Registrar Custody: A 2026 Review of Public Identity Control
Photo by Photo by Darya Tryfanava on Unsplash on Unsplash
A domain name rarely appears on an infrastructure register. It is more likely to sit in a finance spreadsheet, a marketing folder or the memory of a former web developer. That is a fragile arrangement for something that underpins email delivery, customer authentication, application programming interfaces and public trust. In 2026, with staff turnover, agency changes and layered SaaS estates, the question is not merely whether a domain renews. It is who can prove control when renewal, transfer or recovery is required.
Begin with the registry chain, not the website
For .uk and .co.uk names, the public registry is operated by Nominet. The organisation that appears as registrant is the legal holder; the registrar is the commercial intermediary that manages the record. Those roles are often confused. An organisation may believe it owns its domain because its name appears on the website, while the registrar account is held under a former employee’s personal email address and paid for with a departed contractor’s card.
An ownership audit should therefore trace the chain from registry to registrar to billing to DNS. Start with a registry lookup for every name the organisation relies on, including defensive registrations, campaign domains and legacy brands. Record the registrar, registrant organisation, administrative contacts, expiry date, registrar lock status and nameserver delegation. For .uk transfers, note the IPS tag and the process required to move between registrars. If the organisation cannot obtain the tag or access the gaining registrar account, it does not have practical custody.
The hidden dependencies inside DNS
DNS is the control plane that most people see only when it fails. A domain may be registered correctly yet still depend on a third-party DNS provider, an agency account or an application programming interface key held by a single engineer. The audit should identify the authoritative nameservers, the account owner for each DNS provider, the billing route and the change approval path.
Delegation records deserve particular scrutiny. Review NS records, DNSSEC configuration and any CNAME records that point to external services. Dangling CNAMEs left behind after a SaaS migration can create subdomain takeover risk. Mail-related records need equal attention. SPF, DKIM and DMARC policies drift when sending platforms change, when marketing tools are added, or when a legacy mail gateway is decommissioned. A domain that passes a basic website check may still be failing authentication for transactional mail or exposing a spoofable brand.
Custody after staff turnover
Domain risk is often people risk. The registrar account may be protected by multi-factor authentication tied to a mobile number that no longer exists. The DNS provider may be under a shared login used by an agency. Renewal notices may route to a generic mailbox that few people monitor. These are not exotic failures; they are ordinary consequences of distributed responsibility.
A practical review should test recovery, not just access. Can the organisation reset registrar credentials without relying on a former member of staff? Are there at least two authorised administrators using organisation-controlled identities? Is the billing method current and owned by finance rather than an individual? Are emergency contacts recorded outside the registrar platform? For critical domains, consider registrar lock and registry lock arrangements where available, balanced against the operational effort of unlocking for legitimate changes.
A one-page control sheet for the next renewal cycle
The output of the audit should be short enough to act upon. A control sheet can be maintained by the owner of public identity records and reviewed before each renewal cycle. At minimum, it should include:
| Control field | Evidence required |
|---|---|
| Domain and purpose | Primary brand, campaign, defensive or legacy |
| Registry and registrar | Nominet record plus registrar account name |
| Registrant entity | Legal organisation name and contact route |
| Registrar access | Two organisation-controlled administrators with MFA |
| Billing and renewal | Finance-owned payment method and renewal date |
| DNS provider | Account owner, billing route and change approver |
| Mail authentication | SPF, DKIM and DMARC owner and review date |
| Transfer readiness | IPS tag, lock status and recovery procedure |
| Risk rating | Critical, important or retiring |
| Accountable owner | Named role, not an individual’s personal account |
The sheet should be linked to the wider IT asset and supplier registers, but it need not duplicate them. Its purpose is to answer a narrow set of questions quickly: who can renew, who can transfer, who can change DNS, and who can prove the organisation’s authority if a dispute arises.
Treat public identity as infrastructure
Domain names are not merely addresses. They are control points for authentication, mail, brand integrity and service continuity. An organisation that audits servers and SaaS renewals but leaves registrar custody to historical accident is carrying an unmeasured dependency. The remedy is not a large programme. It is a documented chain of custody, tested access, named accountability and a renewal review that happens before the expiry notice, not after it.
