# Who Controls Your Domain Name?

> Updating your contact details before moving your domain can lock it for 60 days. Here is what ICANN policy actually says about control, transfers and expiry.

[Home](https://seoagencynaples.com/) / [Blog](https://seoagencynaples.com/blog/) / Technical SEO Site Protection
# Who Actually Controls Your Domain Name, and the 60-Day Trap Most Owners Find Too Late
Ask a small business owner where their domain is registered and a surprising number cannot say. The honest answer is often that a developer set it up years ago, and nobody has thought about it since.

By [Jamie Kloncz](https://seoagencynaples.com/jamie-kloncz/), Founder and CEO, SEO Elite Agency ** 16 min read ** Published August 22, 2026

A domain name is the one asset in a business that can fail completely while everything else is working perfectly. The site is fine, the hosting is paid, the team is at their desks, and the whole thing is unreachable because a registration lapsed or a login belongs to somebody who left. It is also the asset most owners understand least, which is a bad combination.
There is a set of rules underneath all of this that very few owners have read. ICANN publishes a Transfer Policy and an Expired Registration Recovery Policy, both updated on 21 February 2024, and between them they decide what you are entitled to [1](#ref-1) [2](#ref-2). They are more protective of you than most people assume, and they contain one trap that is very easy to walk into.
This guide covers who actually holds the registration, the 60-day lock and the order of operations that avoids it, what a registrar is and is not allowed to do when you want to leave, and what genuinely happens when a domain expires. One caveat up front: this is the mechanics of gTLD policy, not legal advice about ownership in a contract dispute.

## Three parties, and only one of them is you
The registrant is the entity the domain belongs to, the registrar is the company that sells and manages the registration, and the account holder is whoever can actually log in. Those are frequently three different parties, and the third one is the practical answer to who controls it.
Start by separating the roles, because the confusion here causes real damage. The registrant, or in policy language the Registered Name Holder, is the entity in whose name the domain is registered. The registrar is the accredited company that sells and administers it. Then there is the entirely unofficial third role: whoever knows the login. In small businesses that third person is very often a developer or a marketing agency from years ago.
The policy is clear about whose word carries weight. It states that the Registered Name Holder and the Administrative Contact are the only parties with authority to approve or deny a transfer request, and that in a dispute the Registered Name Holder authority supersedes that of the Administrative Contact [1](#ref-1). So the name on the registration matters more than who holds the password. That is genuinely reassuring, provided the name on the registration is yours.
Which is the thing to go and check today rather than at the point of crisis. Registration data for a domain is published through what the current policy calls RDDS, the Registration Data Directory Services, and your registrar can tell you what is recorded against your name [1](#ref-1). If the registrant is a former developer, a defunct agency, or a personal email nobody monitors, you have a problem that is entirely solvable now and considerably less solvable during an outage.
It is worth noting the scope. These are the rules for generic top-level domains, the.com,.net and.org family. Country-code domains run their own policies, so if you hold a ccTLD the specifics below may not apply to you even where the principle does.

## The 60-day trap, and the order that avoids it
Changing the registrant email address counts as a Change of Registrant, which can impose a 60-day lock on moving the domain. ICANN requires registrars to advise transferring first and updating details second. Almost everybody does it the other way round.
Here is the sequence that catches people. You decide to move your domain somewhere better managed. Being organized, you first log in and correct the contact details, because the email on file is an old one. Then you request the transfer and discover you cannot move for two months.
The policy defines a Change of Registrant as a material change to the registrant name, organization or email address, and states explicitly that any change to the registered name holder email address is a material change [1](#ref-1). It then requires that a registrar must deny a transfer where it imposed a 60-day inter-registrar transfer lock following a Change of Registrant and you did not opt out of that lock before making the request [1](#ref-1).
ICANN clearly knows this catches people, because it obliges registrars to warn you. The policy requires the registrar to inform you that if your final goal is to transfer the domain to a different registrar, you are advised to request the inter-registrar transfer before the Change of Registrant, in order to avoid triggering the 60-day lock [1](#ref-1). Whether that warning reaches you in a form you notice is another matter entirely.
Two other 60-day windows exist alongside it. A registrar may deny a transfer requested within 60 days of the creation date shown in the registry record, and may deny one within 60 days after the domain was previously transferred [1](#ref-1). So a freshly registered domain and a freshly moved domain both sit still for a while. None of this is a reason to panic. It is a reason to plan the order.

- **Decide where the domain is going first.** Choose the destination before you touch anything, because the sequence depends on it.
- **Do not update the registrant details yet.** Changing the name, organization or email address is what arms the 60-day lock.
- **Unlock and request the transfer code.** The registrar has five calendar days to provide it if there is no self-service option.
- **Complete the transfer.** Move the registration to the destination registrar first, while the details are still whatever they were.
- **Then correct the contact details.** Once the domain has arrived, update the registrant record properly at the new registrar.
- **Record where it lives and when it renews.** Somewhere that is not one person’s memory, and not an inbox on the domain itself.
If your registration is currently in somebody else’s name, fix that first and accept the 60-day wait as the cost of doing it properly. A lock you chose is a very different situation from a lock you discover during an emergency.

