Domain Registered to Someone Else (Like Your Web Developer)

Higher-risk issue — be cautious and consider professional help sooner.

Your business domain is registered to someone else — often your web developer, a former employee, or a marketing agency — so they, not you, legally control the name your customers type in and the email that runs on it.

Common signs of this issue

• You suspect your domain is registered to someone else — a WHOIS or RDAP lookup shows a registrar you have never logged into, or an organization that is not your business.
• You pay your web developer or agency for "hosting and domain" as one line item, and you have never received a renewal notice from a registrar yourself.
• Nobody at your company can log in to the account where the domain is registered, or the login belongs to someone who has left.
• Renewal reminders for your domain go to an email address you do not recognize or cannot access.
• Your developer has gone quiet, raised prices, or ended the relationship, and you are not sure you can take the website and email elsewhere.
• A registrar support agent told you they can only discuss the domain with the account holder or the registrant, and that is not you.

Safe checks you can do yourself

None of these require sharing passwords with anyone.

• Run a lookup at lookup.icann.org (ICANN's free registration data tool) and enter your domain. Write down the registrar name, the expiration date, and the status codes. These are shown even when the owner's personal details are hidden.
• Do not be alarmed if the owner fields say REDACTED FOR PRIVACY or show a privacy service. Since privacy laws like GDPR, most registrars hide personal contact data by default. It does not tell you who the registrant is — it only means you cannot see it publicly.
• Understand the two roles. The registrant is the legal holder of the domain. The account holder is whoever logs in at the registrar and clicks the buttons. Sometimes you are the registrant but your developer holds the account; sometimes they are both. Your options depend on which.
• Search your email (all inboxes, including old ones) for the registrar's name from the lookup — GoDaddy, Namecheap, Network Solutions, Squarespace Domains, Cloudflare, Tucows, and so on. An old purchase receipt or renewal email in your name is strong evidence of ownership.
• Check your records for proof of the business relationship: invoices from the developer that list the domain, your contract or proposal, and your business registration showing the trading name that matches the domain. Gather these before you ask anyone for anything.
• Ask the current holder, in writing and politely, to transfer the domain into your name and your own registrar account. At most registrars the quickest route is an internal account move (often called a "push" or "account change") to an account you create first; the alternative is an unlock plus a transfer authorization code so you can move it to a registrar of your choice.
• Once the domain is in your account, confirm the registrant contact shows your business and your email. Registrars usually email the old and new registrant to confirm a change of owner; answer those promptly or the change can stall.
• Before anything moves, make a note of the current DNS records (a screenshot of the DNS zone, or ask the developer to export it). Your website and your email depend on those records, and they must survive the move intact.
• Turn on auto-renew and two-factor login in your new registrar account, and add a second person at your business as a backup contact so this cannot happen again.

What this usually means

In most cases nobody set out to take your domain. A developer registered it for convenience when building the site, used their own account because it was faster, and bundled the renewal into their fees. That works until the relationship ends, the developer disappears, or a dispute starts — and then you discover the name your whole business runs on is legally theirs. If they are still reachable and reasonable, the fix is usually a friendly request and a fifteen-minute job on their side. If you are still stuck on logins to the site itself, regaining access to your website covers the wider picture.

The harder cases are when the developer is unreachable, refuses, or wants payment first. Registrars will generally only act for the registrant or the account holder, so if you are neither on paper, support staff cannot simply hand the domain over, however obvious the story. Your documents — invoices, contracts, emails showing you paid for the domain — are what turns "trust me" into a case. Some registrars have a formal ownership dispute or change-of-registrant process that accepts this kind of evidence; ask for it by name. If the domain is simply held at a registrar you want to leave, transferring a domain to another registrar walks through the unlock and code steps.

Formal routes exist but are a last resort. ICANN, which oversees domain rules, accepts complaints about registrars that are not following transfer rules, but it does not decide who owns a domain. The UDRP process is meant for bad-faith registrations of names that match a trademark, costs money to file, and is not designed for ordinary contract disputes with a former contractor. If it gets that far, speak to a lawyer — this page is not legal advice. The good news is that most cases never get there once the other side sees a clear, documented, polite request.

What not to do

• Don't let the domain expire hoping to buy it back cheaply. After expiry there is a grace and redemption period, and then it can be snapped up by anyone, including domain resellers.
• Don't threaten or insult the developer before you have asked properly. They hold the keys, and a calm written request gets results far more often.
• Don't pay a stranger who claims they can "recover" your domain for a fee. Only the registrar, the current holder, or a formal dispute process can move it.
• Don't point the domain somewhere new or change nameservers before you control the account — you can take down your own email in the process.
• Don't ignore a sudden renewal or ownership email about your domain. Check it by logging in directly, not by clicking the link, since fake renewal notices are common.
• Don't assume a privacy-redacted lookup means the domain is stolen. Redaction is normal and says nothing about who the registrant is.

When to get help

Bring in help when the developer is unresponsive, the registrar will not talk to you, or your email runs on the domain and cannot afford a gap. Moving a domain between people and registrars is easy to get wrong: a change of registrant can trigger a transfer lock, a careless nameserver switch can drop email for a day, and a missed confirmation email can quietly cancel the whole request. Someone who does this regularly knows what evidence registrars accept, how to preserve every DNS record, and how to word the request so it gets actioned rather than ignored.

Glenn, who runs WebsiteSelfHelp, helps small business owners get domains out of a former developer's hands and safely into their own name, with the website and email still working at the end. Tell him what the lookup shows and who holds the account, and you will get a plain answer on the realistic route and what it will take — no passwords needed to start.

Frequently asked questions

Related free guides