Domain names are the web and email addresses your business runs on, and you rent them a year at a time rather than owning them outright. For a UK business, that means registering the name to the company itself, keeping renewal contacts current and protecting the email that uses it, so it's never the thing that takes you offline.
Most pages ranking for this search are shops: type a name, see a price, buy. That's the easy bit. The trouble tends to turn up years later, so we'll follow one made-up business through it.
The short version
- The registrant named on a domain is its legal holder, so register business domains to the company, not to a person or agency.
- A .uk domain that isn't renewed is suspended 30 days after expiry, taking the website and email down with it.
- Verisign's wholesale .com price rises 7% to $10.97 a year from 1 November 2026, so multi-year renewals are worth considering.
- SPF, DKIM and DMARC make it much harder for anyone to send email that pretends to be from your exact domain.
- Lookalike domains sit outside email authentication, so buy the obvious variations and tell customers bank details never change by email alone.
Calder Joinery and the domain nobody can log into
Calder Joinery Ltd is an illustration, not a client: a 14-person kitchen and joinery firm in Halifax. It's traded on calderjoinery.co.uk since 2016, when the founder's nephew built the first website and registered the domain on his own account, with his personal Gmail. He bought calderjoinery.com at the same time.
A domain name is the readable address people type. DNS, the internet's address book, turns it into the numeric location of your website and of the servers that handle your email. Whoever controls the domain controls where both point. For Calder, that's a nephew who now lives in Melbourne and hasn't logged in since 2019.
Nothing has gone wrong yet. Which is exactly why nobody has looked.
Who actually owns our domain name?
Whoever paid the invoice, the legal holder of a domain is the registrant: the person or organisation named on the registration. Nominet treats a .uk registration as a contract, and registrar names.co.uk spells out that the registrant must be a legal entity, with a limited company registered under its full legal name so it can be checked against Companies House. A domain registered to the nephew belongs, on paper, to him.
Calder's first job, then, is a change of registrant to Calder Joinery Ltd, done while the nephew is still happy to help. After that the account moves to a company login. The contact should be a shared address like domains@ rather than anyone's personal inbox, and two named people should be able to get in.
The .com has a wrinkle. Under ICANN's long-standing transfer policy, changing the registrant's name, organisation or email triggers a 60-day lock on moving to another registrar. ICANN's GNSO Council voted in March 2025 to scrap that lock, but the change still needed board approval and time for registrars to implement. So ask yours which rules apply before you plan a change of owner and a move in the same week.
What happens if a domain name expires?
Leave a .uk domain unrenewed and it's suspended 30 days after its expiry date. That's when the website and email stop working. Nominet's renewal reminder schedule emails the registrant the day after expiry, warns of suspension at day 23 and sends a final cancellation warning at day 83. Hosting firm Hostworld's guide to the expiry timeline adds that a .uk name stays renewable until day 90 and drops on day 95, when anyone can register it.
Every one of those emails would go to the nephew's old address. For a joiner whose quotes, supplier invoices and bookings all arrive by email, a month of silence before anyone twigs is a real cost.
The .com runs on different rules. ICANN's Expired Registration Recovery Policy requires most registries to offer a 30-day Redemption Grace Period after a name is deleted, and Hostworld notes that restoring during that window usually costs the renewal price plus a separate restore fee. You can get it back. It's rarely cheap or calm.
Calder's fix is dull and effective: auto-renew on, a company card that won't quietly expire, and multi-year renewals on the main domain. There's a cost argument as well. Verisign, which runs the .com registry, is raising its wholesale price 7% to $10.97 a year from 1 November 2026, its first rise since September 2024. Registrars set their retail prices on top of that, so we'd book a longer renewal now. Call it housekeeping.
How do you stop someone faking your company email?
Owning the domain is what lets Calder protect the email that runs on it. The NCSC's email security and anti-spoofing guidance covers three records: SPF publishes which servers may send mail for your domain, DKIM signs each message to show it really came from you, and DMARC tells receiving servers what to do with mail that fails those checks, while sending you reports.
Calder had none of them. Anyone could send an email that appeared to come from accounts@calderjoinery.co.uk, and a forged "our bank details have changed" note to a customer is how plenty of small firms lose money. The NCSC suggests starting DMARC on a monitoring-only setting. Reports begin arriving within 24 hours and show who's sending as you. After a few weeks of adding the legitimate senders Calder had forgotten, like its invoicing software and the website contact form, it can tell the world to reject the rest.
The lookalike domains Calder didn't buy
Email authentication only protects your exact domain. It does nothing about calder-joinery.co.uk or calderjoinery.co, which a fraudster can register for a few pounds and use to send invoices. In one case reported in 2025, criminals impersonated a logistics platform used by UK freight brokers with a domain differing by a single character or ending, and industry estimates put losses at £40,000 to over £160,000 per incident.
We wouldn't tell Calder to buy every variation. That never ends. Buy the obvious few, such as the hyphenated version and any ending customers might guess, point them at the main site and keep an eye out for new registrations close to your name. And tell customers and suppliers in writing that your bank details will never change by email alone.
Where Calder ends up a year later
Both domains now sit in the company's name, on one account with two named people, renewing automatically, with DMARC rejecting forgeries. Most of it was a few afternoons' work, all done before anything broke. If you'd rather see every domain, DNS record and mailbox in one place, that's why we built Apiary, and our client portal for DNS and mail shows the same idea built for a client.
Talk to Swarm Labs about getting your domains in order.
Sources
- Domain Name Wire: Breaking: VeriSign raising wholesale .com prices
- Nominet: .uk Renewal Reminder
- Hostworld: The expiry, grace and redemption timeline
- ICANN: Expired Registration Recovery Policy
- NCSC: Email security and anti-spoofing
- Domain Incite: ICANN to kill off 60-day domain transfer lock
- names.co.uk: .UK domain name validation
- Yahoo News: The silent impersonators: how lookalike domains threaten UK business trust