Source: ICANN Transfer Policy and Expired Registration Recovery Policy, both updated 21 February 2024 Download SVG

## What a registrar is not allowed to do
A registrar may not use the transfer process to collect money, may not deny a transfer simply because you have not responded, and must hand over the transfer code and remove the lock within five calendar days. Silence defaults to allowing the transfer, not blocking it.
This section exists because of a specific and common situation: the developer who built the site also registered the domain, the relationship has ended, and the domain is now leverage. Owners in that position usually assume they have no options. The policy says otherwise, and it is worth reading the actual wording rather than accepting the first no.
On money, the policy is direct. It states that in the event of a dispute over payment, the registrar must not employ transfer processes as a mechanism to secure payment for services, noting that it has other collection mechanisms available that are independent of the transfer process [1](#ref-1). There are narrow exceptions concerning unpaid previous registration periods, but a general commercial dispute is not one of them.
On the practical obstacles, the list of things that are not valid grounds for denial includes nonpayment for a pending or future registration period, no response from the Registered Name Holder, and a domain sitting in registrar lock status where you were not given a reasonable opportunity to unlock it [1](#ref-1). And the policy sets a clock: where the registrar does not provide self-service facilities, it must give you the unique AuthInfo code and remove the ClientTransferProhibited status within five calendar days of your initial request [1](#ref-1).
The most useful clause is the one about doing nothing. The policy states that where the Registered Name Holder has not confirmed the request and the registrar has not explicitly denied it, the default action is that the registrar must allow the transfer to proceed [1](#ref-1). Stonewalling is not an effective strategy, because the process is built to move forward in the absence of a decision rather than stall. If you are being ignored, that clause and your registrar complaint route are the two things to reach for.

- A billing argument is not grounds to hold your domain.
- Not replying to them is not grounds for denial either.
- Five calendar days to hand over the code and remove the lock.
- Silence from the losing registrar defaults to the transfer proceeding.
- The registrant name outranks the administrative contact in a dispute.

## What expiry actually does, which is worse than most people expect
The registrar is required to interrupt DNS resolution once a registration expires, so the site and email go down by design rather than by neglect. After deletion there is a 30-day redemption window, restore fees apply, and the warning emails may go to an address on the domain that has already stopped working.
Most owners assume expiry is like a late bill: a warning, then eventually a consequence. The Expired Registration Recovery Policy describes something more abrupt. It requires that the existing DNS resolution path be interrupted by the registrar, both for registrations deleted within eight days of expiry and, for later deletions, across at least the final eight consecutive days during which the registration remains renewable [2](#ref-2).
Read that as a business owner. Interrupting DNS resolution does not only take the website down. It takes down anything that depends on the domain, and for most small businesses that includes email. The moment the site goes dark, the channel most customers use to reach you goes dark alongside it, which is why an expiry is so much more expensive than the renewal fee it started as.
The warnings are real but easy to miss. Registrars must notify the holder at least twice before expiry, approximately one month before and approximately one week before [2](#ref-2). ICANN also records a best practice that registrars should advise holders to provide a secondary email point of contact that is not associated with the domain name itself, so reminders can still arrive if the domain stops working [2](#ref-2). That advice exists because the alternative is sending an expiry notice to an inbox the expiry has already disabled.
If it goes past deletion there is still a route back, and a cost. Registries must offer a Redemption Grace Period of 30 days immediately following deletion, during which the deleted registration can be restored at the holder’s request by the registrar that deleted it [2](#ref-2). Registrars must make their renewal, post-expiration renewal and redemption or restore fees available [2](#ref-2). Those restore fees are typically far above a normal renewal, and we are deliberately not quoting a figure because it varies by registrar and you should check your own.
Stage What the policy requires What it means for you
One month before A required expiration notice Arrives while everything still works, which is why it gets ignored
One week before A second required notice The last comfortable moment to act
At expiry DNS resolution must be interrupted Site and email go down by design, not by accident
After deletion A 30-day Redemption Grace Period Recoverable, but a restore fee applies and the name does not resolve
After redemption No further guarantee The name can be registered by somebody else

