Who owns your DNS records, and why the answer is often nobody
Nobody owns your DNS records by default. Two companies hold them: the registrar where the domain is registered, and the DNS host running your authoritative nameservers. A free public lookup names both in under a minute. It never names the person with the login, which is the part you have to chase yourself.
- Your domain has two separate sets of keys. The registrar account decides where your nameservers point, and the DNS hosting account decides what the records say.
- ICANN policy makes the registrar, the nameservers, the status codes and the expiry date public, while the registrant name, phone and email are redacted. The record names the companies, never the person.
- Whoever can edit your zone can move your mail with one MX record, pass a domain-validated certificate check, and leave you locked out for 60 days.
- An expiring domain stops resolving for at least the last 8 days it is still renewable, so a sudden outage is often the renewal warning rather than a fault.
- Four questions settle it. Name the registrar, name the DNS host, list everyone with access, and name the mailbox that gets the renewal notice.
Who owns your DNS records?
Nobody owns your DNS records the way you own a laptop. Two companies hold them. Your registrar holds the registration, and your DNS host runs the authoritative nameservers that answer for your DNS zone. The person who can change a record is whoever still has those two logins.
In a small company those logins are almost never held by one person, and often not by anyone you currently pay. The web designer registered the domain in 2014 and the registrar account is still in their name. The marketing agency added a TXT record for a mail tool in 2019 and nobody asked where. An IT provider changed the A record during a website move and wrote nothing down. That is the normal state of a 30-person business rather than a scandal.
Half of this is public, which is the useful part. ICANN's Registration Data Policy took effect on 21 August 2025 and requires a public lookup to publish the registrar name, the creation date, the domain status codes and the nameservers. The other half is private by design. The same policy requires the registrant name, street, phone and email to be redacted wherever law requires it. A free lookup therefore names the two companies holding your domain in under a minute, and never names the person holding the password.
We see the value of that stable identity from the other side of the market. Across the 730 city datasets behind this independent directory, 24,491 provider rows resolve to 11,971 distinct registrable domains, because the domain is the one identifier that still matches a provider years later. Firms rebrand, change phone numbers and move offices. The domain is what persists, which is also why losing it costs so much.
This is a different question from the one answered in What is DNS filtering, and do you already have it?. DNS filtering is about resolving other people's names safely. This post is about controlling your own zone, meaning the records that tell the rest of the internet where your website and your mail live.
Why does it matter who controls your DNS records?
It matters because whoever can edit your DNS zone can receive your mail, prove they are you to a certificate authority, and leave you locked out of your own domain. Three separate failures run off one login.
They can take your mail
Mail follows the MX record and nothing else. Microsoft states the consequence plainly in its own setup reference: when you update your domain's MX record, all email sent to that domain starts coming to Microsoft 365. The same mechanism works in any direction, including toward a server you have never seen. The FBI recorded 24,768 business email compromise complaints in 2025 with reported losses of $3,046,598,558, which is close to $123,000 per complaint. Quietly reading the mail is step one in most of them.
They can pass a certificate check
A domain-validated certificate proves control of DNS rather than ownership of a business. Let's Encrypt documents the test it applies, and its wording is the whole point. The DNS-01 challenge asks you to prove that you control the DNS for your domain name by publishing a TXT record under the _acme-challenge name. Publish it, collect the certificate, and a visitor sees a padlock with no warning at all. CISA described exactly this pattern in its alert on DNS hijacking, noting that attackers who modify the location to which an organization's domain name resources resolve can also obtain valid encryption certificates for an organization's domain names.
They can lock you out
ICANN's anti-hijacking rule can work against the victim once a change has already happened. Following a change to the registrant's information, registrars must impose a lock that prevents any transfer to another registrar for sixty days. Registrars may, but are not required to, let a registrant opt out of that lock before the change is requested. The rule exists to stop a stranger moving your domain. It also buys a stranger two months once the change is done.
How do you find out who controls your domain?
To find out who controls your domain, run four checks in the order below. The first two are public and take about a minute each. The last two are phone calls, and they produce the surprises.
