You do not own your domain name, and the body that governs the system says so in those exact words. ICANN’s own FAQ: “paying to register a domain name is not the same as ‘buying’ it outright or permanently. You do not ‘own’ a domain name. What you are doing is more like leasing the domain name from the registry operator.”
That is not a technicality. Everything that surprises companies about domains follows from it: why a transfer can be refused for two months, why an expired name disappears on a schedule you did not set, why the person listed as registrant matters more than the person who paid, and why recovering a lapsed domain is priced by whoever happens to hold it.
For scale, this is a market of 401.6 million registrations across all top-level domains at the end of Q2 2026, of which 166.6 million are .com, or roughly 41 percent of everything.
The registrant of record is the only name that counts
The most expensive domain problem is not losing one. It is discovering that it was never in your name.
ICANN’s definition is thin on purpose. The registrant, “also known as the ‘Registered Name Holder’ is the person or entity that holds the rights to a domain name.” The rights follow that record, not the invoice.
And the accreditation agreement anticipates exactly the situation you are in. “Any Registered Name Holder that intends to license use of a domain name to a third party is nonetheless the Registered Name Holder of record and is responsible for providing its own full contact information.” If your developer registered it, your developer holds it.
ICANN describes the recovery, and it is not automatic. If a third party “registered the domain name using their own contact details (even if you have paid them to register and manage the domain name) … they may be listed as the official Registrant of record. You may need to provide proof of your payment to the third-party/developer to prove to your registrar that you are the rightful holder.”
Verifying this got harder in 2025. Since 28 January 2025, RDAP replaced WHOIS as “the definitive source for delivering generic top-level domain name (gTLD) registration information”. Under the Registration Data Policy effective 21 August 2025, registrant name, street, postal code and phone are redacted, and the email is replaced by “an email address or a link to a web form … which MUST NOT identify the contact email address or the contact itself.”
And redaction is broader than the law requires. Registrars must redact where applicable law requires it, but may also do so where they have “a commercially reasonable purpose” or where “it is not technically feasible to limit application” of redaction. In practice many redact everyone.
So the check is no longer a lookup. Log into the registrar account yourself and read the registrant field. If you cannot log in, you have your answer.
Three separate sixty-day locks, and one of them is mandatory
Transfers get refused for reasons that look arbitrary and are written down. There are three restrictions, and they behave differently.
Within sixty days of registration. A registrar may deny a transfer requested “within 60 days of the creation date as shown in the registry RDDS record for the domain name.”
Within sixty days of a previous transfer. A registrar may deny where the domain “is within 60 days … after being transferred”, excluding transfers back to the original registrar by agreement or by dispute decision.
After a change of registrant, and this one is not optional. “The Registrar must impose a 60-day inter-registrar transfer lock following a Change of Registrant, provided, however, that the Registrar may allow the Registered Name Holder to opt out … prior to any Change of Registrant request.”
And a change of registrant is easier to trigger than it sounds. It means “a Material Change” to the registrant name, organization, or email address, where a material change is defined simply as “a change which is not a typographical correction”. Updating the contact email after somebody leaves the company can lock the domain for two months.
The policy tells registrars to warn you about the order of operations. They must inform the holder that “if its final goal is to transfer the domain name to a different registrar, the Prior Registrant is advised to request the inter-registrar transfer before the Change of Registrant to avoid triggering the 60-day lock.”
One thing worth knowing about the future. A policy review group recommended in February 2025 replacing these with 720-hour restrictions and eliminating the change-of-registrant lock entirely. As of writing, no adopting board resolution was found. Treat the sixty-day locks as the operative rule and re-check before relying on the change.
The clock is documented, most of it is not ICANN policy, and the price at the end of it is set by whoever holds your name.
Three notices are mandatory. Two before expiry, one “approximately one month prior to expiration and one … approximately one week prior”. Then at least one more “within five days after the expiration”. They must arrive in a way “that does not require affirmative action to receive the notification.”
Your site goes dark before your name is gone. For registrations deleted eight or more days after expiry, “the existing DNS resolution path specified by the RAE must be interrupted by the registrar” for at least the last eight renewable days, and any parked page “must conspicuously indicate that the domain name registration is expired and provide renewal instructions.”
Then the lifecycle, using .com as the example. A 45-day auto-renew grace period, then a 30-day redemption grace period during which “the registry must disable DNS resolution and prohibit attempted transfers”, then a pending delete period of “five calendar days”, after which the name is purged.
One distinction that matters if you hold other extensions. Only the 30-day redemption period is ICANN consensus policy across non-sponsored registries. The 45 days and the 5 days are values from the .com registry agreement. Other registries can differ.
