A company wanted to transfer its domain to a new registrar. The registrar's confirmation email went to the technical contact on file, a former employee who had left three years earlier. His mailbox no longer existed.
The transfer could not be approved, and the registrar's support required identity documents and proof of control to change the contact. Meanwhile the domain approached expiry. It took eleven days of paperwork to resolve.
The company now uses a role address for all domain contacts, and reviews them each year.
Who the contacts are, and why they matter
Every domain registration carries contact records. Traditionally there are four: the registrant (the legal owner), the administrative contact, the technical contact and the billing contact. In practice many small organisations filled all four with the same person, usually whoever happened to set the domain up, using their personal work email.
Since the privacy rules that came in around 2018, public lookups often show redacted details, which makes the problem harder to spot. The records still exist; you just cannot see them without logging in to the registrar. So an out-of-date address can sit there for years while the public record looks tidy and anonymous.
Which of those contacts receives which message depends on the registrar and on the type of domain. Renewal reminders usually go to the registrant or billing address, transfer approvals to the registrant or administrative one, and country-code domains have rules of their own. The company in this story learned that the hard way: it had assumed the account owner's email would be used for everything.
What the company was trying to do
The company was a regional accountancy firm of about thirty staff. It had decided to move its domain from a registrar it had outgrown to one bundled with its hosting. The domain was ten years old, renewed automatically each year, and nobody had touched its settings since the original registration, which had been done by an IT contractor who later joined a larger firm.
The steps were the usual ones for a transfer between registrars: lift the registrar lock, request the authorisation code (sometimes called an EPP code or transfer key), enter it at the new registrar and approve the request by email. The first three went smoothly. The fourth never completed.
Eleven days, in order
Day one: the transfer was started and no approval message arrived. The IT manager looked in spam, then asked the registrar's chat support, which told her the message had been sent to the technical contact. She read out the address and recognised the name instantly.
Days two and three: she tried to change the contact from within the account. The registrar refused, citing a security policy that required the registrant's verified identity for contact changes on domains this old. Support asked for a copy of the company's registration certificate and a photo ID for a named director, plus a signed letter on company letterhead.
Days four to seven: the director was abroad. The documents went in on day six. A first submission was rejected because the scan was too dark to read.
Days eight to eleven: the contact was changed, a fresh approval email arrived, the transfer was approved and then completed. The domain's renewal date was just four days away at that point, and the old registrar had already sent two reminders that, naturally, also went to the missing mailbox.
The cost, and the near miss
Nothing was lost in the end, but the margin was uncomfortable. Had the director been unreachable for another week, the domain would have entered its grace period with the website and every staff mailbox on it. Most registrars keep a lapsed domain's DNS running for a while or park it on an advert page, which means email would have stopped arriving without any warning at the firm's end. An accountancy practice that cannot receive client email in the middle of the tax season has a very bad day.
The direct cost was about forty staff-hours of chasing, scanning, waiting on hold and writing letters. The indirect one was a partner asking, reasonably, what else in the firm's setup depended on someone who had left. That question led to a one-page list of every external service and the person responsible for it, which turned out to be the most useful result of the whole episode.
Why registrars are strict about this
It is annoying, but the strictness has a point. Anyone who can change a domain's contact and approve a transfer can take the name, and with it the website, the email and every account that sends password resets to that domain. Domain theft is a real crime with real victims, so registrars treat a request to change contact details on a decade-old domain, made by someone who cannot read the mail sent to the existing contact, with suspicion.
Many registrars also apply a short lock, often 60 days, after a change of registrant details during which the domain cannot be transferred out. Some let you opt out at the time of the change, and some do not offer that option at all. Ask before you change anything, not after.
What a good contact setup looks like
| Field | Weak choice | Better choice |
|---|---|---|
| Registrant | A named employee or contractor | The organisation, with a role mailbox |
| Administrative contact | The person who set it up | [email protected], read by two or more people |
| Technical contact | A former agency developer | The same role address, or the current IT provider's shared one |
| Billing contact | Whoever has the company card | [email protected] |
| Account login email | A personal mailbox | A role address with two-factor sign-in held by two people |
One caution: do not put the role address on the domain it manages. If the domain lapses, the mailbox stops working with it, and so does the reminder. Use a mailbox on a different domain for registrar contacts, so the warning outlives the problem.
What to do if this is happening to you now
- Log in to the registrar and read all four contact records. Write down every address.
- Check the domain's expiry date and add a calendar reminder for thirty days before it.
- If a contact can be changed in the control panel, change it to a role address you control, then read the registrar's notes about any lock period.
- If you cannot change it, ask support what they need, and send everything in one go with clear, bright scans.
- Renew the domain for a year or more while you sort it out, if the registrar allows it. That buys time at the price of a renewal.
The guide to choosing a registrar has more on what support quality looks like, and the expiry checker is useful for watching certificate dates alongside domain ones.
When someone leaves
The root cause was not the registrar or the contact record. It was that leaving the company had no step that said "hand over the things only you know about". The contractor had set up the domain, the DNS and the hosting login, and his departure removed his mailbox but nothing else, which is how an address ends up pointing at nobody.
A leaver checklist for small organisations needs only a few lines on the technical side: which external accounts is this person the contact for, which of those can be moved to a role address now, and who becomes the second holder of each login. It takes ten minutes at the exit interview and saves eleven days three years later.
A ten-minute check
Log in to each registrar account you have and open the domain's contact page. Check who the registrant is, which address each role uses, and whether those mailboxes exist today by sending each a message. Check the account's own login email as well, since it is the recovery route for everything else. A whois example.com from a terminal may show redacted data, but it does show the expiry date, the registrar and the nameservers.
Loose ends
Does the person who registered it still own it?
Not unless the registrant record names them personally. If a contractor registered it in their own name, the legal owner is the contractor, and getting it changed is a separate and harder job.
Can I just let it expire and re-register it?
That is risky. Your website and email stop in the meantime, and someone else may grab the name when it is released.
What if the registrar went out of business?
The registry can sometimes help, though it takes patience. Start by gathering proof that the domain is yours.
What would have caught it
- Use a role address for registrar contacts.
- Review contact details on all domains annually.
- Document who has access to each registrar account.
- Start any transfer at least a month before the domain's expiry date.
- Put the registrant, not an individual, in the registrant field.