## What to do this week
Find out who the registrant is, get the renewal date somewhere durable, put a contact address on the record that does not depend on the domain itself, and turn on auto-renew. None of this costs anything and all of it prevents the expensive version.
The whole subject collapses into a short list of things that take an afternoon. Confirm which registrar holds the domain and log in yourself rather than being told what it says. Check that the registrant name is your business and not an individual who no longer works with you. Note the renewal date somewhere that is not a single person’s memory.
Then fix the contact address, because this is the failure that turns a small problem into an outage. Put an email on the record that does not sit on the domain in question, exactly as ICANN best practice recommends [2](#ref-2). A free mailbox on another provider is fine. The requirement is simply that it keeps working on the day the domain stops.
Turn on auto-renew, and separately confirm the card on file has not expired, since an auto-renew pointed at a dead card is a manual renewal wearing a disguise. Then, if the registrant details need correcting and you also intend to move the domain at some point, remember the order: transfer first, correct second [1](#ref-1). Doing it in the other sequence is what costs you 60 days.
Where we come into this is small and worth stating plainly. When we take on a site we make sure the domain is registered to the business rather than to us, that DNS sits somewhere the business can reach, and that renewal is not one forgotten calendar entry away from an outage. We do not want to be the answer to the question this article asks, which is the same reason we wrote about [who is responsible for applying updates](https://seoagencynaples.com/blog/website-security-updates-patch-window/). If you would like a look at how your setup is currently arranged, our [free SEO audit](https://seoagencynaples.com/free-seo-audit/) is the easiest starting point.

Test yourself
## Do you know what you are entitled to?
Five questions from the current ICANN Transfer Policy and Expired Registration Recovery Policy, both linked in this guide.

- 1 What can trigger a 60-day lock on moving your domain to another registrar? Only selling the business Changing the registrant email address Renewing early Adding a subdomain **Answer:** Changing the registrant email address The policy defines a Change of Registrant as a material change to the registrant name, organization or email address, and specifically lists any change to the registered name holder email address as material. Where a registrar imposed the resulting 60-day lock and you did not opt out beforehand, the policy says it must deny your transfer. Tidying up your contact details is enough to do it.
- 2 In what order does ICANN advise doing a transfer and a details update? Update details first, then transfer Transfer first, then update details It makes no difference Both must happen on the same day **Answer:** Transfer first, then update details The policy requires the registrar to inform you that if your final goal is moving to a different registrar, you are advised to request the inter-registrar transfer before the Change of Registrant, to avoid triggering the 60-day lock. Most owners do it the other way round, because updating your own details feels like the tidy first step. That instinct is what costs two months.
- 3 Can a registrar refuse to release your domain over a billing dispute? Yes, until the bill is settled No, the policy says transfers must not be used to secure payment Only for amounts over five hundred dollars Only if a court agrees **Answer:** No, the policy says transfers must not be used to secure payment The policy states that where there is a dispute over payment, the registrar must not employ transfer processes as a mechanism to secure payment for services, and notes it has other collection mechanisms available. There are narrow exceptions around unpaid previous registration periods, but a general commercial argument is not grounds to hold the domain. This matters most when a web developer is also the registrar.
- 4 How long does a registrar have to give you your transfer code and remove the lock? Thirty days Five calendar days There is no time limit Twenty-four hours **Answer:** Five calendar days Where the registrar does not give you self-service tools, the policy requires it to provide the unique AuthInfo code and remove the ClientTransferProhibited status within five calendar days of your initial request. Silence is not a defense either: the policy says that where you have not confirmed and the registrar has not explicitly denied the request, the default action is that it must allow the transfer to proceed.
- 5 What happens to your website when the registration expires? Nothing until it is deleted The registrar is required to interrupt DNS resolution It stays up for a year Only email stops working **Answer:** The registrar is required to interrupt DNS resolution This surprises people who assume a grace period means business as usual. The policy requires that the existing DNS resolution path be interrupted by the registrar, both for names deleted within eight days of expiry and, for later deletions, for at least the final eight days that the registration is still renewable. Breaking your site is not a registrar being difficult. It is the policy working as designed.
Honest self-check. There is no sign-up, and nothing is stored.

Questions answered
## Straight answers to the common questions
The questions readers ask about this topic, answered directly. **No forms, no sales pitch.**

JAMIE KLONCZ · SEO AGENCY NAPLES ************** ONLINE
Pick a question on the left, or search above. You will get the direct answer, the way an answer engine would give it.

