How to Recover a Domain Registered Under Someone Else's Name?

It is one of the most stressful things a business owner can discover: the domain your website and email depend on is not actually registered to you. Maybe a web designer set it up years ago, a former employee bought it with a personal card, a cofounder registered it in their own name, or a family member did you a favor. Everything worked fine until the relationship changed, and now someone else holds the keys. The good news is that most of these situations can be resolved, often without lawyers. This article walks through how to confirm who holds the domain, how to gather evidence, how to ask for a handover the right way, what registrars can and cannot do, and when formal options like the UDRP or a court action make sense. If you are not sure how domain contacts work, read registrant vs. admin vs. technical contact first, because the distinction drives everything below.

First, Understand What You Are Recovering

There are two separate things to get back, and you may need one or both:

1. The registrant record: who is legally listed as the holder of the domain. This is what registrars and dispute panels look at.
2. Control of the registrar account: who can log in and change name servers, locks, contacts, and renewal settings.

A domain might list your company as registrant but sit in an agency's account, or it might sit in your account but list a former employee as registrant. The fix differs in each case, so identify exactly which one is wrong.

Also Rule Out the Simpler Case

If you are the registrant but have lost access to the account, perhaps because the email address is dead or the employee who set it up has left, this is an account recovery problem, not an ownership dispute. Registrars have identity verification procedures for this. Contact their support, explain the situation, and be ready to provide ID, business registration documents, and proof of payment.

Step 1: Look Up the Current Registration

Start with the public record. ICANN Lookup at lookup.icann.org works for gTLDs, or use RDAP from the command line:

curl -sL https://rdap.org/domain/yourdomain.com \
  | jq '{domain: .ldhName, status, events: [.events[] | {(.eventAction): .eventDate}]}'

Find the registrar, which you will need to contact later:

curl -sL https://rdap.org/domain/yourdomain.com \
  | jq -r '.entities[]? | select(.roles | index("registrar")) | .vcardArray[1][] | select(.[0]=="fn") | .[3]'

And check the registrar's own record, which holds the registrant details:

REG=$(curl -sL https://rdap.org/domain/yourdomain.com \
  | jq -r '.links[]? | select(.rel=="related") | .href' | head -n1)
curl -sL "$REG" | jq '.entities[]? | select(.roles | index("registrant")) | .vcardArray[1]'

Personal data is usually redacted, but you will often see the registrant's organization and country, which may be enough to tell you whether it is your company, an agency, or an individual. For more on lookups, see what WHOIS is and what RDAP is.

Note the Expiration Date

Look at the expiration event. If it is close, the domain is at risk: the current registrant may let it lapse, or deliberately not renew it. You need to act before it moves into the grace and redemption phases described in domain grace period and redemption period.

Step 2: Gather Your Evidence

Before contacting anyone, collect proof that the domain was meant to be yours. The stronger your evidence, the faster any conversation, registrar request, or formal complaint will go.

Evidence	Why it helps
Invoices or receipts showing your business paid for the domain	Shows the registration was made for you
Contracts or proposals with an agency that mention the domain	Often state who owns deliverables, including domains
Emails or messages about registering the domain for you	Shows intent at the time of registration
Business registration documents	Proves your company's legal name and history
Trademark registrations	Essential for UDRP and legal claims
Evidence of use: archived site pages, marketing materials, signage	Shows the domain has represented your business publicly
Employment records	Shows a former employee acted in the course of their job
Bank and card statements	Shows who actually paid renewals

The Internet Archive's Wayback Machine can show how the site looked over time, which helps prove continuous use by your business. See how to check a domain's history for tools and techniques.

You can also export archived snapshots programmatically. This command lists the earliest captures of your homepage from the Wayback Machine's CDX API:

curl -s "https://web.archive.org/cdx/search/cdx?url=yourdomain.com&output=json&limit=5&fl=timestamp,original,statuscode"

Save copies of everything in a folder with dates. If this escalates, you will want a clean timeline.

Step 3: Ask for the Domain Back, Properly

Most domain recoveries end here. Agencies and former employees usually hand domains over when asked clearly, especially when the request makes it easy for them.

Who to Contact

• Agency or designer: the person you worked with, or the company's general contact if they have moved on.
• Former employee: directly, or through HR if there are ongoing obligations.
• Cofounder or partner: directly, but consider whether your partnership agreement or a lawyer should be involved.
• Unknown registrant: through the registrar's contact form or relay email shown in the WHOIS or RDAP record.

