Who Actually Controls Your Domain and DNS? The Audit Every Canadian Business Should Run

Whoever is listed as the registrant controls your domain, regardless of who paid for it. If your web designer, former employee, or old IT provider is in that field, they hold the asset your email and website depend on. Paying the invoice does not transfer registrant status, and in a dispute the registrar follows the record, not your receipts. This is the single most common recoverable failure in Canadian small business IT.

By the Wise Media strategy team, Calgary, Alberta. Updated October 2026. This article explains registrar and registry policy mechanics and is general information, not legal advice. Policies change; verify against ICANN, CIRA, and your registrar before acting on anything here.

Summary

• Four separate things get confused as one: the registrant (who owns it), the registrar (where it is bought), the DNS host (what answers lookups), and the web host (where the site files live). They can sit with four different companies.
• ICANN’s Transfer Policy requires your registrar to give you the authorisation code and remove the transfer lock within five calendar days of your request where no self-service option exists.
• Changing the registrant name, organisation, or email triggers a mandatory 60-day transfer lock on gTLDs such as .com. You can opt out, but only before you request the change.
• For .ca domains, CIRA states a change of registrar “will occur immediately with no pending period,” which is materially different from the gTLD process, and the registrant must meet Canadian Presence Requirements.
• You can move hosting without touching the domain at all. Changing nameservers avoids the transfer process and every lock attached to it.
• The audit below takes about twenty minutes and should be run before you need it, not during an outage.

Table of contents

1. The four roles everyone collapses into one
2. How to check who actually controls your domain right now
3. What ICANN’s Transfer Policy actually says
4. How .ca domains differ, and why it matters in Canada
5. The lockout scenarios, and how each one gets resolved
6. DNS: the part that breaks email when nobody expects it
7. The twenty minute domain control audit
8. FAQ

The four roles everyone collapses into one

Your domain involves four distinct roles. People say “my web guy has my domain” without knowing which of the four they mean, and the four have completely different consequences.

Role	What it is	Risk if someone else holds it	How hard to recover
Registrant	The legal holder of the registration	They own the domain. Full stop.	Hard. Requires their cooperation or a formal dispute
Registrar	The company the domain is registered through	Inconvenient, not fatal, if you are the registrant	Moderate. A transfer with lock periods
DNS host	The nameservers answering lookups for your domain	They control where your site and email resolve	Easy if you control the registrar account
Web host	The server your site files sit on	They hold your files, not your address	Easy. Rebuild or migrate and repoint

Only the first row is an ownership problem. The other three are access problems, and access problems are solvable in an afternoon when the registrant field is correct. This is why the registrant field is the only one worth losing sleep over.

Why the invoice does not help you

Registrars operate from the registration record. Who paid, who had the idea, and whose business name is in the domain are not fields in that record. If a contractor registered the domain under their own name and billed you for it, the registration says it is theirs and the receipt says you bought a service. Resolving that is a legal argument or a negotiation, not a support ticket.

This sits alongside a broader problem we cover separately in who owns your website in Canada. The domain is the piece most often missed, because unlike the site files it is invisible until the moment it matters.

How to check who actually controls your domain right now

Three checks, about ten minutes, no technical skill required. Do them before you read the rest of this article, because the answers determine which sections apply to you.

1. Look up the public registration record. Use ICANN Lookup for gTLDs such as .com and .net, or CIRA’s WHOIS for .ca. Note the registrar name, the creation date, the expiry date, and the domain status codes.
2. Try to log in to the registrar directly. Not through your web designer. Go to the registrar named in the lookup and attempt a password reset against an email address your business controls. If no account responds, you do not have registrar access.
3. Check the nameservers. The lookup shows them. If they point to your web host, your DNS lives with the host. If they point to the registrar or a service such as a CDN, DNS lives there instead. That tells you where to go to change where your site and email resolve.

Note that registrant contact details are often redacted in public lookups for privacy reasons, so the record may not name the holder. That is normal and not itself a problem. The test that matters is step two: can you log in and see the domain in an account you control. If you cannot, assume you do not control the domain until proven otherwise.