← PREV NEXT → [FREE AUDIT →](https://seoagencynaples.com/free-seo-audit/)

- **How do I find out who owns my domain name?** Start with your registrar rather than a third-party lookup tool, because the registrar can show you the full registration record while public directories may show limited data. What you are checking is the Registered Name Holder: the entity in whose name the domain is registered. ICANN policy treats that party as the one with authority over a transfer, and states that in a dispute the Registered Name Holder authority supersedes that of the administrative contact. If the registrant is a former developer, an agency you no longer work with, or a personal email nobody monitors, that is worth correcting now rather than during an outage.
- **Why can I not transfer my domain right now?** There are three common 60-day windows and one of them is self-inflicted. A registrar may deny a transfer requested within 60 days of the domain creation date, and may deny one within 60 days of a previous transfer. The third is a Change of Registrant lock: if the registrant name, organization or email address was changed and you did not opt out of the 60-day lock beforehand, the policy says the registrar must deny the transfer. Changing the email address alone is enough to trigger it, which is why so many owners hit this immediately after tidying up their contact details.
- **Should I update my contact details before or after transferring?** After, and this is the single most useful thing in this article. ICANN policy requires the registrar to inform you that if your final goal is transferring to a different registrar, you are advised to request the inter-registrar transfer before the Change of Registrant, so as to avoid triggering the 60-day lock. The intuitive order is the wrong one. Updating your own details feels like the responsible first step, and it is exactly what arms the lock. Move the domain first, then correct the registrant record at the new registrar once it has arrived.
- **My web developer registered my domain and will not release it. What can I do?** Read the actual policy before accepting no. ICANN states that in a dispute over payment, a registrar must not employ transfer processes as a mechanism to secure payment for services, and that it has other collection mechanisms independent of transfers. Nonpayment for a pending or future registration period is explicitly not valid grounds for denial, nor is no response from the registered name holder. Where the registrar lacks self-service tools, it must provide the AuthInfo code and remove the transfer lock within five calendar days of your request. If you are being ignored, note that the policy defaults to allowing a transfer to proceed where it has not been explicitly denied. This is mechanics, not legal advice on who owns the name.
- **What actually happens when a domain expires?** More than people expect, and faster. The Expired Registration Recovery Policy requires the registrar to interrupt the existing DNS resolution path, both for registrations deleted within eight days of expiry and, for later deletions, across at least the final eight consecutive days that the registration remains renewable. That interruption takes down anything relying on the domain, which for most small businesses includes email as well as the website. Registrars must send at least two warnings, approximately a month and approximately a week beforehand. The problem is that those warnings often go to an address on the domain itself.
- **Can I get a domain back after it expires?** Usually, for a window, and at a cost. Registries must offer a Redemption Grace Period of 30 days immediately following deletion, during which the deleted registration can be restored at the request of the registrant by the registrar that deleted it. Registrars are required to make their renewal fees, post-expiration renewal fees and redemption or restore fees available to you. Restore fees are typically much higher than an ordinary renewal, and we are not quoting a number because it varies by registrar and you should check yours specifically. Once the redemption window closes there is no guarantee at all, and somebody else can register the name.
- **Does any of this apply to a country domain rather than a.com?** Not necessarily, and it is worth knowing which set of rules you are under. The Transfer Policy and the Expired Registration Recovery Policy discussed here govern generic top-level domains, the.com,.net and.org family. Country-code domains are administered by their own national registries under their own policies, which may set different lock periods, different grace periods and different transfer mechanics. The underlying principles usually rhyme, in that there is a registrant of record and a process for moving between providers, but do not assume a specific 60-day window or a 30-day redemption period applies. Check the rules for your particular extension.

## References

- ICANN. Transfer Policy (updated 21 February 2024). accessed 22 August 2026. [https://www.icann.org/resources/pages/transfer-policy-2024-02-21-en](https://www.icann.org/resources/pages/transfer-policy-2024-02-21-en)
- ICANN. Expired Registration Recovery Policy (updated 21 February 2024). accessed 22 August 2026. [https://www.icann.org/resources/pages/errp-2024-02-21-en](https://www.icann.org/resources/pages/errp-2024-02-21-en)

Written by
## [Jamie Kloncz](https://seoagencynaples.com/jamie-kloncz/)
Founder and CEO, SEO Elite Agency
Jamie Kloncz is the founder and CEO of SEO Elite Agency, the firm behind SEO Agency Naples. An engineer who scaled his own plumbing business to 3 million dollars in revenue and led growth for over 200 teams, he built this agency on one principle: every SEO action must connect directly to revenue, not vanity metrics.
[More about Jamie →](https://seoagencynaples.com/jamie-kloncz/)

Free · No pressure
## See where your business actually stands
Start with a free audit of your rankings, Google Business Profile, technical health, and AI-search visibility, with a prioritized plan and an honest quote for your situation.
[Get your free audit](https://seoagencynaples.com/free-seo-audit/)

Keep reading
## Related guides
[Technical SEO The Federal Patch Deadline Is Now Three Days. When Was Your Website Last Updated? Read guide →](https://seoagencynaples.com/blog/website-security-updates-patch-window/)[Technical SEO Your Website Was Not Targeted, It Was Scanned: What Google Does When a Site Is Hacked Read guide →](https://seoagencynaples.com/blog/website-hacked-google-search-naples/)[Technical SEO Why Your Website Is Not Showing Up on Google (and How to Get Indexed) Read guide →](https://seoagencynaples.com/blog/website-not-showing-up-on-google/)