Your web agency owns your domain. Here's how to get it back.

First, find out where the domain actually lives

Before asking anyone for anything, run a registration-data lookup on your domain (WHOIS was retired for generic TLDs in January 2025; its successor is RDAP). ICANN's lookup tool shows the registrar, the registration and expiry dates, the status codes, and the registrant — though the registrant is often shown as "REDACTED FOR PRIVACY."

Two things matter here: which registrar holds the domain (that's where the account you need lives), and whether the listed registrant organisation is your business or the agency. That second detail decides how much leverage you have if things get difficult.

The transfer, step by step

1. 1
   Create your own registrar account first

   At any registrar you trust. Register it to a shared company mailbox (e.g. domains@yourbusiness.com), never a personal inbox — that's how this problem starts.
2. 2
   Ask the agency to unlock the domain

   Domains normally carry a registrar transfer lock (the status code clientTransferProhibited). The current account holder toggles it off in their control panel.
3. 3
   Ask for the auth code (also called EPP or transfer code)

   A short code generated by the current registrar that authorises the move. Under ICANN policy, registrars can't withhold it from the domain's registrant.
4. 4
   Start the transfer from your new registrar

   Enter the domain and the auth code, pay the transfer fee (usually includes a year's renewal), and approve the confirmation email. Transfers typically complete in five to seven days.
5. 5
   Lock it down once it arrives

   Re-enable the transfer lock, turn on auto-renew with a company card, and add a second contact so no renewal notice depends on one inbox.

The locks you might run into

• Newly registered or recently transferred domains can't move again immediately — ICANN requires a lock after registration and after each transfer.
• Changing the registrant's name, organisation, or email has historically triggered a 60-day transfer lock. Under the ICANN policy update adopted in 2025, this is being replaced by a shorter 30-day lock — but check what your registrar currently enforces before you edit registrant details mid-transfer.
• Practical consequence: if you're planning to transfer, do the transfer first and tidy the registrant details after — not the other way around.

If the agency won't cooperate

Check that RDAP result again. If your business is the listed registrant, the domain is yours in ICANN's eyes: the registrar is obliged to give the registrant access to transfer, and you can raise a transfer complaint with the registrar and then with ICANN if it's blocked.

If the agency listed itself as the registrant, it's a contract problem before it's a technical one. Gather evidence that the domain was registered for your business (invoices, the website itself, email history) and start with a direct request; most agencies hand domains over when asked plainly. Escalation paths — registrar complaint, dispute processes, legal demand — exist, but they're slower and costlier than a firm email, so use them last.

Make sure this never happens again

• The registrar account belongs to the company, on a shared mailbox — agencies and freelancers get delegated access, never the keys.
• Auto-renew on, on a company card that someone tracks the expiry of.
• Transfer lock on, and at least two people who know where the account lives.
• Check the expiry date twice a year — or let monitoring do it for you.