Your Domain Is Registered to a Former Employee or Agency: How to Check, Get It Back, Keep It Renewed, and Stop It Happening Again

Table of Contents

1. How this usually comes to light
2. Step one: find out whose name it is in
3. Step two: read the expiry date, the grace period and the redemption period
4. Step three: three ways to get it back
5. Route one: they cooperate
6. Route two: they have vanished or refuse
7. Route three: give up and use a new domain
8. Step four: make sure it never happens again

#How this usually comes to light

Nobody looks it up on a quiet afternoon. The website stops loading, or a customer says email to the company address bounced, and someone follows the thread: the domain expired, the renewal notices went to an employee who left five years ago, or the agency that built the site closed down long ago.

In the previous article on the digital asset inventory I described six categories of digital assets. The domain is the most basic of the six; the website and the email both hang off it. This article covers one thing only: when the domain is in someone else's name, what order do you work in.

The order matters. Look it up, read the dates, and only then decide which route to take.

#Step one: find out whose name it is in

Domain registration data is public. The tool is called WHOIS.

.tw domains (.com.tw, .tw, .org.tw and so on) are managed by the Taiwan Network Information Center, TWNIC. Use TWNIC's WHOIS lookup at whois.twnic.tw. TWNIC also runs an RDAP service that returns the same data in a machine-readable format.

.com, .net, .org and other international domains can be checked with ICANN Lookup (lookup.icann.org) or with the WHOIS tool on any registrar's site.

Read four fields:

1. Registrant. The owner on paper. Company name, the owner personally, an employee, or an agency.
2. Registrar. Which company the domain was bought from. Even when the registrant is hidden, this field is always shown.
3. Expiry date. Covered in the next section.
4. Status. Normal, transfer-locked, or somewhere in the post-expiry sequence.

One thing to know before you start: on international domains, the registrant's name, email and phone are now usually masked by the registrar's privacy service. You may see "REDACTED" or the name of a proxy service. That does not mean the search failed. It means you work from the registrar field, because every subsequent step goes through that registrar anyway. Whether a .tw registrant is displayed depends on TWNIC's disclosure settings; if it is hidden, TWNIC's WHOIS offers a function to request contact with the registrant.

Two more places to dig when WHOIS is not enough: old payment records (whose card was charged the annual fee, who the invoice was issued to) and the web hosting account (whoever built the site often kept the domain and the hosting in the same account).

#Step two: read the expiry date, the grace period and the redemption period

The expiry date is simple. What happens after it is not. The rules differ between .tw and international domains, and registrars differ in the details. What follows is the general rule; the actual number of days is whatever your registrar publishes.

International domains (.com and similar). ICANN's Expired Registration Recovery Policy requires registrars to send a renewal reminder roughly one month before expiry and another roughly one week before, and if five days after expiry the domain has been neither renewed nor deleted, at least one more notice. If the domain is not renewed, the registrar must interrupt its DNS for at least eight consecutive days before deletion, so the website and email stop working; the interruption is meant to be the last warning. Eight days is a floor, not a ceiling: the longer the registrar waits to delete, the longer the site stays down. After the registrar deletes it, the registry provides a 30-day Redemption Grace Period during which the original registrant can restore it, usually for a fee well above a normal renewal, and transfers are blocked. After that the domain goes to pending delete and is released to anyone. How many days of grace a registrar allows before deleting varies from zero to forty-odd; only your registrar's terms will tell you.

.tw domains. TWNIC's registration rules state that when a domain expires without the fee being paid, the registrar may freeze the domain for thirty days, during which the registrant can pay and continue; if not paid, the domain is cancelled and opened for registration. The separate rules for personal .idv.tw domains say the registration is cancelled 45 days after use is suspended. I could not load TWNIC's main rules page while writing this, so this paragraph is compiled from TWNIC's published clause summary and the personal-domain rules page; grace periods announced by individual registrars may differ, and your registrar's current notice is the authority. What is certain: .tw has no general guarantee of a 30-day post-deletion redemption period like international domains. Once the freeze ends, the domain is open to anyone.

Knowing this tells you which square you are standing on. Not yet expired: plenty of time. A few days past expiry: a normal renewal still works. In redemption: more expensive but recoverable. Past that: wait for release and try to register it, with no guarantee.

#Step three: three ways to get it back

#Route one: they cooperate

This is the best case, and the most common one. A former employee has usually just forgotten, not decided to hold it hostage.

There are two actions. You can do one or both:

Change the registrant (transfer of ownership). The domain stays with the current registrar; the registrant is changed from them to your company. For .tw domains this goes through the registrar and typically requires signatures and identity documents from both parties; for personal .idv.tw domains the application is filed directly with TWNIC. Follow whatever your registrar currently requires. For international domains, ICANN's rules have the registrar confirm the change with both the prior and the new registrant before it takes effect.

Transfer to a different registrar. Move the domain from their registrar account to one you open yourself. For international domains this needs an authorization code (AuthInfo or EPP code) and the transfer lock removed. ICANN requires registrars to provide the code and remove the lock within five calendar days of the registrant's request.

