Who Owns Your Company Domain Name? The Digital Asset Check Singapore SMEs Keep Skipping

Whoever is named as the registrant and admin contact on the domain account controls your website, your email and your company name online. That is very often not the person who paid for it. In Singapore companies under 20 staff, the domain, the DNS settings and sometimes the business email all sit inside a web designer's account or a former employee's personal Gmail. Nothing looks wrong until a renewal notice goes to an inbox nobody reads, or a working relationship ends badly. Checking and correcting ownership takes about two hours and costs nothing beyond a renewal fee, which is why it belongs in October rather than in the middle of the year-end deadline stack.

What counts as a digital asset you can actually lose?

Most owners think of the website and stop there. The list that matters is longer, and each item can be held hostage or allowed to lapse independently of the others:

• The domain name and its registrar login. This is the master key. Lose it and the website and email both stop.
• DNS control, which may sit at a different provider from the registrar. This is what points your domain at your site and routes your mail.
• Hosting or the server, including the control panel and database access.
• Business email, usually Google Workspace or Microsoft 365, plus the super administrator account.
• Google Business Profile, Search Console and Analytics, which carry your reviews and your search data.
• Social pages and ad accounts, where page ownership and billing are separate things.
• Payment and invoicing tools, including the gateway account and the bank details behind it.
• Your SMS Sender ID registration and any marketing platform holding a customer list.

Assume anything with a login and a renewal date is on this list until you have proof otherwise.

Why does ownership only surface in an emergency?

Because everything works fine while the original arrangement holds. A designer registers the domain in 2019 as a favour, pays 20 dollars a year on a personal card, and renews it without being asked. Four years later the business is quoting six-figure jobs on the strength of that website. Nothing has changed except the stakes.

The failure arrives in one of three ways. The card on file expires and the renewal silently fails. The person holding the account becomes unreachable, changes career, or ends the relationship on bad terms. Or the account is secured with two-factor authentication tied to a phone number that no longer belongs to anyone at the company. In all three cases the business is locked out of its own name, and the recovery process is slow precisely because registrars are designed to resist people claiming domains they do not own.

How do you check who controls your domain in ten minutes?

Run a public WHOIS lookup on your domain, and for a .sg domain check the SGNIC registration record as well. You are looking for three things: the registrant organisation name, the administrative contact email address, and the registrar. If the registrant is a person rather than your registered company, or the admin email is a personal address or a vendor's address, you do not control the asset.

Then check two more items that WHOIS will not tell you. First, log in to the registrar yourself. If you cannot, you have your answer. Second, confirm which inbox receives the renewal reminder, because that is the only warning you will get before expiry. A renewal notice going to a staff member who left in 2024 is the same as no notice at all.

Who should hold the hosting and email accounts?

Company accounts should be registered to a company-controlled mailbox, not to a person. A role address such as admin@ or accounts@ survives staff turnover; a personal Gmail does not. Keep two-factor authentication switched on, but make sure the recovery method is something the company controls, such as a shared authenticator held by two directors, rather than one employee's mobile number.

Vendors should be added as delegated users or technical contacts, never as the owner. Every serious platform supports this. A web developer can manage DNS records without being the registrant, and an agency can run your ad account without owning the page. If a supplier resists this split, that resistance is itself the risk you are trying to remove.

What goes wrong with renewals in December and January?

Year-end is the worst possible time to lose an account. Staff take leave, corporate cards get reissued with new expiry dates, and in 2027 the first working week runs straight into payroll changes that need email and system access to complete. A lapsed domain typically has a grace period of around 30 days, after which redemption costs a few hundred dollars and takes days rather than hours. During that window your quotes bounce and your website shows an error page to every prospect who looks you up.

So pull every renewal date into one place now, confirm the payment card on each one is valid into 2028, and move any renewal that falls between 20 December and 5 January to an earlier date by renewing a year ahead.

What does a digital asset register look like for a 15-person company?

One sheet, eight columns, kept by the office manager and reviewed once a year. Record the asset, the provider, the account owner email, who pays and on which card, the renewal date, who holds the second factor, the vendor or staff member with delegated access, and one line on what stops working if the account is lost. That last column is what turns the sheet from admin into a risk document, because it shows at a glance that losing the domain stops both sales enquiries and invoicing while losing the analytics account stops nothing urgent.

Store it where two directors can reach it, not only in the accounts inbox. A register nobody can open during a lockout is not a register.

What should you do this month?

Four steps, about two hours in total. Run the WHOIS check and log in to the registrar yourself, 20 minutes. List every account with a login and a renewal date, 40 minutes. Transfer any asset registered to a person into a company role address, 30 minutes per asset, longer if the holder is unreachable. Then book a 30-minute annual review in the same month each year so the register does not quietly go stale.

The companies that handle this well treat it like insurance renewal rather than an IT project. It is not interesting work, and it is the cheapest protection a small company can buy for the asset its entire customer pipeline runs through.

Frequently asked questions

My web designer registered our domain and we are still on good terms. Is this urgent?

It is not urgent, but it is simple, and goodwill is not a control. Ask them to transfer the registrant details to your company and add themselves as the technical contact instead. A cooperative supplier will complete this in under an hour, and you will have removed a single point of failure that no longer depends on anybody staying available.

What if the person holding our account cannot be contacted at all?

You can still recover a domain, but the process is evidential rather than technical. Registrars and SGNIC will ask for proof that your company is the rightful owner, which usually means your ACRA business profile, the original payment records, and correspondence showing the domain was registered on your behalf. Gather those documents before you open a case, and expect it to take days rather than minutes, which is the main argument for fixing ownership while the relationship is still intact.

Should the business owner hold every password personally?

No. One person holding everything is the same risk in a different shape, and it fails the moment that person is on a flight or in hospital. The workable arrangement is a company-owned role mailbox as the registered account, a password manager with two directors holding access, and vendors granted delegated permissions that can be withdrawn without changing ownership.