Your domain name: choosing well, never losing it

In most small businesses, the domain name is the most carelessly held asset the company owns. Registered eight years ago by an agency that no longer exists, or by a partner's nephew who was studying computer science at the time, it renews on a personal credit card that's about to expire. Everything else plugs into it: the website, the email addresses, the invoices, the links in your ads. Every site we deliver on subscription runs on a domain the client owns, and it's written into the contract.

The asymmetry is brutal. You can change hosts in an evening and rebuild the whole site without losing anything. The domain can't be replaced. You keep it or you lose it, and when you lose it, it becomes someone else's property with no contract protecting you.

This article covers both halves of the problem: how to choose, and above all how never to lose it, with the exact mechanics of expiration and what they cost.

The short answer, for the busy

You don't buy a domain name, you rent it in one to ten year blocks, and you lose it automatically if nobody pays the renewal. Three moves secure it. First, check who the registrant is: for a .ca held by a business, CIRA's WHOIS publicly displays the organization's name, so confirm it's yours and not your former agency's. Second, turn on auto-renewal with a backup payment method, lock the domain at the registrar, and put the expiry date in your own calendar rather than trusting email notices. Third, keep the registrant email on a company address, because every expiry notice lands there. If you miss the date, the mechanics get expensive: a grace period of 40 to 45 days, then a 30-day redemption window billed on top of the renewal (Hover publishes US$175), then a public release back onto the market.

Check who the registrant is, it takes two minutes

Start here. Run a WHOIS lookup on your domain and read the registrant field. For a .ca held by a business, the information is public: CIRA hides individuals' contact details but not those of organizations. So you'll see, in plain text, which entity holds the domain your company runs on.

What you're looking for is simple. The registrant should be your business, under its legal name. Not your agency, not an employee's personal name. If it's anything else, you don't own your domain, no matter who has paid the bill for ten years. Under ICANN's Transfer Policy, the Registered Name Holder is the only party with the authority to approve or deny a transfer. Everything else is courtesy.

Then check the email address on file, because that's where every notice goes. ICANN's Expired Registration Recovery Policy requires registrars to send at least two reminders, roughly one month and roughly one week before expiry, plus a third within five days after expiration if the domain is deleted. Three warnings, one address. If that address belongs to a former employee or a mailbox nobody reads, all three safety nets fail together.

.ca, .com, or both

The .ca isn't open to everyone. CIRA imposes Canadian presence requirements and asks you, at registration, to pick one of eighteen categories: Canadian citizen, permanent resident, corporation under Canadian law, trade union, educational institution, trademark registered in Canada. For an incorporated Quebec business, it's the corporation category, with the exact legal name.

This isn't decorative. CIRA runs Registrant Information Validation checks and can demand documents, a passport or birth certificate for an individual. Without proof, the domain is deleted about two months after the audit begins. And "ordinarily resident in Canada" means more than 183 days in the twelve months preceding the application, then in every subsequent twelve-month period for the life of the registration. It's not a one-time checkbox.

On the choice itself, the rule is boring but sound. If your market is Quebec or Canada, take the .ca: it signals local roots and it's still far less crowded than .com. If you sell abroad, take the .com as well and redirect it to your main site. Both cost a few dozen dollars a year, trivial next to what they protect.

Misspellings and variants deserve a more restrained answer than domain sellers give. Buy one or two if they're obvious (the hyphenated form, the typo everyone makes on your name) and redirect them. Don't buy forty: that's a recurring expense and that many more expiry dates to watch.

What happens when you miss a renewal

This is the part most owners discover too late. Here's the full sequence.

At expiry, the domain enters an auto-renew grace period, up to 45 days for a .ca, with the exact length set by the registrar (OpenSRS, for instance, sets it at 40 days). During that window the domain can stop working at any moment. ICANN goes further for generic extensions: it requires the registrar to disrupt DNS service for up to eight days before deleting the name, precisely so the outage acts as a final warning. Your site and your email go down.

Then comes the redemption period, 30 days, mandatory for every generic registry and applied by CIRA as well. The domain is dead: no site, no email. You can still get it back, but at a price. Hover, a Canadian registrar, publishes a US$175 redemption fee on top of the renewal, and Namecheap says plainly that the fee is set by the registry upstream and cannot be waived. Your provider isn't inventing that number, it's passing it on.

After redemption, the domain goes to pending delete for one to five days, then returns to the market. At CIRA it lands on the TBR ("to be released") list, where it must sit at least 60 hours before the release session held every Wednesday at 19:00 UTC. Only registrars take part, which is why a specialist firm can catch your domain ahead of you and resell it back at whatever price it likes. For a generic domain, Namecheap puts the release at 80 to 85 days after expiration.

Three months between the oversight and permanent loss, and several hundred dollars to undo it. That's a lot of margin, but only if somebody reads the notices.

The protection stack, in order of effectiveness

Auto-renewal first, with a backup payment method. The most common cause of expiry isn't forgetting, it's a credit card replaced or expired while auto-renewal was switched on the whole time. Use a company card, not a director's personal one, and add a second one if the registrar allows it.

Next, multi-year registration. A domain can be held for one to ten years, and paying five years up front removes four chances to get it wrong for a few dozen dollars. Best effort-to-risk ratio on the list.

Then the registrar lock. The clientTransferProhibited status blocks any outbound transfer until you remove it yourself. It's free, it should be on permanently, and ICANN requires the registrar to remove it within five days of your request, so it doesn't trap you. Turn on two-factor authentication too: the same reflex as the rest of your website security, on the most sensitive account you have.

Finally, an alert in your own calendar, 60 days before expiry. The three regulated notices are useful, but they all depend on an email address staying alive and read. Your calendar doesn't change employers.

Leaving without losing control

Changing providers should never be a standoff. The procedure is regulated: you unlock the domain, request the authorization code (auth code or EPP code), give it to the new registrar, then confirm. CIRA states that your registrar must hand you that code within five days, and that you can go to CIRA directly if they don't. ICANN sets the same five-day deadline for releasing the code and removing the lock.

Two points defuse retention tactics. A registrar cannot deny a transfer over a billing dispute covering a future period, nor because the domain is locked if you have the ability to unlock it. And a completed transfer adds a year to your registration, so nothing you've paid for is lost.

The real constraint is the 60-day rule: a domain registered or transferred less than 60 days ago can't be moved. Build that into your timeline. On cost, CIRA puts .ca transfer fees at roughly CAD $10 to $20, often with a year of renewal included.

Our position: the client owns the domain

We sell websites on subscription, so the question deserves a straight answer: should the provider hold the domain? No. It stays in the client's name, in an account the client can access, full stop. That's more setup work and it removes a retention lever, which is exactly why some providers don't do it.

A provider holding your domain also holds your email and your search rankings, and you only find out when you try to leave. Hosting can be changed and sites can be rebuilt, but a domain held by a third party has to be negotiated. If you're weighing building your site yourself against hiring an agency, ask the question before you sign.

Run the check this week: WHOIS, registrant field, email address, auto-renewal, lock. Fifteen minutes, once. If the registrant isn't your business, or you can't tell who it is, write to us and we'll sort it out.

→ Tell us about your domain