Who controls your business website and email?

Understand what your business depends on

Think about your business website address.

It may appear on invoices, customer communications, marketing materials and contracts. Your employees might also use email addresses linked to the same domain.

Behind that familiar address are several services that help keep everything working.

Your domain registrar manages the registration of the name. Your hosting provider may run the website. Another company might provide email, while an external agency maintains the site.

Sometimes one supplier looks after everything. Sometimes several are involved.

The important thing is understanding who does what.

If your website stopped working or business email became unavailable, would you know who to contact?

Knowing where responsibility sits makes it easier to resolve problems and maintain appropriate oversight.

Keep ownership and access under control

It's common for an external provider to register a domain or set up a website on behalf of a business.

That arrangement can work well. But it shouldn't leave your organisation dependent on one individual's personal account.

The NCSC advises that public domain names should be managed through accounts controlled by the organisation, rather than personal email accounts.

Check who the domain is registered to, who can access the registrar account and whether your business can manage or transfer the domain if necessary.

If an external supplier needs access, consider whether they can be given their own appropriate permissions rather than sharing a single password.

The same applies when employees leave or supplier relationships end.

Access that is no longer needed should be removed.

You can delegate the day-to-day work without giving up control of an important business asset.

Protect the accounts that matter most

Some accounts have much greater influence over your business than others.

A domain administrator may be able to change settings that determine where your website or email traffic goes. A website administrator may be able to change what customers see.

These accounts deserve additional protection.

Use strong, unique passwords or passkeys where supported, and enable two-step verification.

Limit administrative access to people who genuinely need it.

Make sure account recovery details are current and that recovery doesn't depend entirely on one person or an email account that might itself become unavailable.

The NCSC highlights the importance of protecting powerful administrator accounts (opens in a new tab) because compromising one can give an attacker extensive access.

A few minutes spent reviewing these arrangements can prevent a much more difficult problem later.

Check whether your business email can be impersonated

Criminals don't always need access to your actual email account to make a message appear to come from your business.

Some attacks involve email spoofing, where a sender attempts to make an email appear to originate from a domain they don't control.

This can be used to deceive customers, suppliers or employees.

There are technical protections that help receiving email services recognise and handle these messages.

You may hear your IT provider refer to SPF, DKIM and DMARC (opens in a new tab). These are email authentication standards that help verify legitimate senders and reduce certain forms of impersonation.

You don't need to understand how to configure them yourself.

But it is worth asking whoever manages your email whether these protections are in place and appropriately configured.

The NCSC recommends a phased approach, with testing and monitoring (opens in a new tab), so legitimate business emails continue to be delivered.

These controls don't prevent every type of impersonation, but they can reduce an avoidable risk to your business and its customers.

Don't wait until something breaks

Website and email arrangements can change gradually.

A new agency takes over the website. An employee leaves. Your business moves email provider or introduces another service that sends messages on its behalf.

Each change can affect who has access and how the services are configured.

Build a simple review into your normal business arrangements.

Keep a record of the organisations responsible for your domain, hosting and email. Confirm that renewal notifications go to an appropriate business contact and that payment details are current.

Review administrator access periodically and after significant changes.

It is also worth understanding what your hosting provider backs up, how your website would be restored and who would coordinate recovery if something went wrong.

You don't need a complicated technical register.

You need enough information to avoid discovering that nobody knows how an important service is managed.