten about, like the old product site or the redirect you set up for a campaign in 2022.

But don't just tick the box and walk away. Check the payment card on file. Is it still valid? Does it expire before the next renewal date? Is it a company card belonging to someone who has changed roles? A failed card is one of the most common reasons domains lapse, and the renewal reminder email often lands in a mailbox nobody reads.

Set a calendar reminder two weeks before each renewal date anyway. Belt and braces.

Make sure you'll hear about DNS changes

DNS is the bit that tells the internet where your website and email live. If someone changes your DNS records without permission, they can redirect your traffic, intercept email, or point your domain at a fake login page.

Most registrars let you switch on alerts for DNS changes. Turn them on, and send them to a shared mailbox that at least two people check. If a change happens and nobody notices for a fortnight, the alert has done nothing.

Write down who owns what

This sounds like the least exciting instruction in the world, and it probably is. But a single page listing every domain you own — registrar, account email, renewal date, DNS provider, and who has access — will save you hours of scrabbling around when something goes wrong.

Keep it somewhere sensible. A shared drive, a password manager note, a document in your IT folder. Not in one person's head. The goal is simple: if the person who usually handles the domain is on holiday or has left, someone else can pick it up without a detective mission.

While you're at it, watch out for fake renewal invoices. These are emails that look like a domain renewal notice but come from a different company, often with an inflated price and a tight deadline. They rely on you paying quickly without checking. If an invoice arrives by email and you weren't expecting it, log in to your registrar directly rather than clicking anything in the message.

The rehearsal: what if the domain is lost?

You wouldn't wait for a fire to test the smoke alarms. Spend ten minutes thinking through what you'd actually do if your domain vanished tomorrow.

First, know your registrar's support number and your account number. Keep them in that one-page record. Second, know how to contact Nominet for .co.uk domains, or your registrar's abuse team for others. Third, have a copy of your current DNS records saved somewhere outside the registrar — a screenshot or an export file is fine. Fourth, decide now what you'd put on a temporary holding page and who would tell customers.

That's it. No drama, no elaborate plan. Just enough so that the first hour of a domain problem isn't spent working out who to call.

The short version

Lock the transfer, check auto-renew and the card behind it, update the recovery contacts to a shared mailbox, switch on DNS alerts, and write down the essentials on one page. Then do the ten-minute rehearsal once a year, ideally at the same time you check your cyber insurance or your backup drill.

Your domain is the shopfront. Locking the door takes less time than you think — and it's a lot less painful than explaining to customers why the website has disappeared.