The Login Nobody Owns: A 30-Minute Audit of Your .co.uk
Photo: JoachimKohler-HB, CC BY-SA 4.0, via Wikimedia Commons
Most small businesses treat the domain name like the electricity supply: invisible, essential, and somebody else’s problem until the lights go out. The website looks fine, email lands, invoices go out. Then a renewal email slips into a spam folder, a card expires, or the one person who knows the registrar password leaves on a Friday. By Monday, your email is bouncing and customers are asking whether you have gone bust.
A lapsed domain is not an IT trivia problem. It is a business continuity problem wearing a very boring hat. For a UK business, a .co.uk address is often the first thing a customer checks, the thing printed on the van, and the thing that receives password resets for everything else. If it expires, the fallout is immediate and embarrassingly public.
Why domain expiry hits harder than it looks
When a domain lapses, the website usually goes first. That is the visible bit. The quieter damage is email. Messages bounce, password reset links never arrive, and suppliers start phoning because their invoices have been returned. If the domain is picked up by someone else, the problem gets worse: old email addresses can be recreated, and customers have no easy way to tell the difference between you and a stranger.
Even a short outage dents trust. A customer who sees a parked page or a security warning does not think “temporary registrar issue”. They think “this lot have disappeared”. That is a lot of reputational damage for something that costs less than a takeaway per month.
Start with the public record, not the invoice
For .co.uk domains, Nominet is the registry behind the scenes. You do not usually deal with Nominet directly for day-to-day changes, but its lookup tool is a useful starting point. Search your domain and note the registrar – the company you actually pay – and the registration status. If the registrar name means nothing to you, that is your first clue that ownership is murky.
Next, open the registrar account. Not the invoice folder. The actual account. Confirm that you can log in, that the registrant contact is a business address you control, and that the email address on the account is one someone actually reads. A domain registered to an old IT contractor’s personal email is a single point of failure with a password you do not know.
The five things to confirm in half an hour
A proper domain audit does not need a consultant and a whiteboard. It needs five answers.
1. Who is the registrar? Write down the company, the account username, and who can access it. If the answer is “Dave set it up years ago”, find Dave.
2. Is the registrant contact correct? For .co.uk domains, the registrant is the legal owner of the registration. Make sure it names your business, not a former employee, a web designer, or a friend-of-a-friend. If it is wrong, correct it through the registrar before anything else.
3. Is auto-renew on, and is the card still valid? Auto-renew is not a magic spell. It is a card transaction that fails when the card expires, the bank blocks it, or the billing email goes to a dead inbox. Check the payment method attached to the domain account.
4. Is the account locked down? Turn on two-factor authentication for the registrar account and enable any registrar lock or transfer protection available. For .co.uk transfers, the process involves changing the IPS tag at the registrar, so make sure you understand who can request that change.
5. Who controls DNS? This is the second ownership question. Your domain may be registered in one place, but the DNS records might live with a web host, an IT support company, or a marketing agency. Find out who can edit the nameservers and the key records for your website, email and verification services.
The auto-renew trap
Auto-renew is a useful backup, not a strategy. Small businesses get caught by the same handful of problems: the card on file belonged to a director who left, the renewal notice went to an old info@ address, or the domain was bought through a reseller who has since stopped trading.
Put the renewal date in the business diary – not just in the registrar’s account. Check it sixty days before renewal and again thirty days before. If the domain is managed by an IT provider, ask for the renewal date and the registrar name in writing. “It is handled” is not an audit trail.
DNS is the second set of keys
Even if the domain is safely registered, someone still controls the DNS. That is the set of records that tells the internet where your website lives and where your email should go. If that access sits with one former supplier, you have a different kind of ownership problem.
Document the nameservers, the account holder, and who can make changes. Keep a copy of the key records – website, email, and any verification entries – somewhere sensible. Then decide who has permission to change them. A single person with sole DNS access is a risk, even if they are lovely and currently answering their phone.
Make it an annual habit
Once you have done the audit, put a recurring reminder in the calendar for the same month each year. Check the registrar, the registrant contact, the payment card, the two-factor authentication, and the DNS access. If you are changing IT support or web hosts, add “confirm domain and DNS ownership” to the handover checklist.
It is not glamorous work. It will never be the highlight of anyone’s week. But thirty minutes spent confirming who owns your .co.uk is cheaper than a Monday morning spent explaining to customers why your email has vanished. The domain renews itself until it does not. Make sure you know who is holding the keys when it stops.
