# Domain, Hosting, and Website Account Ownership > Find who controls your domain, DNS, hosting, and website accounts, with an example account list and practical recovery checks. Canonical: https://vassalmarketing.com/information/website-stewardship/domain-hosting-account-ownership/ **Maintained by Vassal Marketing** ยท Last updated on September 26, 2026 Reviewed at least quarterly and whenever a platform or rule it cites changes. General information, not legal or professional advice. Check rules that affect your business with a qualified professional. Could you renew your domain or give a new provider access without calling the person who built your site? This guide helps you find the accounts behind your website, confirm the business controls them, and put the recovery details somewhere your team can reach. ## Why this matters Your website address, website files, and business email may be managed in different accounts. The registrar manages the domain registration. DNS is the set of records that directs visitors and email to the right services. Hosting is where the website runs. One company can handle all three, but access to the page editor does not necessarily include access to the others. That distinction matters when a card expires, an employee leaves, or you change website providers. Finding the right account during a renewal emergency is much harder than checking it while everything works. Start with a short account list: the services you use, who controls each one, and how an authorized person gets access. ## Responsible practices ### Start with the domain Find the registrar, check the registrant details, and confirm that the business can sign in. Review the expiration date, payment method, renewal notices, and recovery contact. Keep a second reminder outside the registrar account. Automatic renewal still needs a working payment method and someone who reads the notices. Turn on registrar lock so the domain cannot be transferred without your approval. ### Draw a simple account map List the domain, DNS, hosting, website editor, email, forms, booking, and analytics services. Ask your provider to fill in the technical connections. For each service, record the login address, business owner, billing contact, renewal date, and the location of recovery instructions. Store a reference to your password manager rather than passwords or backup codes in this list. ### Give each person their own access Invite staff and providers through named accounts and suitable roles wherever possible. The business keeps the main account; a provider receives the permissions needed to do the work. When someone leaves, remove their access and check shared credentials, recovery contacts, and connected applications too. ### Make recovery work without one particular person Use multifactor authentication: an additional sign-in check alongside a password. Keep recovery methods available to authorized business personnel if the usual phone or employee is unavailable. Avoid depending entirely on an email address that would stop working if the same domain or provider account failed. Test the documented recovery path carefully without disabling working access. ### Check what can move before you need to move it Ask which files, content, licenses, and accounts belong to the business and which are rented or licensed from a provider. A hosted website may have export limits. Moving the website often only requires a DNS change; transferring the domain registration is a separate decision with its own requirements. Put the exit steps in writing while the relationship is straightforward. ## Worked example: An account list you can copy Illustrative example: a small service business has one website, business email, and an appointment tool. ### Domain registration Business owner controls the registrar account. Office manager checks renewal notices. Record the expiration date and password-manager entry name. ### DNS and email Business retains administrative access. Website provider documents which records serve the site; email administrator confirms mail-related records. ### Website hosting Business controls billing and recovery. Developer has a named collaborator account. Record where the current site can be exported or rebuilt. ### Booking and forms Office manager confirms the receiving calendar and inbox. Record the account owner, subscription renewal, and a fallback if the service is unavailable. You have enough to start when another authorized person can identify the right account and contact without asking the original developer. That person does not need every technical password. ## Account list checklist ### What you can check 1. Find your registrar and check when the domain renews. 2. Confirm that an authorized person at the business can access each critical account independently. 3. Use the example to complete your account list with your provider, then store it in a business-controlled location. 4. Choose an alternate person who can handle a renewal or recovery if you are unavailable. ### What to ask your provider to handle 1. Explain which DNS records support the website and business email, and preserve a copy before changing them. 2. Set up named roles, multifactor authentication, and a tested recovery path for critical accounts. 3. Document supported exports, license restrictions, and the exit steps for services the business might replace. ## Avoid these failures - Leaving the domain or recovery method tied to a former employee or provider. - Keeping passwords and recovery codes in the same broadly shared account spreadsheet. - Changing nameservers without preserving website and email records. Good website care lowers risk, but no provider can guarantee uninterrupted service. ## Questions business owners ask ### Who should control the domain? The business or appropriate legal owner should retain access to the registration, renewal, and recovery methods. A provider can help administer it through suitable access. Confirm the registrant details and account control; a website invoice alone does not establish either. ### Are DNS and hosting the same thing? DNS directs website and email traffic to the right services. Hosting supplies the environment where the website runs. They can be supplied by one company or several, so document the accounts separately. ### Must we transfer the domain when changing providers? Often you can keep the existing registrar and change only the required DNS records. Have the provider identify what is actually moving and review transfer requirements before starting a separate registration transfer. ### What if only the former developer has access? Gather the agreement, invoices, registration details, and any existing business access. Contact the provider or service through verified channels and ask for its ownership or recovery process. Avoid creating conflicting accounts or changing DNS before you understand the existing setup. ## Primary guidance - [ICANN: Information for domain name registrants](https://www.icann.org/registrants) - [ICANN: FAQs for transferring a domain name](https://www.icann.org/resources/pages/name-holder-faqs-2017-10-10-en) - [NIST: Multi-factor authentication for small businesses](https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication) - [NIST SP 1300: Cybersecurity Framework 2.0 Small Business Quick-Start Guide](https://csrc.nist.gov/pubs/sp/1300/final) ## Connected guidance - [Website Stewardship service](https://vassalmarketing.com/services/website-stewardship.md): See the care and update work available within an agreed service scope. - [SEO-safe website migrations](https://vassalmarketing.com/information/seo-migrations.md): Plan redirects, launch checks, and monitoring when the site or its URLs move. - [Google Business Profile ownership and access](https://vassalmarketing.com/information/google-business-profile/ownership-and-access.md): Keep business-profile access and recovery under business control. - [Domain and SSL certificate renewals](https://vassalmarketing.com/information/website-stewardship/domain-and-ssl-renewals.md): Keep the domain and security certificate from expiring without notice. - [Marketing account ownership inventory](https://vassalmarketing.com/information/resources/marketing-account-ownership-inventory.md): List every marketing account your business uses and who controls it.