Who really owns your website and domain: how to check

The fastest way to find out who really owns your business's domain isn't to ask whoever built it for you: it's to check it yourself, for free, in a couple of minutes, with the public whois lookup. It isn't a technical curiosity for specialists only: it's the only way to know for certain whether the domain is registered to you, or to whoever registered it on your behalf, maybe years ago, maybe without either of you ever noticing.

Why the question isn't as obvious as it sounds

It happens often, and almost always out of carelessness rather than calculation: an agency or a single developer, when building the site, registers the domain under their own account instead of the client's. It's simply more convenient at the time, especially if they're already managing dozens of other domains from the same panel. The problem only shows up later, usually at the worst possible moment: when that provider stops answering, or when you simply want to switch who looks after your site. I've written elsewhere about how often I get exactly that call, "the agency isn't answering anymore": if you aren't the domain's registrant, at that point you're not just looking for a new provider, you're also trying to regain control of an address that technically isn't yours.

Whois shows who the registrant really is

Whois distinguishes three roles, and only one actually matters for ownership. The registrant holds legal control: they approve transfers, receive renewal notices, and decide who can make changes to the domain. The administrative contact acts on the registrant's behalf on non-technical matters, and is often the same person or company. The technical contact handles servers and DNS, but has no decision-making power over the domain itself. To find out whether your business's domain is really yours, there's only one field to check: the registrant.

For an .it domain, the official tool is the public whois lookup on the .it Registry's own site (nic.it): type in the domain name and the system returns the registered holder. For generic domains, like .com or .net, since 28 January 2025 the reference protocol is no longer traditional whois but RDAP (Registration Data Access Protocol), which became the service registry operators must offer instead of whois, under a 2023 global amendment from ICANN: ICANN's public lookup tool allows the same check in a few seconds.

For companies, the name is almost always in plain view

There's a detail that makes this check simpler than it sounds, if your business has a VAT number. The .it Registry's policy on the whois database, version 2.2 dated 30 May 2022, applies GDPR personal data protection only to natural persons: the EU regulation, explicitly cited in the document, reserves the status of "data subject" for natural persons, not for legal entities. As a result, consent to publishing one's own data, and with it the option to request it be hidden from the public lookup, is available only to individuals, sole proprietorships and freelance professionals. A company or an organisation doesn't have that option: its name normally shows up in plain view.

In practice, if your business has a company or a VAT number as the domain's registrant, whois should show exactly that name. If instead it shows the name of an agency, a consultant, or someone who no longer works with you, that's a concrete signal, not an interpretation: the domain isn't registered under your business's name.

What to do if you find out it isn't you

Before getting alarmed, it's worth remembering that in most cases this isn't dishonesty: it's a choice made for convenience when the site was built, by someone who was perhaps already managing dozens of other domains from the same panel and didn't think to register this one differently. The practical step is to ask whoever currently manages the domain's control panel to change the registrant to your own business: it's a standard administrative request at any registrar, usually requiring company details or an ID document, not a transfer of the whole website. Having the original invoice or quote at hand helps clarify the situation quickly, especially if your relationship with that provider has since broken down.

The website isn't just the domain

The domain is only one of the things to check. Hosting, the space where the site's files actually live, which I've written about in website hosting: what it really costs, has its own account and credentials, which can be registered to whoever activated it for you instead of to you. And the website itself, if it was custom-built, raises the question of who has admin access to the content and, in more complex cases, to the code. An ongoing relationship with whoever looks after your site, which I cover in why it pays to have someone looking after it, should make clear from the start who each of these three things is registered to, not just the most visible one.

Where to start

The check costs nothing and takes less time than this article did to read: look up your domain name in the official whois tool, .it or generic, and see who's listed as the registrant. If it's you, you've only spent two minutes gaining extra certainty. If it isn't, at least you know where to start fixing it, and who to talk to about it. If you'd like to go through this, or the rest of how your website is set up, together, we can do it as part of the digital check-up: otherwise write to me and we'll look at your domain's whois together.