And the price of recovery is not regulated at all. ICANN requires only that registrars make “redemption/restore fees reasonably available” and display them, adding plainly that “it is up to your registrar to set their own prices, terms and conditions.” For reference, the .com registry’s own published fee schedule charges the registrar $40 per restore command. What you are charged on top of that is a commercial decision.
Which gives one operational instruction. Put the expiry date in a shared calendar owned by the company, not in one person’s inbox, and keep auto-renew on with a payment method that outlives the employee who set it up.
Two failure modes involve a third party: the name lapses and is taken, or your name is registered by somebody else in the first place.
The dispute policy requires three things at once. A complainant must show the domain “is identical or confusingly similar to a trademark or service mark in which the complainant has rights”, that the holder has “no rights or legitimate interests in respect of the domain name”, and that it “has been registered and is being used in bad faith”. The policy closes with the operative sentence: “the complainant must prove that each of these three elements are present.”
Which means a mark comes first. Without trademark rights there is no complaint to bring, whatever the moral case.
The odds, for cases that reach a decision. Across all years, WIPO records 61,705 transfers, 5,567 complaints denied and 1,031 cancellations, out of 68,303 decided cases. That is 90.35 percent transferred and 8.15 percent denied.
And the caveat that keeps the figure honest. Those are decided cases. Roughly 14 percent of cases settle before a decision, and they are not in the table. “Over 90 percent of decided cases result in transfer” is accurate. “Over 90 percent of disputes go the complainant’s way” is not.
Volume is rising. WIPO recorded 6,282 cases in 2025, its highest on record, against 4,204 in 2020, with more than 84,700 cases handled since 1999.
And a lapsed domain is not a lost cause. In a 2023 case concerning a foundation domain that “mistakenly lapsed in 2022”, the panel found “that by snapping up the domain name after DiCaprio mistakenly allowed it to lapse, the registrant was guilty of opportunistic bad faith”. Recovery is possible. It is slower and more expensive than a renewal.
Changing domain without losing what the old one earned
If the name has to change, the search guidance is specific, recently updated and mostly about patience.
Keep the redirects far longer than you think. “Keep the redirects for as long as possible, generally at least 1 year. This timeframe allows Google to transfer all signals to the new URLs, including recrawling and reassigning links on other sites that point to your old URLs.” And from the user’s side, “consider keeping redirects indefinitely.”
Use permanent redirects. “We recommend that you use HTTP permanent redirects if possible, such as 301 and 308.”
The reassurance, stated directly. “Don’t worry about link credit. 301 and other permanent redirects don’t cause a loss in PageRank.”
Two things that do cause damage. Chains, where the advice is to redirect “to the final destination directly” and otherwise keep chains to “no more than 3 and fewer than 5”. And blanket redirects: “Don’t redirect many old URLs to one irrelevant single URL destination, such as the home page of the new site.”
Expect a visible dip and a slow tail. “For medium-sized websites, it can take a few weeks or more for Google to gradually start showing the new URLs”, and “you may experience ranking fluctuations while Google recrawls and reindexes your site.”
And change one variable at a time. The guidance is explicit: if you want to move domain, change your CMS and redesign, “do them one at a time: move to a new domain, then change your site’s layout.” Most migrations that are blamed on the domain move were three changes shipped together. That is also the order to hold to when a rename and a site rebuilt for conversion fall in the same year: the move ships alone, the redesign follows once the rankings have settled.
Open your registrar account today and read the registrant field. If it names an agency, a developer or a former employee, fix that before anything else, and remember to request the transfer before changing the details rather than after.
Put the expiry date in a company calendar with two owners, and confirm the payment method on file is not a card that expires with somebody’s employment.
If you are choosing a name, the useful constraint is not the extension. It is whether you hold the trademark rights that would let you defend it, because the dispute policy starts with a mark and the domain follows.
No. ICANN states it directly: paying to register a domain name is not the same as buying it outright or permanently, you do not own a domain name, and it is more like leasing the name from the registry operator.
Why can't I transfer my domain right now?
Probably one of three 60-day restrictions: within 60 days of registration, within 60 days of a previous transfer, or after a change of registrant. The last one is mandatory unless you opted out before making the change.
How long do I have to recover an expired domain?
For .com, roughly 45 days of auto-renew grace, then a 30-day redemption grace period mandated by ICANN policy, then 5 days of pending delete. Only the 30-day redemption period is policy across registries; the others are registry-level values.
How long should I keep redirects after changing domain?
Google says to keep them for as long as possible, generally at least one year, and to consider keeping them indefinitely from the user's perspective.