Your Business Domain and Email: Ownership, Renewals, Transfers and Gmail Sender Rules

Make sure you own the domain

ICANN, the organization that coordinates domain names, publishes a list of registrants’ rights and responsibilities. A few points every business owner should know:

• Your registration is governed by a Registration Agreement with an ICANN-accredited registrar, and you are entitled to review it and download a copy.
• You must provide accurate contact information and update it promptly when it changes.
• You must respond to your registrar’s inquiries within fifteen days and keep your account data current. If you use auto-renew, you must keep your payment information current.

Practical steps:

1. Look up your domain’s registrar with ICANN’s lookup tool (lookup.icann.org).
2. Log in to that registrar account yourself. If a web designer or former employee set it up, ask them to move it into an account owned by your business.
3. Use a contact email that you will always have access to, and that isn’t on the same domain (if the domain lapses, email on that domain may stop too).
4. Turn on multifactor authentication on the registrar account (see our customer data protection checklist).

Renewals and what happens at expiry

ICANN’s Expired Registration Recovery Policy applies to generic top-level domains such as .com, .net and .org. It says:

• Registrars must send at least two renewal reminders before expiry: one about one month before and one about one week before. If the domain isn’t renewed or deleted, another notice must go out within five days after expiry.
• After expiry, the registrar must interrupt the domain’s normal DNS resolution path for a period while the domain can still be renewed, which means your website and email can stop working.
• Registries (with the exception of sponsored registries) must offer a 30-day Redemption Grace Period after a registration is deleted, during which the previous registrant can ask the registrar to restore it.
• Registrars must make their renewal, post-expiration renewal and redemption fees reasonably available, at a minimum on their website.

The simple protection is auto-renew plus a current payment card, and a calendar reminder a month before the renewal date.

Moving your domain to another registrar

From ICANN’s registrant FAQs:

• You need an Auth-Code (also called a transfer or EPP code). Your registrar must provide it within five calendar days of your request, if you can’t generate it yourself in your account.
• A registrar may deny a transfer within 60 days of initial registration or within 60 days of a previous transfer.
• Changing the registrant name, organization or email can trigger a 60-day lock on transfers to a different registrar. Some registrars let you opt out, but they don’t have to. ICANN suggests finishing a transfer before changing contact details if moving is your goal.
• You have the right to transfer an expired domain. Registrars can’t deny a transfer because of expiration or non-renewal, unless you haven’t paid for a previous registration period.
• Your domain may also be in “Lock” status. Registrars must give you a readily accessible and reasonable way to remove it.

You don’t always need to move the domain at all. ICANN notes you can change hosting providers or update your nameservers instead.

Business email that reaches the inbox

An address like office@yourbusiness.com looks more trustworthy than a free webmail address and stays with the business when staff change. Whatever provider you use, Google’s email sender guidelines (for mail sent to personal Gmail accounts, with requirements starting February 1, 2024) set these baselines:

From Google Workspace Admin Help, “Email sender guidelines,” checked October 30, 2026. Google recommends that all senders set up SPF, DKIM and DMARC.

What the three records do, in plain words:

• SPF lists which servers are allowed to send mail for your domain. Google says your SPF record should include all senders for your domain, so add your invoicing app or newsletter tool if it sends as you.
• DKIM lets receiving servers verify that the domain owner actually sent the message, according to Google.
• DMARC tells receiving servers what to do with mail that fails SPF or DKIM checks, according to Google.

If you use an email service provider, Google says to verify that they authenticate your domain’s email with SPF and DKIM. Your email host and any app that sends invoices or reminders on your behalf will usually give you the exact DNS records to add.

Checklist

• Domain registered to the business, in an account you control, with MFA.
• Auto-renew on, payment card current, renewal date on the calendar.
• Contact email on the registrar account that doesn’t depend on the domain itself.
• SPF and DKIM set up for every service that sends mail as your domain, and DMARC added.
• A shared business inbox (for example, office@) that survives staff changes.