Status codes worth recognising

Status	What it means	Action
clientTransferProhibited	The registrar has locked the domain against transfer	Normal and good. It is a theft protection. Remove it only when transferring
clientHold	The registrar has pulled the domain out of DNS	Urgent. Usually non-payment or a verification failure. Your site is down
pendingTransfer	A transfer is in progress	If you did not start it, contact the registrar immediately
redemptionPeriod	The domain expired and was deleted	Recoverable but typically only through the current registrar, with a redemption fee
serverTransferProhibited	The registry, not the registrar, has locked it	Often a dispute, court order, or registry level hold

What ICANN’s Transfer Policy actually says

For generic top-level domains such as .com, .net, and .io, transfers are governed by ICANN’s Transfer Policy, which binds every accredited registrar. The version currently published was updated 21 February 2024, with contracted parties permitted to implement from 21 August 2024 and required to implement no later than 21 August 2025. These are the provisions a business owner needs.

Your registrar has five days, not whenever they feel like it

Where a registrar does not offer a self-service option, it must provide the authorisation code and remove any clientTransferProhibited status within five calendar days of your initial request. A registrar that stalls past that window is out of policy, and ICANN accepts formal transfer complaints. A transfer also cannot be denied purely for non-payment of a transfer fee.

The three 60-day locks, and only one of them is mandatory

Trigger	Length	Mandatory?	Can you avoid it?
Within 60 days of initial registration	60 days	No, registrar may deny	Ask. Some registrars allow it
Within 60 days of a prior transfer	60 days	No, registrar may deny	Ask. Policy permits denial, not requires it
After a change of registrant	60 days	Yes, registrar must impose	Only by opting out before requesting the change

The third row is the one that catches people. If you are buying a business, taking a domain back from a contractor, or simply correcting the registrant to your corporation’s name, and you also want to move registrars, do the transfer first and the registrant change second. Reverse that order and you are locked out of transferring for sixty days.

A correction worth making

A number of articles published over the past year state that ICANN has eliminated the 60-day change of registrant lock. Read against the Transfer Policy text ICANN currently publishes, that is not what the policy says: the registrar “must impose” the lock, with a pre-change opt-out. Policy reform work has been underway and the rules may well change, so check the current ICANN policy text yourself before you plan a transfer around a blog post. That includes this one.

The default approval nobody mentions

Under the policy, the registrar of record must send the Form of Authorization to the holder no later than twenty four hours after the registry notifies it of a transfer request. If that registrar does not respond to the registry’s notice within five calendar days, the transfer is approved by default. This cuts both ways. It means a legitimate transfer cannot be stalled indefinitely by an unresponsive incumbent. It also means an unauthorised transfer request against a domain nobody is monitoring can complete through sheer silence, which is precisely why you leave clientTransferProhibited on and keep the registrar contact email on an address you actually read.

How .ca domains differ, and why it matters in Canada

.ca is not governed by ICANN’s Transfer Policy. It runs under CIRA’s own General Registration Rules, and the differences are practical rather than academic. Most guides on this topic are written for a United States audience and skip .ca entirely, which is a problem when it is the default domain for Canadian businesses.

Mechanic	gTLD (.com, .net)	.ca (CIRA)
Who may be the registrant	Anyone	Must meet Canadian Presence Requirements
Auth code turnaround	5 calendar days	5 calendar days
Registrar change timing	Up to 5 days, default approval if no response	“Immediately with no pending period”
Registration period on transfer	Varies by registry	CIRA adds one year, to a 10 year maximum, fee applies
60-day restriction	After registration, prior transfer, or registrant change	After registration date or a previous registrar change
Redemption Grace Period	Typically 30 days	30 days
Auto-Renew Grace Period	Varies	45 days

The Canadian Presence Requirement is a real constraint

A .ca registrant must satisfy CIRA’s Canadian Presence Requirements. This has a consequence most owners never consider: if your .ca is registered to an individual contractor rather than your corporation, correcting that is a change of registrant where the incoming registrant must independently qualify, already be a CIRA registrant, and accept the Registrant Agreement. It is not a form you fill in unilaterally.

The upside is that CIRA’s registrar change is clean. Where a gTLD transfer involves a waiting period and a default approval mechanism, CIRA’s rules state the change of registrar occurs immediately once submitted. If you are moving a .ca away from an uncooperative provider, the bottleneck is obtaining the authorisation code, not the transfer itself.

