Who Holds the Keys?
Owning, Protecting, and Recovering Your Domain
Five posts from real client lockouts — a lapsed card that took email down for a week, a login locked inside the account it was meant to fix, and a provider that handed over a domain without asking who I was.
On This Page
1. If Your Domain Is Down Right Now
Start here: a lapsed domain is usually recoverable. It doesn't vanish the night it expires — it moves through stages, and the stage decides what you do and what it costs. Look your domain up on any WHOIS or domain lookup site to find the registrar and its status, then find your stage below.
-
1
Just expired — grace period
Usually a few weeks. Everything is down, but it's still yours to renew at the normal price. The only hard part is getting into the account that holds it. Renew first, sort out ownership after.
-
2
Redemption
Still recoverable, but registrars charge a restore fee — often well over a hundred dollars on top of the renewal. Expect to prove you're the rightful owner. Acting quickly here genuinely saves money.
-
3
Released
Back on the open market. If nobody has registered it yet, buy it back now. If someone has, recovery becomes a negotiation — and sometimes it isn't for sale at any price.
The cost of waiting isn't linear.
A domain that was a twenty-dollar fix last month can be unrecoverable this month. If yours is anywhere before stage three, move now rather than after the weekend.
Read the full walkthrough: How to Get Your Domain Back →2. The One Idea Behind the Series
None of the stories in this series involve a hacker. Every one of them is an arrangement someone made years ago, for good reasons, that nobody wrote down: a domain registered in a developer's account, a renewal card that quietly expired, a login that depended on the thing it was supposed to fix, a provider that never checked who was asking.
The fix is the same every time. You don't have to run any of this yourself — but you have to know where it lives, and be able to get in.
Three layers, one question for each — whose account is this in?
- Registrar — where you rent the name, a year at a time
- DNS — the phone book that points the name at your website and your email
- Hosting — where the website and email actually land
Outsource the work. Never outsource the keys.
3. The Five Posts
Each post stands on its own. Read in order, they go from how the pieces fit, to the ways control slips away, to getting it back.
What DNS Actually Is (and the Week It Cost a Client Her Email)
A client lost her email for a week because a company she'd never heard of held her domain, and it lapsed. A domain isn't one thing — it's a registrar, a DNS provider, and the services it points to — and email hangs off the same phone book as the website.
You Don't Own Your Domain
You rent it, on a renewal you probably never see. Renting is normal — what matters is whose name is on the lease. Where domains usually end up, how to find out who holds yours, and the three things to ask for so you can walk away with it.
Don't Keep Your Spare Key Inside the House
A five-minute payment fix that couldn't be made, because the login was "Sign in with Google" on a business email bought through the same site builder that had just gone down. Why bundling everything behind one vendor creates a single point of failure, and where the spare key should live.
Nobody Asked Who I Was
When I finally tracked down the company holding a client's domain, they handed it over without a single check that I was authorized. Why verification friction is the feature, and why a provider that makes recovery effortless is one to move away from.
How to Get Your Domain Back
Your site is down, your email is dark, and the domain lapsed. How to tell which stage it's in — grace, redemption, or released — what to do at each one, and the three things to fix once it's back so it doesn't happen again.
4. The Ten-Minute Check
Do this before anything is on fire. If you can't answer one of these, that's the post to read first.
Could you log into your registrar, DNS, and hosting right now — without asking anyone?
Three logins. If you have all three, you can move, fix, or fire whoever manages it. If one is missing, that's the layer that takes your email down for a week.
Read: What DNS Actually Is →Is the domain registered to you, and do renewal notices reach an inbox you read?
A renewal notice sent to a dead address, a card nobody updated, an account nobody could reach — nearly every lapse traces back to one of those.
Read: You Don't Own Your Domain →Does the email you log in and recover with depend on the accounts it unlocks?
If one lapse can take out both the service and the email you'd use to get back into it, add an independent address as a login and recovery option.
Read: Don't Keep Your Spare Key Inside the House →The last time you dealt with your provider, did they check who you were?
If a provider ever handed you access, a transfer, or a password reset on your say-so alone, it will do the same for anyone who asks.
Read: Nobody Asked Who I Was →5. Frequently Asked Questions
Can I get my domain back after it expires?
Usually. For the first few weeks it's in a grace period and renews at the normal price. Then it enters redemption, where it can still be restored for a fee that often runs well over a hundred dollars. Only after both windows pass is it released to the public, where anyone can register it.
Why did my email stop working when my domain expired?
Email runs on DNS records called MX records that say where mail for your domain goes. When the domain lapses, those records stop resolving and mail has nowhere to go. A domain isn't just the website — it's the address book for everything with your name on it.
Do I actually own my domain?
Nobody owns a domain outright — they're rented, usually a year at a time. What matters is whose account the rental is in. If a developer, agency, or site builder registered it under their account, they see the renewal notices and you find out when it breaks.
How do I find out who holds my domain?
Look it up on any WHOIS or domain lookup site — even with privacy protection it usually shows the registrar and expiry date. Then ask whoever manages it for account access, the domain unlocked for transfer, and the transfer (auth or EPP) code.
Why can't I log in to fix my site when my email is down?
If you sign in with "Sign in with Google" using a business email that depends on the same site builder, domain, or payment, one lapse takes out the email and your way in with it. Add an independent email as a login and recovery option, on a provider unrelated to the rest.
Is it a bad sign if a provider gives me access without verifying who I am?
Yes. Verification is the provider protecting you from everyone who isn't you. One that hands over a domain, transfer, or reset on someone's say-so will do it for anyone who asks — that's a provider worth moving away from.
Not Sure Who Holds Your Keys?
Finding out is usually one conversation.
If your domain is down, or you just can't answer the questions above, reach out. I've tracked down registrars and providers on clients' behalf before, and I'll help you get the keys back in your name.