Domain Name Management: Own the Name Your Business Runs On

Every business runs on one name. Customers type it into a browser. Staff send mail from it, and several cloud services check it before they will let anyone log in.

The trouble usually starts with a small request. A new phone system needs one mail record changed, and it turns out nobody in the building can log in to change it. The name was registered years ago by whoever built the first website, and that person is long gone.

The other version arrives as an outage. A renewal notice goes to a mailbox that closed when a staff member left, the reminders run out unanswered, and the website and the email stop on the same morning.

Both cases have the same cause. Domain name management sits outside every check that catches the rest of the IT, because the name has no serial number and never appears on a purchase order.

Price it before deciding it is a small problem. Take an illustrative 18-person Christchurch firm whose .co.nz name lapses for two working days: about $1,980 of staff time lost to workarounds, roughly $3,200 of enquiries that bounce and never arrive, and about $1,200 of provider time to recover the name and rebuild the records. That is about $6,400 for something a free setting would have prevented.

What Is Domain Name Management?

Domain name management is the ongoing job of holding a domain name in the company’s own name and controlling the records attached to it. Two separate things are involved, and businesses tend to treat them as one.

The registration is the legal right to use the name for a fixed period. Domain names are leased, and .nz registrations renew annually or in multi-year terms.

The DNS zone is the switchboard. DNS stands for Domain Name System, and the zone is the list of records that tells the rest of the internet where your website and your mail live.

.nz is New Zealand’s country code top-level domain, or ccTLD. InternetNZ writes the rules for it and the Domain Name Commission, usually shortened to DNC, enforces them.

Those two halves are joined by the nameserver records. Nameservers, often shortened to NS, tell the internet which server holds the authoritative copy of your zone, so a business can register the name at one provider while its web host answers for the records, and changing the nameservers moves every record at once.

What does managing a domain involve day to day?

Managing a domain involves four small jobs, and none of them takes long. The registrant details need to be current, the registrar login needs to sit somewhere the business controls, the zone records need to match the services in use, and the renewal needs to reach an account somebody reads.

Store the registrar credential in the company’s password manager and not in a personal browser profile. A login held in one employee’s saved passwords leaves when they do.

How is authoritative DNS different from DNS filtering?

They solve unrelated problems and are often confused. Authoritative DNS is your own zone, publishing where your services live so the rest of the world can find them.

DNS filtering is a security control deciding which sites your staff can reach. It works on other people’s domains and has no bearing on who holds your registration.

Who Legally Holds Your Business Domain Name?

The registrant holds it, and the registrant is whoever is named on the registration record, whatever the invoice says. That single field decides who can move the name or change the records.

This catches out businesses that had a website built years ago. The developer registered the name to their own company as a convenience, and the record still says so a decade later. Nobody acted badly, and it was the fastest way to get the site live that week.

business.govt.nz tells new businesses to register the name with an authorised registrar, and the DNC publishes that list. A name bought through a reseller still sits under an authorised registrar, and that registrar carries responsibility for it.

Why does the registrant contact matter more than the invoice?

Because the registrar acts on the registrant’s instruction and treats everyone else as a third party. Paying the bill for fifteen years gives a business no standing at all when another company is named on the record.

The DNC’s own guidance says registrars are unlikely to release an authorisation code to any party other than the registrant, and advises requesting it from the registrant email address on the registration record. When that address belongs to a former contractor, the business has a problem it cannot solve by paying.

Out-of-date contact details are also a breach of .nz policy, and the DNC can ask a registrant to validate them.

What does a .nz registration give you?

A .nz registration gives you the right to use the name for the registration term, and no more than that. Nobody owns a .nz domain outright, and the registration renews indefinitely as long as somebody renews it.

It also puts your details in the public WHOIS record. Individuals who do not use a domain for trade can hide theirs with the Individual Registrant Privacy Option, or IRPO, but a trading business generally cannot, so look your own name up once a year.

A registration is not a trade mark. Registering yourbusiness.co.nz gives you no claim over the same words at another second level domain, which is why businesses that care about the name register the obvious variants and point them at the main site.

Which DNS Records Does Your Business Depend On?

Five record types inside the zone carry everything a small business runs on its name. Get one wrong and a service disappears, with no error message a manager would recognise.

An A record points the name at the web server holding your site. A CNAME, short for canonical name, points one name at another, which is how booking systems and payment portals are usually attached.

An MX record, short for mail exchanger, routes your email. A TXT record proves to a service such as Microsoft 365 that you control the name, and an SPF record, short for Sender Policy Framework, sits inside a TXT entry and lists which servers may send mail as your business.

