Email and Domain Ownership When Switching IT

Here is a question that stops a surprising number of business owners cold: if your IT provider vanished tomorrow, could you log in to the account that controls your domain name? Not your website. The domain itself, the thing your email, your website, and half your logins hang off of.

For a lot of small businesses, the honest answer is no. The domain was registered years ago by a web guy, an old provider, or a long-gone employee, and it has quietly worked ever since, so nobody has looked. That is fine right up until you switch IT providers, and then it is the single most common source of drama in the whole transition. The good news: you can check all of this today, in about twenty minutes, without telling anyone anything.

The three things your business must control

People say "we own our domain" as if it were one thing. It is three, and they can be held by three different parties without anyone noticing.

1. The registrar account

The registrar (GoDaddy, Namecheap, Cloudflare, and so on) is where the domain is actually registered. Whoever controls the registrar account can renew the domain, transfer it, or let it expire. This account should be in your business's name, tied to an email address your business controls, with billing on your card. Not your provider's account with your domain inside it. Providers holding client domains in a shared account is common and usually well-intentioned, but it means your most fundamental digital asset sits behind someone else's login.

2. DNS

DNS is the set of records that says where your email gets delivered (MX records), where your website lives, and which services may send mail as your domain (SPF, DKIM, DMARC). DNS is often hosted at the registrar but does not have to be. It is completely normal, and fine, for your IT provider to manage DNS day to day. The requirement is that your business has its own admin access too, so a provider change never means begging for control of your own records.

3. Email admin

Your Microsoft 365 or Google Workspace tenant has a global admin role. That role can read settings for every mailbox, reset any password, and add or remove users. Your provider needs admin access to do their job. But at least one global admin account should belong to your business: credentials in your safe (with MFA on), not just theirs. If every admin on the tenant traces back to the provider, then in every practical sense, they own your email.

The traps we see most often

• The domain registered under the provider's own account. The classic. Often it dates to the original website build. Everything works for years, and then a switch (or a dispute, or the provider going out of business) reveals that "your" domain is an entry in somebody else's portal.
• The provider's email as the registrar contact. Even when the account is nominally yours, renewal notices, expiry warnings, and password resets go to an address at the provider's domain. If the relationship sours, so does your ability to recover the account.
• Registered under an ex-employee's personal email. Not a provider problem, but the same disease: the office manager who set it up in 2016 left in 2019, and the recovery email is a personal Gmail nobody can access.
• DNS held hostage by inertia. The domain is yours, but DNS is hosted on the old provider's platform, and moving it was "on the list" for years. During a switch, this turns a five-minute records update into a negotiation.
• No business-held global admin. The tenant is legally yours, and Microsoft and Google both have recovery processes for exactly this, but those processes take time and documentation. During a transition, time is the thing you do not have.
• Domain expiry mid-drama. Domains renew annually, and a domain that expires during a provider dispute can be lost or held for ransom pricing. Know your expiry date before it matters.

How to check where you stand, today

1. Look up your domain's registration. Run a WHOIS or RDAP lookup on your domain (your registrar's own lookup page, or ICANN's lookup at lookup.icann.org, works fine). Privacy services often mask names, but you can still see the registrar, the creation and expiry dates, and the nameservers. If the registrar is a company you have never heard of and the nameservers point at your provider, that is your first data point.
2. Try to log in to the registrar. Does anyone at your company have credentials? Does the account's contact email belong to your business? If you cannot answer both with yes, treat it as a finding, not a crisis, and write it down.
3. Check who can edit DNS. Ask where DNS is hosted and whether your business has its own login. The nameservers from step 1 tell you where to look.
4. List your email admins. In Microsoft 365 or Google Workspace, an existing admin can list all admin accounts in a minute. Confirm at least one global admin belongs to the business, with MFA enabled and credentials stored somewhere durable.
5. Note your expiry dates. Domain renewal date, and whether auto-renew is on and billed to a card you control.

Twenty minutes, and now you know your exposure. If everything checks out, excellent: your eventual provider switch just got dramatically simpler. If it does not, keep reading.

Fixing ownership without starting a war

If the domain sits in a provider's account, the fix is a registrar transfer into an account your business owns, or at minimum moving it into your own account at the same registrar. Most providers cooperate when asked plainly and in writing; the domain is not an asset they want a fight over. Do it calmly and, ideally, before you announce any switch, because untangling ownership is easier while the relationship is still routine. If a provider refuses to release a domain that is plainly your business's name and trademark, registrars and ICANN have dispute processes, and that is the point to check with your attorney rather than escalate on your own.

The email admin fix is even simpler: ask for a business-held global admin account to be created this week. Any provider who resists giving the business owner admin access to the business's own tenant is telling you something important, and it belongs next to the other entries on our list of signs you should fire your IT provider. To be fair, the reverse is also true: a provider who says "of course, here you go" just earned real credibility, which is worth weighing before you assume the worst; we wrote about that judgment call in New MSP, or Just Better Communication?

Why this comes before everything else in a switch

In our phased transition plan, ownership verification sits in phase one, before the new provider is even chosen, because everything else in the switch depends on it. DNS changes route your email during cutover. Registrar access proves the domain follows you. Admin credentials are what actually gets recovered in the credential-recovery step, and they matter to your cyber insurance posture too, since identity and admin control are the first things an underwriter asks about. When we run a switch, recovering every one of these accounts, including the awkward conversations, is part of the service. But the twenty-minute check above is yours to do today, no matter who you switch with, or whether you switch at all.