The registrant is not the same as the web designer
The first question is whose name appears as the domain registrant, not who built the website or paid the latest invoice. A domain registration gives its registered holder contractual rights subject to the registry and registrar rules; it is not a permanent purchase of an internet word. A designer may configure hosting, edit DNS and manage a site without becoming the registrant. For a Malaysian small business, the practical objective is continuity: the business should be able to identify the authorised holder, renew the name, approve changes and recover control when a contractor or employee leaves. Record those roles separately before ordering services.
Choose the correct legal holder before checkout
Where a domain represents an incorporated company, the organisation normally needs an internal decision about the legal entity that should be registered. A sole proprietor may have a different appropriate identity and documentation from a private limited company. Do not assume that a director's personal email or a freelance developer's account is an adequate substitute for the business record. For .my names, MYNIC publishes category-specific eligibility and supporting-document guidance, including commercial documentation for .com.my. Confirm the precise category and required evidence before purchase. If the business has several entities, decide which entity is entitled to use the name and record the rationale.
Understand the four MYNIC contact roles
MYNIC distinguishes the registrant from administrative, technical and billing contacts. Its management guidance describes the administrative contact as an authorised representative of the registrant organisation; the technical contact manages nameserver matters, while the billing contact handles payment information. These are operational permissions, not interchangeable labels. A trusted technician may legitimately maintain DNS without being authorised to change the registrant. A finance employee may receive invoices without needing control over nameservers. For each role, record a primary person, an internal replacement and the approval route. Check the current MYNIC self-service rules for the specific action rather than assuming every contact can perform every task.
Registrar account access is another layer
The registrar is the company through which the registration is managed; its customer portal may contain renewal controls, contact details, transfer settings and payment methods. Even when the registered organisation is correct, losing the only login can delay urgent work. The business should maintain a documented account owner, a recovery method it controls and a named person responsible for reviewing renewal notices. Avoid creating a single shared password that circulates through chat messages. Where the registrar supports delegated access, use it rather than handing the master login to each contractor. Record the registrar's support and account-recovery process before an incident occurs.
Keep recovery email independent of the domain
An account recovery address hosted on the same domain creates a circular dependency. If the domain expires, DNS breaks or email hosting is suspended, the person trying to recover the domain may be unable to receive the reset message. A safer design uses an independently accessible, organisation-controlled recovery channel, protected by strong authentication and documented for authorised staff. This does not mean using an employee's private mailbox without governance. Check that the address is current, that the recovery phone is accessible and that a second responsible person knows the escalation procedure. Test recovery information periodically without deliberately locking the account.
Separate DNS administration from registration control
DNS records determine where web and email traffic is directed, but editing a record is not the same as holding the registration. A provider may manage DNS in a separate dashboard from the registrar. Document both systems: which company sponsors the domain, which service hosts authoritative DNS, who can change nameservers and who can edit individual records. A web developer usually needs only the permissions required for the site; changing mail MX records or transferring the domain should require additional approval. Cloudflare documents scoped member roles, illustrating how technical access can be granted without distributing every account privilege.
Use individual access and least privilege
Every person who can modify a critical domain creates a possible point of error or compromise. Give staff individual accounts where the provider supports them, enable available multi-factor authentication and limit each role to the required task. A person hired to change one website record should not automatically gain billing, transfer or account-owner privileges. Review access when the project changes stage, when a supplier contract ends and after a security incident. Keep an internal list of approved administrators, but do not store passwords or recovery codes in the public website repository. Security is a process of assigning, checking and revoking authority, not merely choosing a strong password once.
Record a handover before work begins
A written service brief should state who registers the domain, the intended registrant, the registrar, the term, who pays renewal fees and how the business receives account access. If a supplier purchases the domain on the customer's behalf, specify whether the supplier is an administrator, reseller or registered holder, and how any required change will be completed. Do not rely on a verbal promise that the domain belongs to the client. Ask for the domain name, registration confirmation and a screenshot or export of relevant account details, with sensitive identifiers protected. This makes a later handover an ordinary procedure instead of a dispute.
An invoice alone does not settle control
A payment receipt is useful evidence of a commercial transaction, but it does not by itself identify every right under the domain registration agreement. A business might reimburse a developer while the registrar still lists the developer as registrant. Conversely, an agency may pay from its own card while the business is properly recorded as holder. Compare the invoice, contractual scope, registrant data and actual portal permissions rather than treating any single document as conclusive. If records disagree, stop non-urgent changes, preserve dated evidence and seek correction through the registrar and the parties' written agreement. Legal ownership disputes may require professional advice.
Check MYNIC rules for a change of registrant
Changing the registered holder is not simply editing a website profile. MYNIC's managing-a-domain guidance describes a specific change-of-registrant action that can be submitted by a user with the Administrative Role before the domain expires. It separately describes transfers between self-care accounts and transfers between registrars. Identify which action is actually needed; they solve different problems. Before initiating any request, confirm the current holder's authorisation, supporting documents, domain status and receiving party's details. Retain the confirmation after completion and recheck the registrant record. Avoid describing a change as finished merely because a support ticket was opened.
Treat .com transfers differently from .my changes
For generic top-level domains such as .com, ICANN's Transfer Policy governs many inter-registrar and change-of-registrant procedures. Its published rules include circumstances where a transfer may be denied, and a change of registrant can trigger a 60-day inter-registrar transfer lock unless an available opt-out was exercised beforehand. Those rules must not be copied mechanically onto .my domains, which follow MYNIC's own applicable procedures. If the plan involves both changing the holder and moving registrars, ask the current registrar which order is valid before making either change. The right sequence can prevent an avoidable lock or an incomplete handover.