Sender policy and email authentication are a larger subject than this post covers, so treat SPF here as one entry in the zone.

Which third-party services hang off your domain?

The list is longer than most owners expect, and each service adds a record somebody has to remember. Payment portals, booking systems, e-commerce platforms and marketing tools are attached with a CNAME or verified with a TXT entry.

A business with four services hanging off one name has four things that break together, and the person who set them up is often no longer there.

Write down the reason whenever a supplier asks you to add a record, or it becomes a record nobody dares remove three years later.

Where should the zone be documented?

Document the zone outside the registrar, in records the company keeps itself. Export the zone file or capture every record, and store it with the rest of your IT documentation. Update it whenever a service is added.

A documented zone can be rebuilt in an hour. An undocumented one gets rebuilt one complaint at a time, as staff report what has stopped working.

What Happens When a Domain Renewal Is Missed?

The name stops resolving, which takes the website and the email down together, and then it moves through a grace period and a redemption period before anyone else can register it. The business usually hears about it from a customer who could not reply to a quote.

The failure is almost never a decision. A renewal notice goes to an address with no person behind it, or to a card that expired, and the reminder sequence runs out unanswered.

Two-day outages are common, because recovery depends on reaching the registrar in business hours with proof of identity. A name sitting in a former contractor’s account takes longer than that.

How long is a lapsed domain name recoverable?

A lapsed name stays recoverable for a window after expiry, and the length of that window depends on the registrar and the second level domain. A .co.nz name passes through a grace period, then a redemption period, before it is released for public registration.

Do not treat that window as a plan. Once the name is released anyone may register it, and a name trading for fifteen years is attractive to whoever notices it first.

Who should the renewal notice go to?

The renewal notice should go to a role address the business controls, with a second copy to the finance mailbox. Renewal reminders sent to one named person fail the moment that person changes job.

Register for several years if the registrar allows it. A three-year term removes two chances to miss the notice.

Put the expiry date wherever the business already tracks compliance dates.

How Do You Stop a Domain Name Being Lost or Hijacked?

Six controls do almost all of the work, and five of them are free. They settle who is named on the record, who can log in, whether transfers are blocked, where the renewal is billed and whether the zone is written down.

• Register the name to the company. The registrant should be the legal entity, with a role address such as accounts@ or admin@ as the contact.
• Hold the registrar login yourself. A business that cannot log in does not control its name, whoever manages it day to day.
• Turn on two-factor authentication at the registrar. Own Your Online, the NCSC’s business guidance, advises using an authenticator app or a physical key over codes sent by text message, because text and email codes can be intercepted.
• Enable registrar lock. A locked name carries a client transfer prohibited status and cannot be moved until your current registrar removes it.
• Bill the renewal to a monitored account. A shared finance mailbox and a company card outlast any individual’s inbox.
• Write the zone down. Keep a current copy of every record somewhere other than the registrar’s dashboard.

None of that is technical work. Domain name management is mostly a question of whose name is on what, checked once a year.

Ask your provider about DNSSEC too, which signs your zone so a browser can tell it reached the real record.

The domain belongs on the asset register alongside everything else the business owns. It has no serial number, which is why it falls out of IT asset management unless somebody adds it deliberately.

Who should hold the registrar login?

The business should hold the registrar login, with its IT provider given delegated access. That arrangement survives a change of provider, because the account stays where it is and the access is withdrawn.

A provider who insists on registering the name in their own account is asking the business to accept a risk it does not need to take. Ask for the company to be the registrant before work starts.

How Much Does Losing Control of a Domain Name Cost?

Losing control of a domain name costs more than fixing it, in almost every case. The bill arrives as lost trading and staff time, and neither line appears in the IT budget.

Read the table from the bottom up. The last two lines show what the first four prevent.

Which of those costs can you avoid?

Return to the illustrative 18-person firm from the start of this article. Its two-day outage came to about $6,400: roughly $1,980 in staff time, about $3,200 in enquiries that never arrived and about $1,200 to recover the name.

Correcting the registrant and taking on managed domain and DNS management would have cost about $700 in the first year, then about $250 a year.

That nets out at roughly $5,700 avoided on the first occasion it would have happened, against $250 a year to hold the position afterwards.

How Do You Recover a Domain Held in Someone Else’s Account?

By proving you are the registrant, or by getting the named registrant to authorise the change, and then moving the name to a registrar the business controls. The .nz rules are explicit on the provider’s obligations here.

A provider must not decline or delay a transfer request by withholding the authorisation code, and the DNC states that the code must be supplied to the domain name holder on request and free of charge. Quote that when a former developer stalls.

