Who owns a domain name, and why that login matters
Registrars, renewals, and how stealing the name steals the mail.
A domain name is a rental, not a house you built. You pay a registrar. The registrar talks to a registry. ICANN sits above a lot of that machinery. If you stop paying, someone else can take the name. If you used a cheap reseller and lost the account email, getting it back is paperwork and luck.
Who you actually paid
GoDaddy, Namecheap, Google Domains (now Squarespace), a local host that “throws in a domain”: they are retailers. The real record for `.com` lives at Verisign. Your name in that database is what the internet believes. WHOIS used to print your home address. Privacy proxies hide that now. The registrar still knows who pays.
Why this is a security problem
If an attacker takes the registrar login, they can point the name at their server. Mail follows the name. Password resets follow mail. That is how some “we got hacked” stories actually start: not the web host, the domain.
Turn on 2FA at the registrar. Use a unique password. Lock the domain if the registrar offers a lock. Put the renewal on a card that will not expire in silence. A lapsed domain on a business you still run is a gift.
Subdomains and tricks
`login.yourbank.com` is yours if you control `yourbank.com`. `yourbank.evil.com` is not. People read the first half. Browsers care about the last half. Look at the whole host. A domain you do not remember registering is not yours, even if it contains your brand.
The name is the front door sign. Keep the key to the sign, not only the key to the website behind it.