The one account that can move your whole company somewhere else

Somebody set your domain up years ago. Possibly a web designer, possibly a founder on a laptop, possibly whoever happened to have a card to hand that afternoon. It cost about twelve pounds, it renewed quietly ever since, and the login has been sitting in a shared password note or an old inbox ever since. Nobody thinks about it, because there is nothing to think about. The domain works.

Here is the part worth sitting with for a moment. That account doesn’t just hold a web address. It decides where your website lives, where your email is delivered, and — because every “forgot password” link in every system you own is sent to an address at that domain — who can reset the password on everything else. Whoever controls the registrar account controls the front door to the company, and then all the interior doors as well. It is the single most load-bearing account most small businesses own, and it is very often the only one with no two-factor authentication, no transfer lock, and a contact address that belongs to someone who left in 2022.

That’s the quiet failure: not a break-in, but a piece of critical infrastructure sitting unlocked because it has never once misbehaved.

Why it stays invisible

Everything about a domain is designed to be undramatic. It renews automatically, it costs almost nothing, and it produces no alerts, no dashboards and no monthly report anyone reads. There’s no moment in the year when someone is obliged to look at it. So the account that matters most gets audited least, purely because it never asks for attention.

The transfer lock is the clearest example. A domain can carry a set of status flags — the technical name is EPP status codes — that tell the registry what is and isn’t allowed. The one that matters here is clientTransferProhibited, which blocks the domain from being transferred to a different registrar. ICANN’s guidance to registrants is direct about this: asking your registrar to apply status restrictions such as clientTransferProhibited, clientDeleteProhibited and clientUpdateProhibited helps prevent unauthorised transfers, deletions and updates to your domain (ICANN, EPP Status Codes). Some registrars set the transfer lock for you at registration. Others set it only when you ask. Nothing on your invoice tells you which sort you have.

The contact address is the second half of it. The email on the domain record is where transfer confirmations, expiry warnings and account-recovery messages go. If it points at a person who has left, or at an alias nobody monitors, then the one warning you’d get before your domain moved elsewhere lands somewhere silent.

And the whole domain layer tends to sit on a single point of failure by default. Our own measurements bear this out: 97.4% of UK small companies have all their nameservers with a single provider (n=954, 95% CI 96.2–98.2, measured 18 August 2026 — Quiet Failures base rates). That figure is about DNS rather than registrar locks, and single-provider DNS is a perfectly reasonable choice for a small company. It’s quoted here for what it says about shape: at the domain layer, almost everything you depend on hangs from one account, with one fate. Which is an argument for making that one account genuinely hard to take.

Find it yourself

You can establish exactly where you stand in about ten minutes, and most of it needs nothing but a browser.

1. Look up your own domain’s status. Open a WHOIS or RDAP lookup — your registrar’s own “whois” page will do, as will ICANN’s public lookup — and search for your domain. Read the Domain Status lines. You are looking for clientTransferProhibited. If you see it, the transfer lock is on. If the status reads only ok or active, it is not.

2. Read the dates and the contact while you’re there. Note the expiry date, and check whether the registrant contact email is one a current employee actually reads. “Privacy protected” is fine and normal — but you should still be able to say who receives the mail behind it.

3. Establish who can log in. Open the registrar’s control panel and find the account settings. Two questions, both plain. Is two-factor authentication switched on? And how many people can sign in — including the web agency you used in 2019, and anyone sharing a single set of credentials?

4. Check the lock in the panel too. Registrars label this differently — “Domain lock”, “Transfer lock”, “Registrar lock” — and it usually sits in the domain’s settings page next to the nameserver fields. Confirm it agrees with what WHOIS told you.

5. No command line needed at all. Every step above is a web page. If you’d rather use one, whois yourdomain.com from a terminal returns the same status lines.

The common finding isn’t a disaster. It’s that the lock was never turned on, and that three people you’d have to think hard to name can still sign in.

The fix

Good here is a short, dull list, and it’s mostly done in one sitting.

Turn the transfer lock on. In the registrar’s control panel, enable the domain lock. This sets clientTransferProhibited and means a transfer request can’t proceed until someone deliberately unlocks the domain first. It costs nothing and inconveniences you only on the rare day you genuinely want to move registrars.

Know how to undo it, because you will need to eventually. Legitimate transfers are your right, and the policy protects that: if a registrar doesn’t give you a way to remove the lock yourself, it must remove clientTransferProhibited within five calendar days of your request, and it may not refuse to release your authorisation code merely because you’re in a billing dispute (ICANN, Transfer Policy). Worth knowing before you’re in a hurry. Note too that changing the registrant’s details can itself trigger a 60-day transfer lock — so if a genuine move is coming, do the contact tidy-up well ahead of it, not the week before.

Put two-factor on the account, and make it someone’s job. The registrar login deserves at least the protection your email has. Give it multi-factor authentication, get it out of any shared note, and record — in writing, somewhere a colleague could find it — who owns the account and who the backup is. An account nobody owns is an account nobody notices losing.

Point the contact address at a role, not a person. Use something like [email protected] that reaches more than one current employee, and make sure the registrar’s notification emails aren’t quietly filtered away. This is the change that turns “we had no warning” into “we got the email”.

Set a calendar reminder for a year’s time. Fifteen minutes, once a year: check the lock is still on, the expiry is still far away, the contact still works and the list of people who can log in is still the list you’d want. Auto-renew on a live card is part of this too.

None of this needs a security consultant, and none of it costs anything. It’s one afternoon’s attention to the account that everything else quietly depends on — after which the most important thing you own is also one of the harder things to take.

PS — if you’d rather not read raw WHOIS output, DomainOps reads the status flags, expiry date and contact for you and tells you plainly whether the transfer lock is on, then watches for changes you didn’t make. But the lookup above costs nothing but ten minutes, so do that first, today, whether or not you ever automate the watching.