Keep contact information accurate and reachable
Registration contact details have operational consequences. ICANN explains that registrars must verify certain contact information and may suspend a generic-domain registration if required verification is not completed. Use a maintained business contact and respond to legitimate verification messages through the registrar's trusted portal. Update details promptly when staff or company information changes. Do not assume that a public WHOIS lookup will display the holder's full identity: MYNIC has restricted public disclosure of personal contact fields. For an internal ownership audit, request authoritative account evidence from the registrar or holder rather than guessing from an anonymised public lookup.
Renewal responsibility needs a backup person
Domain registration is time-limited, so a correct registrant record is not enough if nobody monitors expiry. Assign a named renewal owner and a backup who can access the billing process. Record the domain, registrar, renewal date, payment method owner and evidence of successful renewal in a controlled inventory. Review auto-renew settings, but do not rely on them without checking payment failures and confirmation notices. Keep renewal planning separate from hosting and email subscriptions, which can have different providers and dates. A calendar reminder is a prompt to verify a completed transaction, not proof that renewal has occurred.
Document what happens when staff leave
When a domain administrator resigns, the business should not discover that the only recovery email or authentication device belonged to that person. Include domain access in the staff departure checklist: identify registrar and DNS accounts, transfer administrative responsibility, revoke unnecessary access and verify that recovery factors still work. Preserve required audit records according to company policy; do not indiscriminately delete evidence. If the departing employee is the named registrant, that is a separate ownership issue requiring registrar procedures and documented authorisation. Treat the change as a controlled handover with two-person verification, especially where email and website services depend on the domain.
Contractor offboarding should preserve services
A supplier handover should inventory the domain, registrar, nameservers, DNS zone, hosting account, email provider, SSL arrangements and any third-party integrations. Confirm who will retain each account and whether a new technical contact is needed. Before revoking a contractor's access, make sure an authorised business representative can perform the same essential tasks and that backups of relevant configurations exist. Do not change nameservers just to demonstrate control: a careless switch can disrupt mail routing or the website. Record what was tested, which permissions were removed and which items remain with the outgoing supplier under a written agreement.
A hypothetical freelancer registration problem
Imagine a Penang retailer whose first website was built by a freelancer. The freelancer registered the domain under a personal account, configured email and sent the retailer an annual invoice. Two years later the retailer changes agencies and cannot obtain the registrar login. The immediate response should be evidence gathering, not an improvised DNS migration. Locate the contract, invoices, domain status, communications and any proof of intended registrant. Ask the current registrar which verified change or account-recovery process applies. While the matter is unresolved, protect working services and avoid claiming the retailer legally owns the registration without examining the actual agreement.
If a founder uses a personal account
A founder may register a name before a company is formally established. That can be understandable at an early stage, but the arrangement should be reviewed when the business entity and governance become clear. Decide whether the registrant should change, whether the registrar supports a company account and what documents are required. Do not make a rushed change immediately before an important transfer or renewal; some generic-domain registrant changes affect transfer eligibility. Document who approves the change on behalf of the organisation and keep the previous records. The objective is a traceable transition, not rewriting history to pretend the company was always the original registrant.
Use a controlled domain asset register
A useful domain register contains more than the name and expiry date. Include the exact extension, intended business purpose, legal registrant, registrar, account owner, administrative contact, DNS host, recovery channel, renewal date, approval owner and latest evidence check. For sensitive account details, store references to a protected credential manager rather than copying secrets into a spreadsheet. If several brands or defensive registrations exist, mark which are business-critical and which are optional. Review the inventory whenever new domains are purchased or staff responsibilities change. An incomplete but maintained register is more useful than a perfect-looking list that nobody checks.
Verify control without making risky changes
An ownership review should be evidence-based and minimally disruptive. Have the authorised representative sign in to the registrar, inspect the registrant and contact records, confirm renewal access and verify who can obtain support. Inspect DNS separately, noting the current authoritative nameservers and mail-related records without editing them. Check that a second authorised person can reach the escalation process. Save dated screenshots or exports in the business's protected records, redacting recovery codes and payment details. If a permission cannot be demonstrated, label it unverified and arrange a controlled test with the provider rather than claiming full control from a screenshot alone.
When a dispute or lock blocks a handover
Not every domain dispute can be solved by resetting a password. If the recorded registrant contests a change, preserve correspondence and identify the registrar's formal process. For generic domains, ICANN's transfer rules specify several reasons a transfer can be denied; the existence of a dispute may matter. For .my, consult MYNIC's current registrant and administrative procedures. Do not bypass authorisation, impersonate a contact or publish an unverified claim of ownership. If the parties disagree about contract rights, seek appropriate legal advice. Meanwhile, document the business impact and make only authorised changes that protect existing customer-facing services.
The final decision and acceptance checklist
Before treating domain governance as complete, ask five separate questions. Is the intended business entity the recorded registrant? Can an authorised person access the registrar and receive verification messages? Are DNS and billing roles assigned with limited permissions? Is renewal tracked with a backup owner? Can the business recover or hand over access if a supplier leaves? A 'yes' should have evidence, not merely a verbal assurance. Keep unresolved items visible with a responsible owner and target date. This approach does not guarantee immunity from disputes or outages, but it reduces avoidable dependence on one person and gives the business a practical basis for continuity.