Does your business really control its domain name?

Before looking for a password, find out which service it gives access to.

Within a business, the domain, website hosting and email are often referred to by the name of the provider looking after them. ‘It is all with our agency’ may cover several suppliers and several accounts.

Four separate elements are worth identifying:

One provider may supply all four services. Their functions remain separate: registering a domain does not, by itself, provide website hosting or email accounts. The my.lu guide explains this distinction.

DNS records connect the domain to its associated services. Their configuration affects both the website and email, as explained in the DNS Luxembourg glossary. That is why work carried out for the website can have consequences elsewhere.

Ask your provider to help complete this overview with the relevant accounts and contact details. Include less visible uses: an old address that redirects visitors, a subdomain or a tool used by only a few employees.

This overview will be useful when changes are next made. Before a website redesign, for example, it helps you agree what will change and who will then check the website, outgoing email and incoming email.

Once the services are identified, one central question remains: in whose name is the domain registered?

The answer is not necessarily on your agency’s invoice. The person paying the bill, the person making changes and the person or organisation recorded as the holder may be different.

Obtain confirmation of the registered identity from the management account or the registrar, and keep a dated copy. If you find the name of a founder, a former employee or a provider, ask why that name is on record and what steps would be needed to put the arrangements in order.

The registered contacts matter too. The my.lu guide distinguishes administrative, technical and billing contacts, and explains that the administrative contact must be authorised by the holder. These roles are separate from the permissions needed to log in to an account. See My domain name.

What WHOIS can tell you

For a .lu domain, a WHOIS lookup provides a useful starting point. However, only some registration data is public: the identity of an individual holder is hidden, apart from their country of residence, and administrative and technical contact details are hidden by default.

Missing information in the public results does not necessarily indicate a problem. The DNS Luxembourg WHOIS page explains these limits. Ask the domain manager for the information you need.

If a change is required, establish exactly what kind. Updating contact details, changing the registered holder and transferring the domain to another registrar are different operations. The .lu registry describes a change of holder and a change of registrar separately. The published procedures provide for approval by the current administrative contact.

Migrating a website is a different task again: moving its files does not, by itself, change the domain’s registered holder.

Knowing where the domain is managed does not yet mean you can act. An account may be known but inaccessible, or provide only limited permissions.

With an authorised person, try logging in at the official management address. Check the permissions available: being able to view an invoice does not necessarily mean you can change DNS records or manage users.

Protecting access deserves as much attention as making it available. ANSSI recommends separate passwords and two-factor authentication where it is offered. Its digital security guidance also explains the benefits of a password manager.

Then ask: what happens if the usual way of signing in is no longer available?

Depending on the provider, recovery may involve backup codes, another authentication method or a request to support. Ask for confirmation of the steps and the evidence required. A process known in advance is easier to follow than one discovered during an outage.

Where the service allows it, individual user accounts with appropriate permissions make responsibilities easier to share. They also allow one person’s access to be removed without disrupting everyone else.

When an employee leaves or a contract ends, review the relevant permissions, recovery contact details and authentication methods. Record the process and where the backup methods are securely stored in your management record. Keep passwords and codes separately in a secure vault.

Renewal often seems settled once it is automatic or delegated to a provider. Its outcome still needs to be checked.

A replaced payment card, a notification sent to the wrong inbox or an unclear responsibility can allow a deadline to pass. For every domain you intend to keep, Wize suggests documenting four points:

An internal reminder should leave enough time to resolve an access or payment problem. If the domain is included in an annual package, ask your provider how renewal is monitored and how you receive confirmation.

Remember secondary domains

Include old addresses and less frequently used domain names in your review. A domain with no visible website may still receive email or redirect visitors.

Before giving one up, have its uses checked and record the decision. The absence of a website or apparent traffic is not enough to conclude that the domain is no longer needed.

These checks become most useful when they enable another authorised person to take over.

You can delegate day-to-day work to a provider while retaining your ability to make decisions. Agree in writing which operations are delegated, which require your approval and who is responsible for monitoring renewal.

Also establish who to contact during an incident, which documents will be handed over at the end of the contract and how management can be transferred. For a .lu domain, make sure the registered administrative contact remains reachable: the registry stresses the importance of an accessible email address in its registrar transfer process.

Bring the useful information together in an internal record:

Where to start if information is missing

Gather the invoices, registration confirmations and existing correspondence. You can then send a precise request to your contact:

Ask your provider

To update our management record, could you confirm the registered holder and contacts, the registrar, the management account address and the renewal arrangements?

Please also explain who manages the DNS records, which services depend on them and how another person authorised by our business could take over.

If an update is needed, please explain the operation, the approvals required and any possible consequences before making the change.

Keep the response with your record. Following a departure, a change of provider, a migration or a change to payment arrangements, review the relevant points. Updating the record is part of the handover.