Your domain name has a legal owner — and it might not be you: the registrar-account question that can lock a founder out of their own business
Whoever's name sits in the domain registrar account is the party who legally controls it — not whoever paid for it, and not whoever built the site. Founders who never check that field are one dispute away from losing their own domain.
You bought the domain — or paid someone to register it for you — so you assume you own it. That assumption is wrong in a specific, checkable way. A domain's legal owner is not whoever paid; it is whoever's name, email, and account sit in the registrar's records as the registrant of record. If that is a freelancer, an agency, or an ex-employee's personal inbox, they control your domain — you are, at best, someone they have agreed to let use it.
This is not a rare accident. An IT contractor in Phoenix quietly renewed a client's account under his own name for years, then locked the company out of its own email and held the site for ransom. A Nevada publisher that had run the same website since 1998 watched the registration change to its developer's name with no hack at all — just an account the developer already had the keys to. Neither company found out until it was too late to fix cheaply.
This piece is about the gap between using a domain and owning it: what the registrant-of-record field actually controls, the real cases where that gap became a lockout or an extortion attempt, the extra wrinkle Egypt's .eg registration rules add for MENA founders, and — the actual point — what it costs to fix this in five minutes today versus what it costs to fight for a domain back once it's not in your name.
The rule that decides everything is unglamorous: whoever is listed as the registrant of record in a domain's registration data is the party a registrar recognizes as its legal holder — not whoever paid the invoice, and not whoever built the website around it. ICANN's own registrant guidance is explicit that this status carries real, enforceable rights: to transfer the domain, to receive its authorization code, and to control its contact details — and that a registrar cannot lawfully withhold that authorization code from the legitimate registrant [1]. If someone else's name, email, or company sits in that field, they are the one holding those rights. You are, at best, someone they have agreed to let use the domain.
This is not a theoretical gap. An IT contractor providing services to a small Phoenix company renewed its GoDaddy account under his own identity in 2011 — a detail nobody noticed for four years because the site and email kept working. When the company tried to update its own contact information in 2015, it discovered the account, and by extension the domain, belonged to him alone. He locked the company's email, blanked its homepage, and demanded $10,000 to 'fix' it — then redirected the site to pornography when the company refused to pay. Federal prosecutors charged him with wire fraud, and he was ultimately ordered to pay $9,145 in restitution [3] — a fraction of what four years of exposure, downtime, and legal costs actually cost the business.
More often the drift is quieter than extortion. A Nevada publisher that had run the same website since 1998 hired a contract developer to work on it — and watched the registration change from its own name to the developer's in 2016, with no hack and no ransom note. Just a registrar account the developer already had the keys to, and used [4]. Industry writers who track these disputes give the same warning lawyers give about source-code ownership: access is not custody, and a registrar login is not a job title — it is the deed.
ICANN does build real protections around the registrant of record — but only if you are that person. A mandatory 60-day lock follows any registrar transfer, registrant-contact change, or new registration specifically to slow this kind of hijack down, and any change to who legally holds a domain requires the current registrant's own authorization [2]. Those protections are worthless to a founder if the 'current registrant' is a freelancer who registered the domain under their own name three years ago as a convenience, and has since gone quiet.
Egypt's .eg namespace adds a structural wrinkle worth knowing before you register, not after. A .eg domain requires either an Egyptian company or a matching trademark, plus a recognized local representative — so both international founders and many local ones route the registration through a 'local presence' or trustee service, where the provider or its assigned local agent becomes the legal holder and administrative contact on the domain rather than the business itself [5][6]. That is not a mistake by the provider — it is how the local rules work by design — but it means the ownership question has to be settled in the trustee agreement, in writing, or the founder has knowingly built their entire online identity on someone else's name from day one.
Getting a domain back once it is not registered in your name is expensive in a way registering it correctly never is. The formal route — a UDRP complaint filed through the World Intellectual Property Organization — carries a $1,500 fee for a single-panelist case covering up to five domains, or $4,000 for a three-panelist case, on top of separate attorney fees that typically run $3,000–7,000 — putting a contested recovery in the $4,500–$11,000 range before you have necessarily won anything [7]. Registering the domain correctly in your company's own name and email from the outset costs exactly nothing extra.