The lockout scenarios, and how each one gets resolved

Scenario one: the designer registered it under their own name

The most common case, and usually not malicious. They registered it during the build because it was faster than waiting for your details. Resolution: ask for a change of registrant to your business, in writing, while the relationship is good. Have them opt out of the 60-day lock before submitting if you also intend to move registrars. Most designers comply immediately. The ones who do not are telling you something useful about the relationship.

Scenario two: the provider has gone quiet

Resolution: if you are the registrant but lack account access, go directly to the registrar with proof of identity and request account recovery. Registrars have processes for this. If you are not the registrant, this becomes a legal matter, and your leverage depends on your contract. If the domain is also approaching expiry, flag that to the registrar, because an expired domain in redemption is a far worse position than a contested one that is current.

Scenario three: a former employee is the registrant

Resolution: handle it in the offboarding checklist, not afterwards. If they have already left, approach it as a change of registrant request first and escalate only if refused. Check your employment agreement for an assignment of intellectual property and business assets clause before you escalate.

Scenario four: the domain expired and the site is down

Resolution: move immediately. After expiry a domain enters an auto-renew grace period, then a redemption period of roughly thirty days during which recovery usually requires the current registrar and a redemption fee. After redemption it goes to release and anyone can register it. Under the Transfer Policy an expired domain can still be transferred unless a prior registration period is unpaid, but a domain in redemption must be restored by the current registrar first.

Scenario five: you control the domain but the host is holding the site

Resolution: this is the good problem. If you hold the registrar account, you change the nameservers and point the domain wherever you like. You may lose the site files, but you keep the address, the email, and the search equity. Rebuilding a site is a project. Losing a domain is a rebrand. If you are facing a rebuild, our guides on migrating to WordPress and redesigning without losing search traffic cover how to do it without compounding the damage.

DNS: the part that breaks email when nobody expects it

Your domain’s nameservers decide which records are authoritative. Point them at a new provider and every record moves with them, including the ones nobody remembered existed.

This is how a routine hosting migration takes down company email. The old nameservers held MX records pointing at your mail provider. The new ones do not. The website comes up correctly and mail stops arriving, often silently, because senders receive bounces you never see.

Export every record before you change a nameserver

• A and AAAA records, pointing the domain at a server address.
• CNAME records, including the ones added by third party tools you forgot you connected.
• MX records for email. Lose these and mail stops.
• TXT records carrying SPF, DKIM selectors, DMARC, and domain verification tokens for services such as search consoles and workspace providers.
• SRV records, used by some voice and collaboration tools.
• CAA records, which restrict which certificate authorities may issue for your domain.

The authentication records in the TXT row are the quiet ones. They do not break the website, so nobody checks them, and the symptom shows up weeks later as deliverability decay rather than an outage. We cover that failure mode in detail in why your emails are going to spam.

Lower the TTL before you migrate, not during

Each DNS record carries a time to live telling resolvers how long to cache it. If yours is set to 24 hours and you change a record, some resolvers keep serving the old answer for a full day. Drop the TTL to 300 seconds at least 48 hours before a planned migration, make the change, confirm it propagates, then raise the TTL back. This one habit converts most migration incidents into non-events.

The twenty minute domain control audit

Run this once, write the answers down somewhere your business controls, and review it annually.

1. Identify the registrar for every domain you own, including the misspellings and the old brand names you still redirect.
2. Confirm you can log in to each registrar account using an email address your business controls, not a personal or contractor address.
3. Check the registrant is your legal business entity, spelled correctly, with a current address.
4. Verify the contact email on the registration is monitored. Expiry and transfer notices go there and nowhere else.
5. Turn on auto-renew and confirm the payment method on file is not an expired card belonging to someone who no longer works for you.
6. Confirm the transfer lock is on. clientTransferProhibited should be present on any domain you are not actively moving.
7. Enable two-factor authentication on the registrar account.
8. Export your full DNS zone to a file and store it with your business records.
9. Record where DNS is hosted, which may not be the registrar.
10. Document all of the above in a single place a second person in your business can reach.

Step ten is the one that gets skipped and the one that matters most. A domain controlled solely by a founder who is unreachable is functionally the same as a domain controlled by a contractor who is unreachable.

What to put in your next web contract

• The client is the registrant on all domains. The provider may administer, not hold.
• The client holds the registrar account; the provider receives delegated access.
• A full DNS zone export is delivered at launch and after any material change.
• On termination, all access is transferred within a stated number of days with no conditions attached.
• No domain is registered on the client’s behalf without the client’s own registrant details.