- Run a WHOIS lookup on your domain and save the output. It returns the registrar, the creation date, the expiry date, the domain status codes and the current nameservers.
- Read the nameserver lines. They name the company whose DNS hosting actually answers for your zone, which is frequently neither your registrar nor your IT provider.
- Ask who can log in to each of those two accounts, by name, and how many people hold each password today.
- Check which mailbox receives the renewal notices, and whether a human being still reads it.
The nameserver line is the check people skip and the one that settles the question. Your registrar controls where the nameservers point. Whoever runs those nameservers controls the records themselves, including the A record for your website, the MX record for your mail, every CNAME record your tools need, and each TXT record an agency ever added. Recovering the registrar account does not hand you the zone. It hands you the power to delegate the zone to somewhere you control, which is a second job on a second day.
Read the status codes while you are in there
Status codes tell you whether the domain is defended. ICANN publishes what each one means. clientTransferProhibited tells the registry to reject requests to transfer the domain and helps prevent unauthorized transfers resulting from hijacking or fraud, while clientUpdateProhibited does the same for changes to the record itself. That registrar lock is usually a free checkbox, and most small businesses have never switched it on.
How long a change takes to spread
Every record carries a TTL, the number of seconds other servers cache the answer before asking again. Google tells administrators it can take up to 72 hours for new MX records to be recognized. Lower the TTL the day before a planned change and the internet picks up the new value faster. Three days is also roughly how long an unwanted change keeps working while people argue about whose job it is to undo it.
Write the four answers into one document and date it. CISA's performance goals ask organizations to maintain a regularly updated inventory of all organizational assets, including data, hardware, software, systems, facilities and personnel. A domain fits none of those five words comfortably, which is precisely why it falls off every inventory. Audit the page once a year and the surprises stop being surprises.
Three ways DNS ownership quietly goes wrong
Three patterns cause almost every case worth worrying about, and not one of them starts with a hacker.
The registrar account belongs to a vendor you stopped using
A designer registers the domain under their own account and bills you for it each year. The registration stays legally theirs until somebody changes the registrant, and changing the registrant starts the sixty-day clock described above. You keep paying, you keep trading, and you discover the arrangement in the week you try to move. Nothing was hidden. Nobody ever asked.
Nobody is counting the records
Each new tool adds a record, and the records pile up without an owner. SPF is where the pile becomes visible, because Microsoft publishes a hard ceiling. You can only have a single SPF record for your domain, and the total DNS lookups it produces cannot be more than 10. Add an eleventh sending service and the record stops working, so mail your customers expect starts failing a check nobody is watching. The records that carry your email authentication sit in the same zone as everything else, which means the access question decides them too.
The only contact is a person who left
This is the pattern that actually kills domains. The registrar account carries one email address, it belongs to an employee who left in 2022, auto-renew points at a card that has since expired, and every notice lands in a mailbox nobody opens. ICANN's statement of registrant responsibilities is blunt about the duty. You must respond to inquiries from your registrar within fifteen days and keep your registrar account data current.
What happens when a domain expires?
An expired domain does not disappear on the expiry date. Domain expiry runs on a published schedule set by ICANN's Expired Registration Recovery Policy, and that schedule gives you more warning than most owners realize, provided somebody reads the mail.
Registrars must send at least two expiration notices, one approximately one month before expiration and one approximately one week before. If the registration is then neither renewed nor deleted, one further notice goes out within five days after expiration.
Then the lights go out on purpose. Where the registry permits the interruption, the policy requires the registrar to break the DNS resolution path for at least the last eight consecutive days that the registration remains renewable. Read that the right way round. A website and a mail flow that both stop for no apparent reason is not always a mystery fault. It is often the policy telling you the renewal window is nearly closed, and it is the cheapest alarm you will ever get.
After deletion one door is still open, and it is timed. Every gTLD registry except the sponsored ones must offer a 30-day Redemption Grace Period immediately following deletion, during which your registrar can restore the registration for a fee. Miss that window and the name returns to general availability, where anyone may register it and start receiving the mail your customers are still sending.
