Domain, hosting and email: what your company should own

The website is suddenly offline. Nobody knows where the domain is registered. The invoice went to an address that no longer exists. We see cases like this more often than you'd think. Almost always it comes down to responsibilities, not technology.

Domain, hosting and email are the foundation of your website. This article explains who should own what, where to host and why your emails can land in spam.

The domain: in your name

You don't buy a domain directly from the registry. For .de that is DENIC, for .ch it is the SWITCH foundation. You order through a registrar, a provider that manages domains for you. The registry then lists you as the holder.

Watch for three things:

• Your company is the holder. With the correct company name and current address. Not the agency, not a private person.
• Access is with you. The registrar account runs on a company address that several people read.
• Renewal is automatic. With a valid payment method and reminders sent to a shared mailbox.

A domain in an agency's name makes any switch hard. With us, domain, hosting and code run in your name from the start. You can continue with another team at any time.

Where the website should live

Location: EU or Switzerland

Host in the EU or in Switzerland. This simplifies data protection, because no transfer to third countries is needed. Short distances also keep load times low for your visitors. For every provider you need a data processing agreement. More on this in the GDPR checklist.

Type: classic server or modern platform

A classic server with PHP and a database suits WordPress. It needs ongoing updates and backups. Modern websites on Next.js often run on platforms that deliver finished pages worldwide. There is no publicly reachable admin access and less to maintain. What the switch means is covered in WordPress to Next.js.

Setting up company email

Website and mailboxes don't have to be with the same provider. Often it's better to separate them. The connection is made through your domain's DNS records. The MX record says where emails are delivered. The A or CNAME record says where the website lives.

That way email stays reachable even if you move the website. Before any move, check who manages the DNS records. A wrongly set record can otherwise knock out the mailboxes.

Why emails land in spam: SPF, DKIM and DMARC

Anyone can send an email with your sender address. Three DNS records show which emails really come from you:

Since 2024, Google and Yahoo have required authentication from senders who send many emails. Smaller senders benefit too. Without these records, quotes and invoices land in spam more often.

Don't forget any senders. Your newsletter tool, CRM, accounting and contact form often send in your name. Each of these services must be listed in SPF and DKIM. Start DMARC with a policy that only monitors. Read the reports and tighten the rule step by step.

Securing access

Registrar, hosting and email are popular targets. Whoever gets in can redirect your website or read your emails. Automated attackers search for such accounts on purpose. Read more in Agentic attacks.

• Enable a second factor on every account.
• Use personal logins instead of a shared password.
• Remove access as soon as someone leaves the company or project.
• Enable the transfer lock for your domain at the registrar.

A simple list: who owns what

Keep a table with these columns: service, provider, owner, login address, second factor, expiry date, cost. Enter domain, DNS, hosting, email, form service, analytics and ad accounts. Keep the list in a place that at least two people know. Review it once a year.

Frequently asked questions