What to Ask For

Be specific about the outcome you want. There are two common routes:

1. Internal account change (a "push"): If you open an account at the same registrar, the current holder can move the domain into your account. This is usually instant, does not require an authorization code, and does not extend the registration. Then you update the registrant details to yours.
2. Inter-registrar transfer: The current holder unlocks the domain, updates the registrant to you (or agrees to), and gives you the authorization code (also called an EPP code). You start the transfer at your chosen registrar. See how to transfer a domain to another registrar.

In either case, the registrant record must change to you. That is a Change of Registrant under ICANN's Transfer Policy, which typically requires confirmation from the current registrant. Ask them to approve it promptly. For a full walkthrough of the process, see how to transfer domain ownership.

A Sample Request

A short, polite, specific email works best:

Subject: Request to transfer yourdomain.com to Smith Bakery Ltd

Hi Alex,

When you built our website in 2019, you registered yourdomain.com on our
behalf (invoice #1042, attached). We'd now like to manage it ourselves.

Could you please either:
  1. Push the domain to our account at the same registrar
     (account ID: 12345678), or
  2. Unlock it and send us the authorization code so we can transfer it.

We'll also need the registrant changed to Smith Bakery Ltd. If there are
any outstanding fees, let us know and we'll settle them.

Thanks for your help,
Sam

Offering to cover reasonable costs, such as unpaid renewal fees, often removes the main obstacle. Keep the tone neutral even if the relationship ended badly.

If They Want Payment

Sometimes the holder asks for money. If it is a reasonable amount covering their costs, paying is usually cheaper and faster than any formal process. If it is a large sum, that may become relevant evidence of bad faith later, so keep the message. For high-value domains where you agree on a price but do not trust each other, use an escrow service; see how to use a domain escrow service.

Step 4: Contact the Registrar

If the registrant does not respond or refuses, contact the registrar. Set your expectations realistically:

What registrars generally will do:

• Forward your message to the registrant through their relay system.
• Help if you can prove you are the registrant, for example where the organization field names your company and you can prove you represent it.
• Act on court orders or UDRP decisions.
• Investigate if you report that the domain was stolen through account compromise (hijacking).

What registrars generally will not do:

• Decide between competing ownership claims on the strength of invoices or contracts alone.
• Hand a domain to someone who is not the registrant of record without the registrant's consent or a legal order.

The organization field matters here. If the registrant name is your former employee but the registrant organization is your company, many registrars treat the company as the registrant and may work with an authorized officer of the company to update the record, subject to verification. Ask the registrar's support team directly about their process, and send your evidence.

If you suspect the domain was taken from you by unauthorized access rather than registered by someone else from the start, follow the guidance in what domain hijacking is. Registrars treat hijacking differently from ownership disputes, and ICANN's Transfer Policy provides a dispute mechanism for unauthorized transfers between registrars.

Step 5: Consider Formal Dispute Options

When talking fails, you have formal options. Which one fits depends on the facts.

UDRP

The Uniform Domain-Name Dispute-Resolution Policy (UDRP) is ICANN's administrative process for resolving disputes over gTLD domains, handled by providers such as WIPO. To win, a complainant must show all three of:

1. The domain is identical or confusingly similar to a trademark in which the complainant has rights.
2. The registrant has no rights or legitimate interests in the domain.
3. The domain was registered and is being used in bad faith.

UDRP is fast compared to court, typically concluding in a couple of months, and the remedy is transfer or cancellation of the domain. Filing fees are charged by the provider and vary with the number of domains and panelists, so check the provider's current fee schedule.

However, UDRP is designed for cybersquatting, not for business disputes between people who used to work together. A web designer who registered a domain in good faith as part of a project was not acting in bad faith at the time of registration, and panels frequently decline cases that are really contract or employment disputes. UDRP may still succeed where you have a trademark and the holder is now clearly acting in bad faith, but get advice before relying on it. More detail is in what the UDRP is and what cybersquatting is.

ccTLD Dispute Policies

Many ccTLDs have their own dispute resolution services with different criteria. For example, Nominet runs its own Dispute Resolution Service for .uk domains. Check the relevant registry's policy.

Court Action

When the dispute is really about a contract, employment, or partnership, a court is often the right forum. A court can order the registrant to transfer the domain, and registrars will comply with a valid order. In the United States, the Anticybersquatting Consumer Protection Act (ACPA) provides additional remedies in trademark-based cases. Court action is slower and more expensive than UDRP, so it is usually a last resort, but sometimes a lawyer's letter alone resolves the matter.