One ordering trap. Under ICANN's rules, a domain cannot be transferred between registrars within 60 days of registration, within 60 days of a previous transfer, or within 60 days of a change of registrant (unless the registrant opted out of that lock beforehand). So if you want both a new registrant and a new registrar, ICANN's advice is to transfer registrars first and change the registrant second. The other way round costs you two months.

Whichever you do, go straight back to WHOIS afterwards and confirm that both the registrant and the registrar now show as yours.

#Route two: they have vanished or refuse

The single most important thing first: do not let the domain expire. Every dispute process takes time, and if the domain expires and is released before the process finishes, there is nothing left to discuss. If you have any login at all, renew now. If you have none, contact the registrar, explain the situation, and ask whether a third party can pay the renewal. Some registrars allow it, some do not; go by what they tell you.

Then assemble evidence. Company registration, the invoices or card statements from when the domain fee was paid, proof that the website has carried the company's name and trademark for years, and the employee's employment and departure records. Take these to the registrar and explain that the domain is a company asset and the registrant was an employee acting on the company's behalf at the time. Whether the registrar has an internal process, what documents it wants, and whether it is willing to act all vary by registrar. I cannot promise an outcome.

ICANN has a Transfer Dispute Resolution Policy, but it handles disputes between registrars over transfers, not the question of who a domain belongs to. As for a former employee who registered a company domain in their own name, that touches employment and property law. Talk to a lawyer; I am not drawing a conclusion here.

If the domain has already expired and is in the redemption period, remember that only the original registrant can redeem it. What you can do is ask the registrar to help reach them, or wait for release and try to register it. Registrars offer backorder services, but a released domain can be registered by anyone, and there is no guarantee you get it.

#Route three: give up and use a new domain

Sometimes the arithmetic really does favour this. But price it honestly; the cost is routinely underestimated.

Search ranking goes to zero. Years of accumulated authority on the old domain do not travel. A normal domain change uses redirects to carry it across, but you do not control the old domain, so no redirects.

Everything printed is reprinted. Business cards, signage, packaging, flyers, vehicle wraps. Every URL on them is dead.

Email hurts most. Your company email addresses end in the domain. Every address stored in customers' address books, every login you registered on Google, Meta, LINE, payment gateways and accounting software, every invoice and statement sent to you: all changed one at a time. Miss one and that is one more account you cannot get into later.

The old domain may be used for something ugly. Once released, someone registers it and puts up content that has nothing to do with you, or worse, while customers still search your shop's name.

So a new domain is the last resort. Try routes one and two properly before you take it.

#Step four: make sure it never happens again

Once this round is dealt with, spend twenty minutes on the following four settings and the problem stays gone.

1. Register in the company's name. .com.tw already requires company registration. International domains do not, but put the company name in the registrant field anyway, never an individual.
2. Use a company mailbox for the registrar account, not a personal one. A mailbox the company controls, that does not leave with an employee, and that two people can read. Renewal notices go there.
3. Turn on auto-renew with the company card, and set a separate expiry reminder. Auto-renew fails silently when the card expires, so put a calendar reminder one month before expiry as the second layer.
4. Add a second administrator or a second contact email. If the registrar account supports multiple administrators, add one. If it does not, at least make sure the owner and one family member or manager both hold a way to log in.

One last item: add "whose name the domain is registered in" to the employee offboarding checklist. That one line is cheaper than everything above.

If you are not sure what else your shop has registered in someone else's name, the Digital Asset Inventory exists to build that list for you in one pass. The service is currently delivered in Chinese.

I spent ten years as a financial advisor and now run Ultra Lab. Transferring a domain and changing the policyholder on an insurance policy are the same job: find out whose name it is in first, then talk about the rest.

FAQ

How do I find out whose name my domain is registered in?

For .tw domains, use TWNIC's WHOIS lookup (whois.twnic.tw). For .com, .net and other international domains, use ICANN Lookup (lookup.icann.org) or any registrar's WHOIS tool. Read four fields: registrant, registrar, expiry date, status. Registrant details on international domains are often hidden behind a privacy service, but the registrar is always visible, and the registrar is who you deal with next.

My domain has already expired. Can it still be recovered?

It depends on the domain type and how long ago. Under ICANN's general rules, an international domain such as .com gets a 30-day redemption period after the registrar deletes it, during which it can be restored for a fee; each registrar also has its own grace window before deletion. A .tw domain is frozen for a period after expiry so the registrant can pay, then cancelled and released, with no redemption period of the international kind. In both cases only the original registrant can restore it, so act early.

The former employee is ignoring me. Can I just take the domain back?

There is no route that bypasses the registrant and hands it to you immediately. In practice: make sure the domain does not expire first, then go to the registrar with company registration, payment records and evidence of the website's long-term use, and ask what their process is. Where employment law and ownership of property are involved, talk to a lawyer rather than deciding on your own.

Why not just switch to a new domain?

You can, but the cost is usually underestimated: years of search ranking gone, and because you do not control the old domain you cannot redirect it; business cards, signage and packaging reprinted; and worst of all, email. Every customer address book entry and every platform login tied to the old address has to be changed one by one. A new domain is the last option, not the easy one.