UAE, UNFILTEREDYour UAE Company Paid for Its Website. Who Actually Controls the Domain?
The agency built the website, the business paid the invoice and the domain works. But .aeDA says the registrant controls the .ae domain. A practical UAE business handover…
Paying for a website does not prove the company is the domain's registered holder or controls DNS and renewal.
UAE SME owners, operations managers, marketing teams and agencies.
Changing the registrar is different from changing the registrant; changing hosting does not transfer domain ownership.
Check the registered holder and recovery contacts before commissioning or terminating an agency.
Ask who is named as registrant, verify company-controlled recovery, back up DNS records and document the handover.
Your company paid the website developer. The website loads. Invoices go out from a professional-looking email address. Then you decide to change agencies and discover that nobody at your company can renew the domain.
That is not necessarily a hosting problem. It could be a domain registration problem, and the distinction matters. UAE domain administrator .aeDA, part of the Telecommunications and Digital Government Regulatory Authority, explicitly advises registrants to put their own name or organisation’s name on the registration. It says the registrant controls the domain and is the party that can transfer it, cancel it or change its registrant.
In plain terms: paying a developer is not the same thing as being the registered holder of a domain. And owning the domain is not the same as controlling every service that makes the website and business email work.
The four different keys to a business website
Take an illustrative Dubai furniture retailer with a .ae domain, a storefront built by an agency and email hosted separately. The shop may have four distinct points of control:
- Registrant: the person or company recorded as the domain holder with the registry.
- Registrar account: the account through which the domain is renewed and its settings are managed.
- DNS operator: the service controlling records that point the domain to a website, route email and prove domain ownership to services.
- Hosting or application administrator: whoever controls the live website, source code, data, backups and deployments.
Sometimes one provider manages all four. Often the agency has access to three of them and an employee’s personal email is attached to the fourth. An invoice saying “website package” does not identify who has each power.
That means even a business listed as the correct registrant could face disruption when it has no practical access to the registrar account or DNS. Conversely, an agency can have legitimate technical access without needing to be the permanent registrant.
What the .ae rules actually say
The TDRA’s official registration guide tells people using .ae to ensure the registrant name is their own or that of their organisation. It also recommends using reachable contact details and checking the registration information through Whois.
Its transfer guidance separates two processes that businesses often confuse. A change of registrant moves the domain to a different holder and requires a signed request plus confirmations. A change of registrar moves the registration service provider and commonly uses an authorisation code. Changing where a site is hosted is a third, separate action.
For a .com or other generic domain, the governing rules may differ. ICANN defines the registrant as the individual or entity that registers the name through a registrar and explains registrant rights to information about management, transfer and restoration. Do not assume every .ae rule applies unchanged to .com.
The email dependency most owners discover too late
A domain is also often the key to your company’s email. A change to DNS records can affect the website, but changes to MX or other email-related records can disrupt delivery or authentication. When an agency moves a domain without inventorying those records, the apparent success of loading the homepage is an incomplete test.
Before a transfer or DNS migration, export the current DNS zone where supported, record the mail provider, test a real incoming and outgoing message, and ensure that someone at the company controls the recovery contact for the registrar and mail administration.
Do not publish screenshots of DNS or recovery consoles with security-sensitive values or access tokens. The objective is a controlled handover, not a public inventory of your company’s attack surface.
A five-part audit before your next website invoice
- Check the registered holder. Ask your registrar for the current registrant information and compare it with the legal entity named on the contract. Privacy masking can limit what public lookup tools show, so use authorised registrar access for the definitive check.
- Test the recovery path. Can an authorised company representative sign in, renew the name and receive account recovery messages without asking a departed developer?
- Document the DNS and mail configuration. Make sure the company knows who can edit records and where its email is hosted.
- Locate the website assets. Identify the code repository, database, media files, backups, analytics accounts and billing subscriptions. A domain transfer does not carry these assets automatically.
- Make the handover contractual. Agree on the registrant, administrative access, source-code deliverables, data exports, renewal responsibility and an exit process before commissioning work.
What if the agency says the domain belongs to it?
Start with the registry record and contract rather than assuming the invoice settles ownership. If the agency is the registrant, seek a documented transfer or correction through the registrar. For .ae, .aeDA publishes the relevant change-of-registrant and registrar-transfer pathways. If the parties dispute entitlement, contractual facts and available remedies matter; a website designer having built the site does not automatically decide the entire issue.
Document correspondence and avoid attempting to break into someone else’s registrar account. If operational risk is high, consult qualified UAE legal and technical advisers about continuity while the dispute is being resolved.
Why this is bigger than one website
Our UAE SME digital offboarding guide looked at what happens when staff leave with control over WhatsApp and cloud files. Agency transitions create the same structural weakness. The business depends on an asset, but an external individual is the only person who can reach it.
Consider the commercial damage of an expired domain: missed customer inquiries, invoices blocked by email failures, disrupted advertising and brand impersonation risks. The point is not that all those outcomes necessarily happen in every case. It is that the renewal price of a domain can be tiny compared with the operations attached to it.
A business should apply the same verification discipline to payment destinations that Robius outlined in our supplier bank-details investigation: a plausible-looking document is not proof that the right party controls the underlying account.
The Robius Read
The critical question for a UAE SME is not “Who built our website?” It is “Who can keep it operating after the builder disappears?”
The registrant, registrar, DNS and hosting roles are individually auditable. If the company cannot identify and test them, it should treat the website as an operational dependency with an unresolved ownership risk.
The five-minute question to ask today: which named person at your company can renew the domain tomorrow without help from the agency?
Sources and editorial method
- UAE TDRA / .aeDA: registering a .ae domain and registrant control
- UAE TDRA / .aeDA: changing a registrant or registrar
- UAE .aeDA domain policies
- ICANN: information for domain name registrants
Reporting note: This is a practical operational analysis of the regulator’s published rules, not a reported dispute involving a named company. The furniture retailer example is hypothetical. No registrar account or customer domain was accessed. Checked 29 October 2026.
