The question most owners cannot answer
If someone asked you right now who controls your company's domain, could you answer? Not the name on the invoice - the person who can log in and change where your website points, where your email goes, and who the domain belongs to.
In our own onboarding work, this is the single most common gap we find. The domain was registered years ago by a web developer, an IT consultant, or someone who has since left. The registrar account sits in a personal mailbox. The password is in a browser nobody uses any more. And the business keeps paying for a website and email that both depend on an asset it does not control.
This article is about ownership and control. The attack mechanics - how hijacking and DNS spoofing actually work, and what DNSSEC does and does not stop - are covered in our article on domain hijacking and DNS spoofing.
What the domain actually controls
Your domain is not just a web address. It is the set of DNS records that tell the internet where your services live. Microsoft's own domain setup guidance lists the records a business tenant depends on, and every one of them is a lever[1].
| Record | What it does | What happens if someone changes it |
|---|---|---|
| A / AAAA | Points the domain at your web server | Visitors land on someone else's page |
| MX | Routes your email | Mail goes to the attacker, you stop receiving |
| TXT (SPF, DKIM, DMARC) | Proves which senders are legitimate | Your mail is treated as spam, forgeries pass |
| CNAME | Aliases for subdomains | Services quietly redirect |
| NS | Delegates DNS to nameservers | Whoever holds this holds everything |
Change the NS records and every other row follows, including anything that verifies ownership through DNS: certificates, Microsoft 365, Google Workspace, payment providers.
How control actually gets lost
Three patterns, in order of how often we see them.
The domain sits in a contractor's personal registrar account. Nothing goes wrong until the relationship ends, at which point transferring the domain becomes a negotiation instead of an admin task.
The renewal notice goes to a mailbox nobody reads. The registration lapses. There is a grace period and then a paid redemption window, but after that the name is released and anyone can register it.
A former employee still has the login. Usually nothing happens, until their own credentials leak somewhere else and an attacker inherits your DNS.
None of these need an attacker to be clever. They need nobody to have checked.
The two-hour fix
| Action | Why | Time |
|---|---|---|
| Establish who controls the registrar account | You cannot secure what you do not own | 15 min |
| Move the account to a company mailbox, not a person's | Personal addresses leave with people | 30 min |
| Turn on MFA at the registrar | The password alone is not enough | 5 min |
| Turn on the transfer lock | Stops a domain moving without your say | 10 min |
| Enable DNSSEC | Signs your records so answers cannot be forged | 20 min |
| Cut DNS edit access to two or three people | Fewer keys, fewer incidents | 15 min |
| Set auto-renew and a card that will not expire | Prevents the accidental loss | 5 min |
| Export and store your current records | Your baseline if something changes | 30 min |
Two details are worth spelling out. Domain transfers between registrars are governed by ICANN's Transfer Policy, which sets out the authorisation and lock rules a registrar must follow - which is what makes the transfer lock more than a checkbox[2]. And DNSSEC works by cryptographically signing your DNS answers so a forged reply can be detected, which is a different job from stopping someone who has logged into your account legitimately[3].
If a domain is registered in someone else's name, Microsoft's transfer guidance is the practical starting point for moving it into an account you control before you touch anything else[4].
The hosting layer
Once the domain is yours, hosting is the next bill worth reading. Most small business sites need six things, and most of them are free or close to it:
| Requirement | What it means | Realistic monthly cost |
|---|---|---|
| Uptime commitment | A published SLA, not a promise | €15-30 |
| TLS certificate | HTTPS, automatically renewed | €0 |
| Daily backups | Automated, around 30 days retained | €0-10 |
| DDoS absorption | Traffic spikes handled upstream | €0-15 |
| CDN | Fast delivery outside your region | €0-20 |
| Mail forwarding | Contact forms actually arrive | €0-5 |
A managed host covers all of it for €25 to €50 a month. If you are paying over €100 for a site with fewer than 10,000 visitors a month, you are buying capacity you will never use.
Cost is the smaller risk. The bigger one is an unpatched site: most small business site compromises we clean up came in through an outdated plugin or theme, not a clever exploit. Automatic updates plus a host that patches the platform for you removes most of that surface.
The SSL question, asked properly
"Do we need SSL?" stopped being a question when browsers started marking plain HTTP as not secure. The real question is free or paid.
Let's Encrypt issues domain-validated certificates at no cost, and its certificates are trusted the same way any other DV certificate is - the encryption and the browser padlock are identical[5]. It deliberately does not issue organisation-validated or extended-validation certificates, which is fine, because browsers no longer display company names prominently enough for most businesses to care.
| Certificate | Cost | Who actually needs it |
|---|---|---|
| Let's Encrypt DV | €0 | Almost every small business |
| Paid DV | €50-150/yr | Nobody, unless a host forces it |
| EV | €200-500/yr | Regulated finance and legal, occasionally |
| Wildcard | €100-200/yr | Many subdomains on one certificate |
The real risk is not the certificate type, it is expiry. Let's Encrypt certificates are short-lived by design and renew automatically, which is a feature until the renewal job silently fails. Monitor certificate expiry the same way you monitor domain expiry.
Actually
Your domain is the one asset every other part of your digital presence hangs off: website, email, cloud sign-in, payments, verification. Securing it takes an afternoon and costs nothing. Not knowing who controls it is the risk, not the technology.
If you do not know who holds the keys, or you want a second pair of eyes on your DNS records, registrar security and certificate renewals, book a free 30-minute call.