yodai Academy Domain and email

Academy › Publishing › Domain and email

Who can get into your domain and email today without asking your permission

You'll come away with a list of names and access levels: who can touch your domain, your DNS, and your email today, and which account paid for each one.

By Yodai · Published September 6, 2026 · Updated October 13, 2026

4 min read

If the person who built your website left tomorrow, could you log into the site where your domain is registered and make a change? If the answer is no, or you're not sure, better to find out today than the day you actually need to.

You don't need to know how to code. You need something much simpler: if someone has the password to your domain, your DNS (the panel that decides which server your website and email point to), or your email, and you don't, that business isn't fully yours. It's yours only as long as that person answers the phone.

If you've already taken the step of emailing your customers from your own domain instead of a Gmail address, that domain is exactly what you need to check today: it's what holds up your email, your website, and, if you ever sell the business, your entire brand.

Three places where the key can live without your knowing it

It's not just one place. There can be three different panels, with three different passwords, and all three matter equally: the site where the domain was bought and gets renewed, the panel where that domain points to your website (the DNS), and the panel where your company's email accounts are managed. In the next lesson, you'll see why it's better if the same person doesn't hold all three. Today, there's just one thing you need to know: who currently has the password to each one.

If all three were set up by the same agency or freelancer on day one, using their own contact email, and no one has looked at it since, that person still holds the keys. For a .es domain, for example, a change of registrant can be requested by the registrant, the administrative contact, or the registrar agent, according to the Dominios.es FAQ. And in Microsoft 365, whoever signed up for the subscription automatically becomes global admin and can reset any user's password, according to Microsoft's documentation.

How to find out this week
  1. 1Find the domain receipt
    Every domain expires on a specific date, and renewal notices arrive by email before that: for a .com and other generic domains, ICANN policy requires the registrar to send the registrant at least two notices, roughly a month and a week before expiration. Check your inbox (or the inbox of whoever manages it for you) for that notice or the domain invoice: it will show the registrar. If you can't find it and it's a .com or another generic domain, the public lookup at lookup.icann.org will tell you.
  2. 2Find your DNS panel
    It's not always the same place as your registrar: if your DNS is hosted with an outside service, your domain's records are managed there instead of at the registrar, as Google Workspace's help center explains. Just ask directly: "Which panel points my domain to the website?" If no one can answer that precisely, that's your first red flag.
  3. 3Check who manages your email
    If you send email from yourbusiness@yourdomain.com, someone has an admin panel (Google, Microsoft, or your hosting provider) where they can create, change, or delete any mailbox, including yours.
  4. 4Write it down
    For each of the three: the person's name, the email used to log in, and which card or account pays for it. If any piece is missing, that's the first call you need to make.
The costly mistake: a domain registered in someone else's name
When an agency or freelancer registers your domain under their own name, with their own contact email and their own card, the domain's registrant is that person, not your business. The day you part ways, they might not renew it, they might stop answering the phone, or they might simply take weeks to hand over something that was yours from day one. You can avoid this with one condition before you pay anything: the domain's registrant (the "owner") has to be your business, with your contact email, even if someone else handles it day to day. ICANN itself advises against listing web designers, hosting providers, or other third parties as the domain's registrant.
The email to send today if something doesn't add up
Hi [name], I'm reviewing the access setup for [your domain]. Could you confirm which registrar the domain is under, what email account it's tied to, and who currently manages our mailboxes? I'd like to have access too, even if it's just read-only, so we're not relying on just one person. Thanks.

Looking at that list, you'll notice something: it's not one key, it's three, and they're not always held by the person you'd expect.

And if all three hang on a single account, whoever pays the registrar is also the one who controls the DNS and manages the email. The next key is splitting that into three, so no one person can take your business down with them.

What you walk away with
  • You've written down who can log in to your domain registrar, with which account and which email.
  • You know which panel your DNS lives in and who has access to it.
  • You know who manages your email mailboxes and can create or delete accounts.
  • You've sent the email requesting confirmation or access from whoever holds it today, if that's not you.

Sources

  1. FAQs. Dominios.es (Red.es), accessed October 2026.
  2. About admin roles in the Microsoft 365 admin center. Microsoft Learn, 2026 (accessed October 2026).
  3. Expired Registration Recovery Policy. ICANN, updated in 2024 and mandatory since August 21, 2025 (accessed October 2026).
  4. How to identify your domain registrar. Google Workspace Help, accessed October 2026.
  5. Prebuilt administrator roles. Google Workspace Help, accessed October 2026.
  6. Do You Have a Domain Name? Here's What You Need to Know. Part IV: How to Protect Your Domain Name Against Domain Hijacking or Unauthorized Transfers. ICANN, 2018 (accessed October 2026).

In Yodai you connect the domain you already have to your site, and it stays registered where it is, in your name. See how your own domain for your website works.

NextThree keys, not one: who buys, who points the domain, and who manages email