Your Business Domain: Who Actually Owns It?
Identity & Access Governance • Domain Security • Operational Resilience
Strategic Summary: Business domain security is an oversight that often remains invisible until an enterprise-critical communication blackout occurs. If your domain was registered by a third-party developer or contractor during your startup phase, you may not possess the legal or technical ownership required to survive a termination of that relationship. Rudie de Vries explains why domain registrar control is a fundamental security asset and provides the three mandatory checks to ensure your business remains in control of its external identity.
When the Domain Admin Console Belongs to Someone Else
We recently engaged with a client attempting a standard transition to Microsoft 365. The technical process required a routine DNS update—a task that typically consumes only a few minutes. However, the update required administrative credentials for the domain registrar, which the client did not possess.
Years earlier, their previous IT contractor had registered the domain using his personal name rather than the company’s legal entity. Since parting ways with the client, the contractor proved uncooperative, explicitly demanding a 10,000 ZAR payment to transfer the account. The client was trapped. Their entire external identity—company email addresses, verified communication lines, supplier databases, and historical branding—was anchored to a string of characters they did not legally or technically control.
Figure 1: Conceptual overview of DNS and MX record routing—where registrar control acts as the “kill-switch” for all corporate communication.
The Operational Reality of DNS Control
Whoever maintains control over the DNS records holds a kill-switch over your entire digital presence. Domain ownership is not simply about hosting a web page; it is about the authoritative control of MX (Mail Exchange) records. By simply updating the MX records, a hostile or negligent actor can silence your business communication within minutes. Every email sent to your domain will either bounce or be redirected to a server under their control. Your staff will be locked out, your clients will lose the ability to verify your identity, and your supply chain will effectively grind to a halt.
There is no rapid recovery from this state. Domain transfers between registrars are governed by protocols that can take days or weeks, even when both parties are cooperative. In this specific engagement, we advised the client to pay the ransom to restore immediate operations, then pursue legal recourse later. The financial cost was high, but the alternative—weeks of total communication paralysis—would have been significantly more destructive.
Three Critical Domain Governance Checks
To prevent total communication hijacking, every enterprise must verify these three controls immediately:
- Legal Entity Registration: The registrar account must be registered in the name of your business entity. No individual contractor or employee should own the asset legally.
- Credential Sovereignty: You must hold the login credentials for your registrar, or at minimum, store them in a secure, business-managed vault accessible to leadership.
- Autonomous Renewal: Renewals must be automated against a corporate payment instrument. Never rely on an individual’s personal credit card, which may expire or be cancelled when a staff member departs.
Proactive Infrastructure Auditing
This risk sits in a dangerous gap that traditional firewall-based threat detection often fails to monitor. It is not an endpoint or software vulnerability; it is a fundamental access control failure at the DNS layer. Most small and mid-sized businesses have never audited their registrar ownership—a mistake that leaves their entire communication backbone exposed.
Our managed cyber security reviews incorporate domain and registrar governance as a core standard. We ensure that your DNS, registrar logins, and digital assets are strictly aligned under your company’s direct control. If you have not verified who holds the keys to your domain, our threat detection and response team can perform an exposure audit today.