What to fix first
Fix five things, in the order below, and most of this risk goes away for close to nothing.
- Set the registrant organization to your company name, not to an individual and not to an agency. The registrant is the party a registry ultimately listens to.
- Turn on multi-factor authentication for the registrar account and the DNS hosting account. CISA's advice after a hijacking campaign was to implement multifactor authentication on domain registrar accounts, or on other systems used to modify DNS records.
- Lock the domain with the transfer and update prohibitions your registrar offers, then leave the registrar lock on between planned changes.
- Move the contact address to a shared mailbox two people read, then confirm auto-renew is active against a payment card that has not expired.
- Document the zone on one page, listing every record, what it is for, who asked for it, and the date it went in.
Keep the transfer authorization code out of that page and in your password manager. A registrar-to-registrar move runs on an authorization code issued by the registrar you are leaving, so an account you cannot reach is an account you cannot leave. Work out how to obtain that code while nothing is wrong, rather than during the week your mail is arriving somewhere else.
A documented zone turns a question nobody can answer into a page anyone can read. That is the whole return on an afternoon's work.
None of these five steps makes a domain impossible to steal, and no honest provider claims otherwise. They close the cheap routes, they make an unauthorized change visible, and they mean the recovery conversation starts from facts instead of guesses.
What to ask your IT provider about DNS
Ask your provider four questions and judge the answers on specificity rather than reassurance. Each one should come back as a name or a date.
- Name the registrar and the renewal date for every domain we own, including the ones we only redirect.
- Name the DNS host and list every person who can edit the zone.
- Show the record list and mark which records you added and which were already there.
- Confirm the lock and MFA are enabled, and tell us the date you last verified both.
Your DNS sits with a third party by definition, and that is where the industry's losses concentrate. Verizon's 2026 breach report found a third party involved in 48 percent of all breaches, with third-party supply chain breaches up 60 percent. CISA's performance goals name the risk directly in goal 1.E, Manage Risks from Managed Service Providers, scoped to providers that remotely manage an organization's IT infrastructure. A provider holding your registrar login sits inside that scope whether your contract says so or not.
A provider who answers in names and dates is managing the asset. A provider who says the domain is all set is reporting a feeling. The questions cost nothing to ask, and the difference between the two answers shows up exactly once, usually on the morning your mail stops.
Two neighboring records deserve the same audit, because they live in the same zone you just mapped. Read Your DMARC record says p=none for what your current policy actually permits, and How to read a DMARC aggregate report for what those reports reveal about who is sending as you. Phone numbers carry a near-identical ownership problem, covered in Phone Number Porting Problems.
FAQ
Who owns a company's DNS records?
The registrant owns the domain, and whoever holds the DNS hosting account edits the records. Those are often different parties. ICANN's Registration Data Policy makes the registrar, the nameservers, the status codes and the creation date public, so a free lookup tells you which companies are involved.
How do I find out who my domain registrar is?
Run a WHOIS lookup on your domain and read the registrar line. The same result lists your nameservers and your domain status codes, because ICANN policy requires those fields to be published. It will not name the person holding the login, since the registrant contact details are redacted.
Can my web designer hold my domain hostage?
They cannot refuse forever, but they can make it slow. If the registrant information is changed, registrars must lock the domain against transfer for sixty days, and opting out of that lock is optional for the registrar. Fix the registrant organization now, while the relationship is still friendly.
What happens if I forget to renew my domain?
You get warnings, then an outage, then one grace period. Registrars send two notices before expiry and one within five days after. Resolution is then interrupted, and after deletion a 30-day Redemption Grace Period lets your registrar restore the name for a fee.
Why does it matter who controls my MX record?
Because the MX record decides where every message goes. Microsoft states that changing it means all email sent to that domain starts coming to Microsoft 365, and the same applies to any destination. The FBI logged $3,046,598,558 in business email compromise losses in 2025.
Best IT MSP is the independent directory of vetted managed IT and cybersecurity providers across North America. Organic ranking is earned on rating and verified data, and paid placement is always labelled. Take the four questions above to three merit-ranked firms in your city and compare the answers side by side.