Common mistakes

• Changing the registrant and then trying to transfer. Do it in the other order, or opt out of the lock first.
• Registering the domain to an individual rather than the corporation. It complicates a sale, a dispute, and a .ca eligibility check all at once.
• Using a contractor’s email as the registration contact. Every expiry warning and transfer notice goes to someone who may no longer be reading.
• Removing the transfer lock permanently “to make things easier.” It is a theft protection, and the default approval mechanism makes it meaningful.
• Letting the domain and the hosting renew on different cards with different owners. One lapses, and you find out via a customer.
• Treating DNS as the host’s problem. Your MX, SPF, DKIM, DMARC, and verification records are business infrastructure. Keep an exported copy.
• Not auditing the domains you no longer use. Expired old brand domains get re-registered by others, and the backlinks pointing at them stop being yours.

Frequently asked questions

How do I find out who owns my domain name?

Run a public registration lookup through ICANN Lookup for gTLDs or CIRA’s WHOIS for .ca. Registrant contact details are frequently redacted for privacy, so the definitive test is whether you can log in to the registrar named in that record using an account your business controls. If you cannot, you do not control the domain, regardless of whose name appears on the invoices.

Can my web designer hold my domain hostage?

If they are listed as the registrant, they hold a real asset and recovering it needs their cooperation or a formal dispute process. If you are the registrant and they merely have account access, you can go to the registrar directly, prove identity, and recover the account. The distinction is entirely about the registrant field, which is why checking it is the first thing to do.

How long does a domain transfer take?

For gTLDs, typically five to seven days. The registrar of record must send the authorisation form within twenty four hours of the registry’s notice, and if it does not respond within five calendar days the transfer is approved by default. For .ca domains, CIRA’s rules state the registrar change occurs immediately with no pending period once submitted, so the real wait is obtaining the authorisation code.

Why can I not transfer my domain right now?

Most often one of four reasons: the domain was registered or transferred within the last 60 days, the registrant details were changed within the last 60 days, clientTransferProhibited is still set, or there is an unresolved dispute or registry level hold. Check the status codes in your registration lookup first, then ask your registrar which specific restriction applies.

Do I need to move my domain to change web hosts?

No, and in most cases you should not. Changing nameservers or updating the A record points the domain at a new host without touching the registration, which avoids the transfer process and every lock attached to it. Keep the domain wherever it is, repoint DNS, and migrate the site. Move the registrar only when you actually want to change registrar.

What happens if my domain expires?

It stops resolving, so your site and email go down. It then passes through an auto-renew grace period, followed by a redemption period of roughly thirty days during which recovery usually requires the current registrar and a redemption fee. After that it is released and anyone may register it. Act in the first days, not the last.

Should my business use .ca or .com?

Own both where you can, and redirect one to the other. .ca signals Canadian presence to customers and requires meeting CIRA’s Canadian Presence Requirements, which is a modest trust signal in itself. .com is the global default and the one people type by habit. The control mechanics differ between them, so audit each separately rather than assuming settings carry across.

The bottom line

Your domain is the only part of your web presence that cannot be rebuilt. Hosting can be replaced in a day. A website can be rebuilt in weeks. A domain you do not control is a rebrand, and it takes your email, your search equity, and every printed thing with your address on it along with it.

Twenty minutes of checking is the entire mitigation. Confirm the registrant is your business, confirm you can log in, confirm the contact email is one you read, export your DNS, and write it down where a second person can find it. Do that this week and the scenarios in this article stop being your problem.

Get your domain and DNS audited properly

Wise Media runs a domain, DNS, and access audit as part of every website build and every growth engagement, because we would rather find this before a migration than during one. If you are not certain who holds your domain, or you are about to move hosts and want the DNS handled without taking email down, we will check it and tell you exactly what you control. Ongoing coverage of this sits inside our website maintenance plans.

Start with the Wise Media intake form and tell us your domain. We will come back with what the public record shows and what we would fix first.

Sources

• ICANN Transfer Policy
• ICANN, FAQs for registrants: transferring your domain name
• ICANN, About change of registrant
• CIRA General Registration Rules
• ICANN Lookup