Choosing a Route

Situation	Usual best route
Cooperative agency or ex-employee	Direct request and push or transfer
You are the registrant but locked out	Registrar account recovery with identity verification
Company is the registrant organization, contact person left	Registrar verification with company documents
Unresponsive holder, no trademark	Lawyer's letter, then court if needed
Holder demanding a large payment, you have a trademark	UDRP or ccTLD dispute process, with legal advice
Domain was stolen via account compromise	Registrar hijacking process, and possibly ICANN's transfer dispute policy

Step 6: Protect the Domain While You Wait

Disputes take time. Meanwhile:

• Watch the expiry date. If the holder lets the domain lapse, you want to be ready. Set up monitoring and consider a backorder; see how to catch an expiring domain.
• Monitor DNS and status changes. A sudden name server change could take your site and email offline.
• Prepare a fallback domain. If your email depends on the disputed domain, plan how you would communicate with customers if it went down.
• Do not make threats you will not follow through on. Keep communication factual.

This small script checks the domain's status, name servers, and expiry and prints a warning if anything changes from a saved baseline. Run it daily from cron:

#!/usr/bin/env bash
# watch-domain.sh - alert on changes to a domain's RDAP data
set -euo pipefail

DOMAIN="${1:?usage: watch-domain.sh domain}"
STATE_DIR="${HOME}/.domain-watch"
mkdir -p "$STATE_DIR"
STATE_FILE="${STATE_DIR}/${DOMAIN}.json"

CURRENT=$(curl -sfL -H "Accept: application/rdap+json" "https://rdap.org/domain/${DOMAIN}" \
  | jq -S '{
      status: (.status // [] | sort),
      nameservers: ([.nameservers[]?.ldhName | ascii_downcase] | sort),
      expiration: ([.events[]? | select(.eventAction == "expiration") | .eventDate] | first)
    }')

if [[ -f "$STATE_FILE" ]]; then
  if ! diff -q <(echo "$CURRENT") "$STATE_FILE" > /dev/null; then
    echo "CHANGE DETECTED for ${DOMAIN}:"
    diff <(cat "$STATE_FILE") <(echo "$CURRENT") || true
  else
    echo "${DOMAIN}: no change"
  fi
fi

echo "$CURRENT" > "$STATE_FILE"

A crontab entry to run it every morning and email the output (if your system has mail configured) looks like this:

0 8 * * * /usr/local/bin/watch-domain.sh yourdomain.com

Step 7: Once You Have It Back, Lock It Down

After the domain is in your name and your account:

1. Confirm the registrant record shows your legal company name and a role email address you control.
2. Enable two-factor authentication on the registrar account. See how to secure your domain registrar account with 2FA.
3. Turn on registrar lock and consider registry lock for critical domains.
4. Enable auto-renewal with a current payment method, and renew for several years if it is important.
5. Give developers delegated access, not ownership, in future.
6. Write domain ownership into contracts with agencies and freelancers, stating that domains are registered in the client's name.
7. Audit all your domains, including defensive registrations and old campaign domains, for the same problem.

---

Domain Recovery FAQ

Conclusion

Recovering a domain registered under someone else's name starts with understanding exactly what is wrong: the registrant record, the registrar account, or both. Look up the current registration, collect evidence that the domain was registered for your business, and make a clear, polite request for a push or transfer plus a change of registrant. Most cases end there, especially if you offer to cover reasonable costs.

When cooperation fails, registrars can help only within limits, typically when your company is already the registrant of record or a court or dispute panel has ruled. UDRP suits trademark-based bad-faith cases, while contract and employment disputes often belong in court. Whatever route you take, protect the domain while you wait, and once you have it back, make sure it is registered to your business, in your account, with strong security, so it never happens again.

Here are some useful references for going deeper on domain recovery and disputes:

1. ICANN: Uniform Domain-Name Dispute-Resolution Policy — the official UDRP policy text.
2. WIPO: Domain Name Dispute Resolution — WIPO's UDRP and ccTLD dispute services, guides, and filing information.
3. ICANN: Transfer Policy — the rules for transfers and changes of registrant.
4. ICANN: ICANN Lookup — check the current registration data for a gTLD domain.
5. Internet Archive: Wayback Machine — archived snapshots to document your historical use of a domain.