Your website works until the person who built it stops answering
A domain name has one field that carries every power: the registered name holder. That name can move the domain, renew it, or delete it. The administrative, technical and billing contacts can do none of those things, whatever they are called. If the holder on your domain is the person who built your site rather than your business, you are renting your own address from someone who has no contract with you.
QUICK ANSWER
A domain name has one field that carries every power: the registered name holder. That name can move the domain, renew it, or delete it. The administrative, technical and billing contacts can do none of those things, whatever they are called. If the holder on your domain is the person who built your site rather than your business, you are renting your own address from someone who has no contract with you. Checking takes about two minutes and costs nothing.
The site has worked for six years. Nobody has touched it. Then the card on file expires, or the person who set it up moves to Istanbul and stops replying, and it turns out nobody at the business can log in to anything.
This is not a story about a bad developer. Most of the time the arrangement was a favour, done quickly, in good faith, in 2019. The problem is that domain names have an owner field, somebody has to be in it, and on the day the site was set up the only person in the room who knew what a registrar was got typed into it.
Here is how to find out where you stand, and what changes depending on the answer.
There is one name on your domain that matters, and it may not be yours
Every domain has four contact roles attached to it: registrant, administrative, technical and billing. Three of them are notification addresses. One of them is ownership.
The registrant, called the registered name holder in the contract that governs this, is the party the registrar has an agreement with. Everyone else is a phone number written on a form.
[ 01 / Four fields, one owner ]
Three of these are addresses. One is ownership.
Every domain carries all four. Only one of them can do anything.
Registered name holder
Transfer the domain to another registrar
Change who owns it
Renew it, or let it expire
Redeem it after deletion
Change the nameservers
Administrative · technical · billing
Receive notifications, including the expiry warning
May be listed publicly
Can do none of the five things on the left
Being the administrative contact means you are told what is about to happen and cannot stop it.
ICANN, Registrant Rights and Responsibilities Under the 2009 Registrar Accreditation Agreement, and the ICANN Transfer Policy as updated 21 February 2024. Both read 6 September 2026.
ICANN's own example of the problem is a web designer registering a domain for a client
This is not an edge case somebody invented to sell a service. The organisation that governs domain names uses exactly this scenario as its illustration.
From ICANN's Registrant Rights and Responsibilities, still the live version of the page:
"Sometimes a Registered Name Holder may register a domain name and then allow another person to use the domain name (such as a website designer registering a domain name for a client). If this happens, and the person actually using the name did not enter into the Registrar/Registered Name Holder Agreement (referred to as a 'third party' in the RAA), the Registered Name Holder could be accountable for wrongful use of the domain name by the third party."
Read what that says about who is who. The designer is the holder. The business paying for the site is "another person" and "a third party". The regulator picked this exact arrangement to explain the split, which tells you how ordinary it is.
The administrative contact cannot move anything
The word administrative does a lot of damage here. It sounds like the senior role. It is not.
ICANN's Transfer Policy runs transfer authorisation through the registered name holder. Being listed as the administrative contact on a domain gives you notifications about it and no authority over it. If your business is in the admin field and your developer is in the holder field, you will receive the email telling you the domain is about to expire, and you will not be able to renew it.
That is the specific shape of this failure. You are informed and powerless at the same time, which is why it usually gets noticed far too late.
Registering a .com.tr took no documents. Getting one moved still does.
If your domain is a .com.tr, this gets harder rather than easier, and almost nobody knows it.
Since TRABİS went live on 14 September 2022, registering a .com.tr is documentless and first come first served. That change was real and it is why North Cyprus has no country domain anyone can actually register but can register a Turkish one freely.
Changing the holder is a different transaction, and TRABİS says so on its own FAQ:
"Alan adları devredilebilir, bunun için hizmet alınan Kayıt Kuruluşunun internet sitesinde yer alan ilgili formun tam ve doğru olarak doldurulması gerekir. Ayrıca mevzuatta belirtilen devir için gerekli belgeleri de iletmeniz gerekmektedir."
Domains can be transferred, the form must be completed fully and correctly, and you must also submit the documents required for transfer as specified in the legislation. So the registration that needed no paperwork needs paperwork to undo, and the paperwork has to come from the current holder.
The same page adds something worth knowing while you are there. TRABİS says domain sales would become possible three years after it went live, and that the details would be announced. Read on 6 September 2026, four years on, the page still says the details are to be announced.
Getting agreement is not the end. It starts a 60 day lock.
Say the conversation goes well and the holder agrees to sign the domain over. There is one more delay nobody warns you about.
Under the current Transfer Policy, updated 21 February 2024, a registrar must impose a 60 day inter registrar transfer lock following a change of registrant. The opt out exists only if it is exercised before the change, not after. So on the day you finally become the owner, you also become unable to move the domain to a registrar of your choosing for two more months.
Plan for that rather than discovering it. It is the difference between a handover that lands before a season and one that lands after it.
[ 02 / Two ways this ends ]
Both paths start the same way and neither is quick
One needs the holder to cooperate. The other is what happens when nobody does anything.
If the holder agrees
- AgreementThe holder consents to hand the domain over
- then
- Change of registrantSubmitted through the registrar
- then
- 60 daysInter registrar transfer lock. Opt out is only possible before the change, never after
If nobody renews it
- 1 The registration expires
- 2 A grace period runs, its length set by the registrar rather than by policy
- 3 The registration is deleted
- 4 A 30 day redemption period begins. The registry must disable DNS resolution and prohibit transfers, so the site is off and the mail stops
- 5 A pending delete period, then the name is released to anyone
The website is dark for the whole of step 4, including the days you spend trying to fix it.
