5 questions before letting an agency host your domain

A domain name is the single most strategic asset a business owns online. Lose the building, you can rent another one. Lose the domain, every Google ranking, every backlink, every email address, every customer's bookmark, every printed business card, every Companies House registration is broken at once.

Yet domains are the asset most often quietly held by suppliers. The agency registers it "for you" during the build, lists themselves as the contact, charges the renewal, and, for years, nothing goes wrong. Then a dispute starts, or the agency closes, or the founder gets a better quote elsewhere, and the question of who actually owns the name suddenly matters.

This guide is the five questions I would ask before letting anyone hold a domain on my behalf. One bad answer is enough to walk away. Two bad answers and you do not have a supplier, you have a leverage problem.

01The five questions, in order

Ask all five. If you get fewer than five clean answers, you have a problem to fix this month, not next year.

02Question 1, Registrar in whose name?

The registrant is the legal owner of the domain. For a .uk domain, Nominet records the registrant in a public WHOIS lookup (with personal addresses redacted for individuals). For a .com, ICANN records the registrant. The agency may be listed as the technical contact, the admin contact, or the billing contact, but the registrant should be the business that the domain represents.

How to check, in 60 seconds

For a .uk domain:

1. Go to whois.nominet.uk.
2. Search your domain.
3. The "Registrant" field shows the legal owner. If it shows your agency's name and address, not yours, the domain is theirs, not yours.

For a .com / .co / .org:

1. Go to who.is or lookup.icann.org.
2. Search your domain.
3. Inspect the "Registrant Organization" field. Same logic.

What "in your name" should look like

For a limited company:

• Registrant Name: the company directors or "Company Secretary"
• Registrant Organization: the company name as registered at Companies House
• Registrant Address: the registered office, not the agency's office

For a sole trader: your name, your address.

Walk-away signals

• The registrar is listed under the agency's email address (e.g. admin@agency.com).
• The "Organization" field shows the agency's trading name.
• The registrar is one the agency uses for all its clients (a multi-tenant reseller account where you have no individual login).

Acceptable answer

"The domain is registered at (registrar) in your company's name. You have your own login, we'll send you the credentials and 2FA recovery codes today. We are listed only as the technical contact."

Walk-away answer

"We hold it on your behalf, it's easier that way." Easier for them. Worse for you.

03Question 2, DNS in whose account?

The DNS is where the operation of the domain lives. Even if you legally own the domain, if the DNS is in the agency's Cloudflare or Route53 account, they can break your email, your site, and your SSL certificate in five minutes.

The three places DNS commonly lives

1. At the registrar itself. Acceptable for small businesses. The registrar is your single account; if it's in your name, the DNS is too.
2. At a managed DNS provider (Cloudflare, AWS Route53, DNS Made Easy, deSEC, Bunny DNS). Acceptable if the account is in your name and you have admin login.
3. At the agency's shared DNS account. Not acceptable, ever.

How to check

• Log into your registrar.
• Look for "Name servers" or "DNS configuration".
• If the name servers are ns1.youragency.com, the DNS lives at the agency.
• If they are ns1.cloudflare.com, ns2.cloudflare.com, the DNS lives at Cloudflare; the next question is whose Cloudflare account?
• Ask the agency to give you the login credentials for that Cloudflare account.

Acceptable answer

"DNS lives at (provider). Login is yours; we have invited-collaborator access; you can revoke us in one click. The 2FA recovery codes are in a 1Password vault you co-own."

Walk-away answer

"DNS is on our Cloudflare account, we manage it for you." Then they can deny you access at will.

04Question 3, Transfer-out policy in writing?

For UK domains, transfer-out is a regulated process. Nominet requires the registrar to release a domain to a new registrar on request, usually within 5 working days. For .com domains, ICANN requires the same with a 60-day post-transfer lock period.

What you want in writing:

• Transfer-out is unconditional. No outstanding-balance excuse. No "we're too busy this month."
• The agency does not charge a "transfer fee" beyond what the registrar itself charges (usually nothing).
• The agency provides the transfer authorisation code (the "auth code" or "EPP key") within 24 hours of a written request.
• The agency does not lock the domain (registrar lock can be enabled, but must be unlockable on request).

What the contract should say

Walk-away answer

"We can transfer it for a £250 admin fee", that fee is leverage, not labour. Nominet charges zero for a .uk transfer-out.

"Transfer-out takes 30 days", Nominet's actual process is 5 days, often same-day.

"We need to clear all invoices first", fine as a commercial point, but not a technical condition. Pay the bill, then transfer. The two should not be linked.

05Question 4, Who pays the renewal, directly?

This question separates two scenarios:

Scenario A, Healthy

The domain is in your name. Your credit card is on file at the registrar. You get the renewal email from Nominet / GoDaddy / 123-Reg directly. The agency may remind you, but the registrar invoices you, not them.

Scenario B, Risky

The agency pays the registrar, then re-bills you on a custom invoice marked "domain renewal, £45" (with a margin baked in). You have no direct relationship with the registrar. If the agency misses the renewal (cash-flow problem, oversight, dispute), your domain lapses without you ever knowing.

