Why the domain name matters so much
Almost everything your business does online depends on the domain name. Through that domain’s DNS settings, the rest of the world knows:
- where your email should go, for example to Microsoft 365;
- where your website is hosted;
- whether email sent in your name really comes from you, through SPF, DKIM and DMARC;
- that you own the domain, for example when connecting it to Microsoft 365 or other services.
So whoever can reach the DNS settings can redirect your email or replace your website. And if the domain expires, everything stops at once.
What goes wrong in practice
In SMEs we keep seeing the same situations:
- the domain is in someone else’s name: the web designer, a former colleague or the founder personally registered it once. Formally, the domain then does not belong to the company;
- the account depends on one person: the login and renewal emails go to one employee’s personal address. When they leave, access leaves with them;
- renewal fails: an expired payment card or a missed invoice, and the domain lapses. Sometimes someone else can register it afterwards;
- no two-step verification: the registrar account is protected by a password alone, even though it is just as important as your Microsoft 365 admin account;
- nobody knows what is in the DNS: old records for services that have not been used for years, or a change nobody can explain any more.
Who should hold the keys
Arrange ownership and access like this:
- owner: the domain name is registered in your company’s name, with the correct company name and registered address. Check this in the registrar account;
- contact address: use a general address that will keep existing, such as a shared mailbox for administration, not the address of one person. Note: preferably do not put that address on the same domain, or add a second address, because if the domain stops working, that email will not arrive either;
- two people with access: at least two trusted people can sign in, each with their own account if the registrar allows it. Store the details in a password manager, just like your break-glass accounts;
- suppliers get access, not ownership: a web designer or IT partner can work with their own account or limited rights, but the domain stays yours.
What you set up with the registrar
- two-step verification on every account that can reach the domain;
- automatic renewal turned on, with a payment method that does not depend on one person;
- transfer lock: lock the domain so it cannot be moved to another provider without your consent. For .nl domains, SIDN, the registry for .nl, also offers an extra registry lock through many registrars;
- alerts on changes: have the registrar email you on a sign-in, a DNS change or a transfer request, if it supports that.
Keep a short DNS overview
You do not need to become a DNS specialist. A one-page overview is enough: which records exist, what they are for and who requested them. Remove records for services you no longer use, because a forgotten pointer to a cancelled service can be misused by someone else. Also include the domain in your leaver checklist: when someone with access leaves, change the password or remove their account.
What Floor ICT handles
Floor ICT sets up the DNS records for Microsoft 365, SPF, DKIM and DMARC properly, keeps the overview up to date and regularly checks whether records have been added or removed. We help move a domain that is still in a former supplier’s name over to your company. Ownership of the domain and the main access to the registrar account stay with you; we work with our own account or the rights you give us.