The Keys to the Public Name: Auditing Domain Control in UK Businesses

A domain is communications infrastructure

Most UK businesses treat a domain name as a small administrative item: something bought once, renewed annually and largely forgotten. In practice, the domain is the public name through which email is delivered, websites are reached and customer trust is maintained. Its DNS records determine where mail flows, which services may send on the organisation's behalf and whether a website resolves at all. When a domain lapses, the consequences are rarely confined to a missing homepage. Email begins to bounce, password reset messages fail and customers encounter error pages that suggest the business has disappeared.

The risk is not hypothetical. A card can expire, a renewal notice can arrive in an inbox nobody monitors, or the one administrator who understood the registrar account can leave. Each of these is a routine event. Together they form a communications incident waiting for a date. A domain control audit is therefore less about web design and more about operational resilience.

The registrar account is a shared secret

The registrar is the organisation through which the domain is registered. Its control panel holds the practical authority to change nameservers, alter contact details, renew or transfer the registration. Many SMEs have exactly one person who knows the login. That person may be a founder, an office manager, a web developer or an external agency. The first task is to establish which registrar holds each domain and which email address is associated with the account.

A particular hazard arises when the registrar account email sits on the domain itself. If the domain lapses or its mail routing fails, recovery messages cannot be received. The account email should be on a separate, monitored domain, preferably one controlled by the business. Renewal notices should reach a shared mailbox rather than an individual's inbox, and the account should not depend on a personal mobile number that may change.

Mapping who can change the zone

DNS authority is often distributed informally. The registrar may host the zone, or nameservers may point to a hosting provider, a content delivery network or a third-party DNS service. Each arrangement creates a different set of access rights. The audit should record the authoritative nameservers for every domain and identify who can edit records at that location.

Certain records deserve particular attention. MX records direct email. SPF, DKIM and DMARC records affect sender authentication and deliverability. CNAME records are frequently used for service verification, including marketing platforms and productivity tools. TXT records may carry verification tokens or other policy information. If a marketing agency or IT supplier can alter the whole zone merely to add a verification record, they can also redirect email or change website addressing. Where possible, access should be scoped, and changes should follow a documented request process rather than an informal email.

Renewal ownership and payment methods

Renewal failure is usually a finance problem before it is a technical one. The audit should establish the expiry date, auto-renew status and payment method for each domain. A card held by a former employee or a personal account is a weak point. Moving renewals to a corporate payment method with a long validity period reduces the chance of a silent lapse.

Calendar reminders should be set at ninety, sixty and thirty days before expiry, and they should reach more than one person. For .co.uk domains, the registry is Nominet, but renewal is normally handled through the registrar. The business should confirm that the registrar's contact address is current and monitored. Auto-renew should be treated as a safety net, not a substitute for oversight.

MFA, transfer locks and recovery

Multi-factor authentication should be enforced on the registrar account. An authenticator application or hardware key is preferable to SMS where available. Recovery codes should be stored offline in a controlled location, not in the same inbox as renewal notices. Registrar transfer locks, often labelled clientTransferProhibited, should be enabled to prevent unauthorised transfers. Where the registrar offers stronger registry-level locks, those should be considered for high-value domains.

Access should also be reviewed when staff leave. A departed administrator with an active login is a governance gap, even if the intention behind it was convenience. Delegated access should be granted sparingly and removed promptly.

Supplier and reseller access

Many SMEs acquire domains through a web agency or IT provider. The agency may hold the registrar account, appear as the registrant contact or manage DNS on the business's behalf. This can work well until the relationship changes. The business should confirm that it is the legal registrant and that it can obtain control of the account if the supplier ceases trading or the contract ends.

Procurement clauses should address domain access explicitly. Exit provisions should require the supplier to transfer registrar control, provide a zone file export and confirm that no lingering DNS records point to services the business no longer uses. A domain is not a hostage to be discovered at the end of a contract.

A practical audit checklist

1. Inventory every domain the business owns, including defensive registrations and misspellings.
2. Record the registrar, expiry date, auto-renew status, payment method and account email for each.
3. Identify the DNS host and authoritative nameservers.
4. List who has edit rights and whether MFA is enforced.
5. Export the current zone file and note the owners of key records.
6. Confirm the registrant contact is the business, not an individual or agency.
7. Enable transfer locks and review recovery options.
8. Test that the account email can receive messages independently of the domain.
9. Store the findings in a secure IT exit file with named owners.
10. Schedule a quarterly review rather than an annual scramble.

Documenting and rehearsing

A domain register is most useful when it is not held solely in one person's memory. The record should state who can renew, who can change DNS and who escalates if a renewal fails. It should be stored securely but accessibly, with a clear owner.

A short rehearsal is worthwhile. If the administrator left tomorrow, could someone else renew the domain? If the card expired, would the finance team notice? If a supplier vanished, could the business regain control of its own public name? These questions are simpler to answer before a renewal date than after email has stopped. Treating the domain as communications infrastructure, rather than an annual line item, is the first step.