The code was called a UDAI, short for Unique Domain Authentication Identifier, and is now an Authorisation Code under the current .nz rules. Plenty of businesses and older provider dashboards still use the old name, so ask for either.

Allow a fortnight where the third party co-operates, and longer where the registrant company has been struck off, because a struck-off company cannot authorise anything.

1. Look up the name in the DNC’s WHOIS service and read the registrant field. WHOIS is the public record of who holds a domain, and it will tell you inside a minute whether your business is named.
2. Ask the named registrant to authorise the transfer in writing. Where the registrant is a company that still exists, this is a short email and no dispute.
3. Request an Authorisation Code from the current registrar. The code works only once and expires after 30 days, so start the transfer promptly.
4. Check for a transfer lock before you begin. A client transfer prohibited status has to be removed by the current registrar first.
5. Move the name to a registrar where the business holds the account, then correct the registrant and the contact address. Confirm the change in WHOIS afterwards and do not assume it went through.

What if the developer will not respond?

Escalate to the registrar first, then to the DNC, which takes complaints about .nz providers. A dispute resolution service also exists for disagreements over who has rights to a name.

Where the name has already lapsed and been taken, the practical answer is often a new name and a redirect, which costs more than the controls would have.

Changing where mail is delivered is a separate project with its own sequence. If a mailbox move forms part of the work, email migration covers that side of it.

Book a Domain and DNS Review

Exodesk has supported South Island businesses since 1989 and works with clients across Canterbury, Otago and Southland from offices in Christchurch and Dunedin. Domain name management sits inside our managed IT services, so the registrant is right, the lock is on, the renewal is watched and the zone is documented before any of it turns urgent.

Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.

Frequently Asked Questions

What does registrant mean on a domain record?

The registrant is the person or organisation legally recorded as holding a domain name. Registrars act on the registrant’s instructions and treat everybody else as a third party, including whoever pays the invoice. Check that field before assuming your business is named on it.

How do I check who my domain name is registered to?

Use the Domain Name Commission’s WHOIS lookup and read the registrant field. It is public and free, and takes under a minute.

What is an Authorisation Code, and was it called a UDAI?

An Authorisation Code is the code needed to transfer a .nz domain name between registrars. It was previously called a UDAI, short for Unique Domain Authentication Identifier, and older dashboards still use that name. Each code works only once and expires after 30 days. Your registrar must supply one on request at no charge.

Can our provider refuse to hand over our domain name?

No. Under the .nz rules a provider must not decline or delay a transfer by withholding the authorisation code, and must provide it free of charge when the registrant asks. If a provider stalls, the Domain Name Commission takes complaints about .nz providers.

How much does it cost to manage a business domain?

Domain name management runs $25 to $45 a year for a .co.nz registration, plus $150 to $300 a year if a provider monitors expiry and holds the records for you. Registrar lock and two-factor authentication are free at most registrars. A one-off tidy-up to correct the registrant and document the zone runs $250 to $600.

What happens if a domain name expires by accident?

The website and the email stop at the same moment, because both depend on records published under that name. The name then passes through a grace period and a redemption period before it is released for anyone to register.

Is registrar lock worth turning on?

Yes. Registrar lock blocks any transfer of the name until your current registrar removes it, and it costs nothing at most registrars. A locked name shows a client transfer prohibited status in WHOIS. The only cost is an extra step on the rare occasion you do want to move.

How long do DNS changes take to appear?

Most changes show up within minutes to a few hours, governed by the time to live, or TTL, set on each record. Lower the TTL a day before a planned change so the switch happens quickly. Some networks cache for longer than the TTL asks, so allow up to 24 hours before treating a change as failed.

Who should the domain be registered to, the company or a director?

Register it to the company as the legal entity, using a role-based contact address the business controls. A name held personally by a director creates a problem when the business is sold or the director leaves.

How long does a domain name transfer take?

A .nz transfer usually completes within minutes to a few hours once the new registrar submits the authorisation code. Getting that code out of the current provider is the slow part, and it can take days if nobody answers. Allow a week end to end, and longer if the registrant details need correcting first.

Who manages domain names for businesses in Christchurch and Dunedin?

Exodesk manages domains and DNS for businesses across Canterbury, Otago and Southland, working from offices in Christchurch and Dunedin. The work covers correcting the registrant, enabling lock and two-factor authentication, monitoring renewals and documenting the zone. Exodesk has operated since 1989 and supports domain name management as part of a wider managed IT service.

What is the first step to getting our domain under control?

Look up your own name in WHOIS and read the registrant field. That one check tells you whether this is a five-minute tidy-up or a recovery job.