Held by One Inbox: Putting Domain Ownership and DNS Control on the UK SME Risk Register

Most UK small firms can name the person who holds the office keys. Far fewer can say with confidence who controls the company domain, which payment card keeps it alive, or how a DNS change would be made at 9pm on a Friday if the usual administrator were unavailable. The domain is the firm's digital premises. It carries email, the website, customer trust and increasingly the verification records that underpin cloud services. Yet ownership and control frequently sit in a single inbox, an old agency account or a spreadsheet that has not been opened since the last website redesign.

That is a governance gap rather than a technical curiosity. A lapsed domain can take email and website access down within hours. A disputed registrar account can stall a rebrand, a Microsoft 365 migration or a payment provider verification. An unexplained DNS record can quietly redirect traffic or leave a service exposed. For a small business without a dedicated domain administrator, the sensible response is not a large project but a short, repeatable review. Forty-five minutes, four or five competent people and a written record are enough to move the domain from personal memory onto the risk register.

Why this belongs beside premises and insurance

Domain names and DNS records are often classified as marketing assets or webmaster housekeeping. In practice they are corporate infrastructure. The registrant should be the business, not an individual's personal account. The renewal should be funded by a business payment method with more than one person aware of it. The DNS zone should be documented well enough that a new supplier can understand it without reverse-engineering years of changes. These are governance questions, and they deserve the same scrutiny as a lease, a key-holder list or an insurance renewal.

The risk is especially acute around change. Agency handovers, website rebuilds, staff departures and finance team reshuffles all disturb the quiet arrangements that keep a domain running. A 2026 review should therefore be scheduled before those events, not after them.

Minutes 0–10: establish who legally holds the domain

Begin with the registrar account and the registrant contact. For .uk names, the relevant registry is Nominet, but the day-to-day account usually sits with a registrar or web agency. Confirm three things: the registrant organisation matches the business, the registrant email is a business-controlled mailbox rather than a personal or former employee address, and at least two current staff can access the registrar account through separate credentials.

If the domain was purchased by an agency, check whether it is held in the agency's account or the firm's own. An agency holding the domain is not automatically a problem, but it becomes one when the relationship ends without a documented transfer plan. Record the registrar name, account reference, registrant contact and the date access was last verified. Where the registrant is an individual, plan a correction rather than leaving the discrepancy in place.

Minutes 10–20: renewal, payment and registrar lock

Auto-renew is a useful safety net, not a substitute for oversight. Confirm that auto-renew is enabled, that the stored payment card is current and that the card belongs to the business. Check the expiry date and the renewal notice address. A common failure pattern is a card that expired with a departed finance officer, leaving renewal notices to bounce from a mailbox nobody reads.

Next, confirm the registrar lock is enabled. This is often labelled clientTransferProhibited and helps prevent unauthorised transfers. Review the registrar's account recovery settings at the same time. Multi-factor authentication should be active on the registrar account, with a recovery method that does not depend on the same mailbox or mobile phone as the primary administrator. Store recovery codes in the firm's password manager or another controlled location, not in the administrator's personal notes.

Minutes 20–30: build a plain-English DNS inventory

A DNS inventory does not need to be a technical treatise. It needs to answer what each record does, who asked for it and when it was last reviewed. Export or screenshot the current zone and group the records into categories: website addressing, email routing, verification records, security records and anything unexplained.

Pay particular attention to MX records for email, TXT records used for SPF and DMARC, and verification records for cloud services. Mark any record that points to a supplier no longer used. Note the time-to-live values, because a low TTL makes emergency changes faster while a high TTL can leave stale information cached for hours. The inventory should identify the business owner for each record, not merely the person who can edit it. This is also the moment to remove orphaned records that create unnecessary exposure.

Minutes 30–45: document the emergency change route

An emergency route is only useful if it has been tested on paper. Document who can authorise a DNS change, who can perform it, how out-of-hours contact is made and what the registrar's support process looks like. Identify a break-glass account with appropriate protection and confirm that at least two people know how to invoke the process. Record the expected propagation time and the communication steps for customers and staff if email or the website is affected.

Where changes are planned, such as a website migration or a new email provider, lower the TTL in advance and schedule the work outside peak trading periods. Keep the runbook short enough to be used under pressure. A one-page document with named roles, contact numbers, registrar details and rollback steps is more valuable than a lengthy policy nobody can find.

After the review: assign ownership and set a cadence

The review should end with a named owner, a deputy and a diary entry. A quarterly check of access, renewal and DNS records is proportionate for most UK SMEs. A fuller review should precede any agency change, domain transfer or major cloud migration. Findings should be recorded in the risk register with owners and dates, not left in a shared folder.

The domain may not feel as tangible as a set of shop keys, but it controls access to the shop window, the post and much of the firm's correspondence. Treating it as a governed asset is a modest exercise with a disproportionate payoff: fewer surprises, clearer accountability and a documented way back if something goes wrong.