ICANN Transfer Policy, updated 21 February 2024, on the sixty day lock following a change of registrant. ICANN Expired Registration Recovery Policy, updated 21 February 2024, sections 3.1 and 3.2, on the thirty day redemption grace period and the requirement that the registry disable DNS resolution. Both read 6 September 2026.
A lapsed domain goes dark for thirty days by policy, not by accident
If nobody renews, the timeline is not a cliff, it is a staircase, and one step of it is worse than people expect.
ICANN's Expired Registration Recovery Policy requires every gTLD registry to offer a redemption grace period of 30 days after deletion, during which the registration can still be restored. Then this, in the policy's own words:
"During the Redemption Grace Period, the registry must disable DNS resolution and prohibit attempted transfers of the registration."
DNS resolution disabled means the website is off and the email stops. For thirty days minimum, while you are actively trying to fix it, and you cannot move the domain elsewhere to speed it up. Restoring it is possible, and registrars set their own restore fee, which is consistently a large multiple of what the renewal would have cost.
For a hotel this is not an IT problem. It is a month with no booking form during which every link anyone has ever sent about you resolves to nothing.
Nobody has measured how often this happens, so we went and looked
There is no figure for it. WIPO publishes its domain dispute caseload by complainant industry and by outcome, and its caseload summary carries no category for a developer holding a client's domain, though the courts have certainly seen the shape of it: in DSPT International, Inc. v. Nahum, 624 F.3d 1213, a United States appeals court upheld a $152,000 verdict against a former associate who redirected a company's site during a dispute over money he said he was owed. One case in another jurisdiction is not a measurement.
The public record for a domain, though, is readable by anyone. So rather than assert that this is common here, it seemed better to go and count.
Forty four websites belonging to hotels operating in North Cyprus were checked on 6 September 2026, taken from the Cyprus Turkish Hotels Association membership and verified as northern property by property. Some are group domains covering several hotels, so the forty four cover just over half of the eighty five star rated hotels the TRNC tourism ministry's own January to July 2026 statistics record on the register.
On ten of them the registrant organisation is published outright. One of those ten is the hotel. The other nine are information technology companies, a telecom, web and hosting firms, and one domain broker.
Twenty three are masked or redacted, and eleven returned no registrant field at all. That is not evidence of a problem by itself, because redacting the registrant became normal across the industry after 2018. It is the reason this cannot be settled from outside. If your registrant is hidden, you cannot confirm it is you by looking. Somebody has to log in.
Then the dates. Of the thirty eight domains with a readable expiry date, ten expire within six months and five within forty five days. One of them expired on the morning of the check.
And one has already gone. A five star resort in the census no longer holds its own .com. Typing it in today returns a domain broker's sale page rather than the hotel. The resort is still open and still trading.
None of this is unique to this island. Pew Research Center's study of link rot, published 17 May 2024 across roughly a million pages, found 38% of pages that existed in 2013 gone within a decade. Sites are rarely shut down. They stop being renewed by somebody.
No hotel is named here, deliberately. The aggregate is the finding, and every hotel in it can run the same check on its own domain in about a minute.
[ 03 / 44 hotel domains, read from the public record ]
Where the registrant is visible, it is almost never the hotel
Checked 6 September 2026 across hotels operating in the north, covering just over half the star rated hotels on the ministry register.
domains checked
44
registrant disclosed outright
10
of those ten is the hotel
1
masked or redacted
23
no registrant field returned
11
expiry date readable
38
The other nine disclosed registrants
Information technology companies, a telecom, web and hosting firms, and one domain broker. Not one of them is a hotel.
Dates, of the 38 that publish one
- 10 expire within six months
- 5 expire within forty five days
- 1 expired on the morning of the check
- 1 is already gone. The address now returns a domain broker's sale page and the resort is still trading.
Redaction became standard across the domain industry after 2018, so a hidden registrant is not evidence of a problem. The ten disclosed records are the only ones that can be read, and nine of them name a supplier.
Hotels drawn from the Cyprus Turkish Hotels Association membership and verified as northern property by property. Registrant, registrar and expiry read from the public domain record on 6 September 2026. Denominator of 85 star rated hotels from the TRNC Turizm Planlama Dairesi, Turizm İstatistikleri Ocak-Temmuz 2026, dated 28 August 2026. No hotel is named.
Four questions, and most of the time the answers are fine
Run these before you need them. All four are free and none of them require us.
Read the registrant field on your own domain's public record. Ask whoever manages your site which account the domain sits in and whether you can log in to it today, not whether they can. Ask where the code lives and whether you have access. Ask whose address receives the renewal notice.
If the answers come back clean you have a website you own and you need nothing from anyone. That is worth ten minutes to confirm.
If they do not come back clean, the ceiling is real and you cannot climb it alone. You cannot move a domain you do not hold. You cannot rebuild from a codebase you cannot see. On a .com.tr you cannot even start without documents from the person who is not replying. That is the point where the problem stops being administrative and becomes a rebuild with a deadline attached.
We take that on as a defined piece of work: establish what you actually hold, get the registrant field into your company's name, move the domain and DNS into an account with your name on it, and hand over the code and the logins in writing. When it is finished, the test is simple. If we stopped answering tomorrow, your website would keep working and you could hire anyone.
That is what ownership means, and it should be a line item, not a favour.