Register every domain your business will ever depend on under the company's own name, its own email, and its own account — no exceptions, no 'just for now.' Treat the registrar login exactly like a bank login: nobody outside the founding team gets the password, and any contractor gets delegated DNS or admin access, never the account itself. A developer who insists on registering it in their own name 'to make setup easier' is telling you how they plan to negotiate later.
For an early-stage founder with no technical background, letting a trusted freelancer or agency register and manage the domain removes a real point of friction: no fumbling through a registrar dashboard mid-launch, no forgotten renewal because nobody on the team understood the reminder email. The formal transfer can happen 'later,' once the business and the relationship are proven — and most of these relationships end amicably, with the domain handed over on request.
The honest answer sorts by relationship, not by rule. A long-standing technical partner with a real, named business and a documented agreement is a very different risk than a freelancer found on a marketplace last week. The mistake isn't always letting someone else touch the registration — it's not knowing, and not writing down, which one you're dealing with.
Register the domain yourself, in your company's name and email, on an account only your founding team controls — full stop, regardless of who does the technical work. Delegate DNS records and admin panels freely; never delegate the registrant field. Where a local rule genuinely requires a trustee — Egypt's .eg namespace among them — get the transfer terms in writing before you register, not after you need them. The fix costs nothing on day one. It costs thousands, and months, once you need it back.
- 01If your web developer or agency disappeared tomorrow, could you log into the account that actually controls your domain right now?
- 02Whose email address receives your domain's renewal and transfer notices — yours, or an inbox that hasn't been checked in years?
- 03For a .eg or other locally-restricted domain, do you know whether you or your local trustee is the legal holder of record — and is that written down anywhere?
- 04Have you ever actually retrieved and stored your domain's auth/EPP code, or would you be asking a third party for it under pressure?
- 05Does your contract with any agency or freelancer state, in writing, that the domain is registered in your company's own name and account — or does it just say they'll 'handle the website'?
- [1]ICANN — Registrant rights FAQ: the registrant of record holds enforceable rights to transfer a domain and to its authorization (EPP) code, which a registrar cannot lawfully withhold from the legitimate registrant.
- [2]NameSilo — "Domain Transfer Rules in 2026: Locks, TAC Codes, and Policies": ICANN's mandatory 60-day lock follows registrar transfers, registrant-contact changes, and new registrations, and any change of legal holder requires the current registrant's authorization.
- [3]U.S. Department of Justice, District of Arizona — press release: an IT contractor was convicted of wire fraud for renewing a client's domain/hosting account under his own identity, then locking its email and defacing its website in a $10,000 extortion attempt; ordered to pay $9,145 restitution.
- [4]Domain Name Wire — "Don't give your web developer access to your domain registrar account": the ApplianceRepair.net case, in which a Nevada publisher's domain registration changed from its own name to its contract developer's in 2016 via existing registrar access, with no hack involved.
- [5]Web Solutions — Egyptian domain registration rules: a .eg domain requires an Egyptian company or a matching trademark plus a recognized local representative, so non-local registrants typically route registration through a local-presence or trustee service.
- [6]Web Solutions — Egypt domain names, Trustee Service: under a local-presence/trustee arrangement, the provider or its assigned local agent — not the business — becomes the legal holder and administrative contact of record on the .eg domain.
- [7]WIPO Arbitration and Mediation Center — updated 2026 UDRP fee schedule: $1,500 filing fee for a single-panelist case of up to five domains, $4,000 for a three-panelist case, with separate attorney fees typically $3,000–7,000.
We register your infrastructure in your name — domain, DNS, and hosting, all under your own account from day one.
Like a felucca crossing the Nile, Felukaa's job is to carry founders from the bank they're standing on to the other side — you run the business, we carry the infrastructure. Every domain we touch gets registered in your company's name and email on an account only you control; we hold delegated access to build, never the registrant rights. Fifteen minutes to check who actually holds the keys to the domain you're already running your business on.
Book a free 15-min consultation