What can go wrong in Scenario B

• The agency stops trading. The renewal lapses. You find out 30 days later when the domain enters redemption. Recovery costs hundreds, sometimes thousands, plus a 30-day chase through Nominet.
• A dispute starts. The agency lets the renewal slip "by mistake". By the time you notice, the domain is in redemption and the agency has all the leverage.
• The agency's payment method fails. Nominet emails the agency. The agency doesn't forward the warning. Same outcome.

Acceptable answer

"You pay the renewal directly, it's your card on file at the registrar. We don't touch it."

Walk-away answer

"We bundle the renewal into our monthly invoice, it's simpler for you." Simpler. Not safer.

06Question 5, What does the agency keep if you leave?

This is the question that tests the whole arrangement. Domains are the high-value example, but the same question covers:

• The domain itself.
• The DNS account.
• The hosting account.
• The website source code.
• The email accounts (info@yourdomain.com, accounts@yourdomain.com).
• The Google Business Profile / Apple Business Connect listing.
• The SSL certificate (usually auto-renewed; not usually a problem, but worth confirming).
• Analytics history (Google Analytics, Plausible, etc.).
• The image library and brand assets used on the site.

What you want to hear

"Nothing of substance. The domain is yours; DNS is yours; hosting is yours; source code is yours and lives in your GitHub Organisation; email accounts are on your tenancy; the GBP listing is in your name; analytics history is exportable; brand assets you commissioned are licensed to you under the contract."

What you don't want to hear

"We've built up a lot of expertise in your account that would be hard to transfer." That sentence is leverage dressed as professionalism. The right transition is one in which the next supplier inherits documentation, not dependency.

07The healthy arrangement, what good looks like

A healthy domain arrangement, in one paragraph: the domain is registered in your company's name at a mainstream UK registrar; you hold the registrar login; DNS lives in a managed-DNS account (Cloudflare, deSEC, Route53) that is also in your name with the agency as a collaborator you can revoke; you pay the renewal directly with your card on file; the contract has a written transfer-out clause guaranteeing release within 7 working days at zero fee; and on cancellation the agency retains no operational lock on the domain, DNS, hosting, email, or source code.

If that paragraph describes your current setup, you're fine. Skip this page and read one of the other three guides.

If it doesn't, the next section is the recovery process.

08Recovering a domain held against you, practical steps

If you have just realised the domain is registered in the agency's name, here is the sequence I would run.

Step 1, Don't tell the agency, yet

If the agency holds the domain and you are mid-dispute, telegraphing your intent gives them time to lock the domain or let it lapse. First, do a WHOIS lookup yourself and confirm exactly what you're dealing with.

Step 2, Find out which registrar

The WHOIS record tells you the registrar. Nominet for .uk. Tucows / Wild West Domains / GoDaddy etc. for .com. Note the registrar's name.

Step 3, Read the contract

Look at every contract, MSA, or quote you signed with the agency. Search the PDF for the words "domain", "registrar", "renewal", "transfer". If the contract says "the agency will register and hold the domain on the client's behalf", that's a fiduciary relationship and Nominet has dispute procedures.

Step 4, Open a polite ticket asking for transfer

Write to the agency. Plain English. "I'd like to take ownership of the domain at the registrar. Please send the registrant-change procedure and the auth code by (date)." Keep it cordial. Do not threaten.

Step 5, If they refuse, Nominet DRS

For a .uk domain held against you, Nominet's Dispute Resolution Service (nominet.uk/disputes) is the recognised forum. It costs £200 for the standard service and decisions are usually issued within 60 days. The DRS is designed for exactly this case, a domain registered for a client that the client cannot recover.

For a .com domain, ICANN's UDRP is the equivalent (icann.org/resources/pages/udrp-2012-02-25-en). Slower, more expensive, but enforceable.

Step 6, Parallel: register a defensive variant

While the dispute runs, register a clean variant (yourbusiness.com if you're fighting for yourbusiness.co.uk, or vice versa). Use it as a defensive landing in case the dispute drags. Don't redirect customers there, keep it clean for SEO purposes, but have the alternative in your name.

Step 7, On recovery, fix the whole arrangement

Once the domain is back in your name, rotate every credential. Move DNS to your own account. Move hosting. Move email. Cancel the agency's renewal billing. Audit every access pathway.

09Sources + further reading

• Nominet, Registrant rights and the DRS · nominet.uk/disputes/
• Nominet, Transferring a .uk domain · registrar.nominet.uk/uk/registrars/registry-systems/transfer/
• ICANN, Transfer of registrations · icann.org/resources/pages/transfers-2012-02-25-en
• ICANN, UDRP procedure · icann.org/resources/pages/udrp-2012-02-25-en
• ICO, On data-controller / data-processor relationships · ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/
• WHOIS lookups, whois.nominet.uk · who.is · lookup.icann.org

A note on the long-form version

This guide is short on purpose. The five questions are the short version of a longer audit, registrar audit, DNS audit, email-MX audit, SSL audit, GBP-listing audit, GitHub / repo audit, hosting audit, analytics audit. If you want the long version run on your business, that is part of every UK Web Marketing onboarding. Direct download on the resources page; direct email on the contact page; same human at both.