Who Should Control the DNS Settings for Your Business Domain?

By Bill Stilwell · Last reviewed October 16, 2026

The short answer

Your business should control its own Domain Name System (DNS) settings, through a login the business owns and protects with multi-factor authentication (MFA). DNS records tell the internet where to send your website visitors and your email. Find out where your DNS is managed, make sure at least two business-controlled people can get in, and keep a written log of every change.

What this means

DNS works like a phone book for the internet. When someone types your domain, DNS tells their device which server holds your website. When someone emails you, DNS tells their email system where to deliver it.

Your DNS lives in one place, set by your “nameservers.” That place might be your registrar, your web host, or a separate DNS service. Many owners don’t know which one it is.

Here are the records most small businesses have:

A record. Points your domain to the server that holds your website.
CNAME record. Points one name to another, like “www” to your main domain.
MX records. Tell the world where to deliver your email.
TXT records. Hold text that proves things, like that you own the domain or which services may send email for you. Email protection settings live here (see 12.1.6 Email Security).

Say a roofing company switches web designers. The old designer set up DNS in their own account. The new designer can’t change the A record, so the new site can’t go live. The roofer spends two weeks chasing the old designer for access. That’s what this page prevents.

Why it matters

Whoever controls DNS controls your website and email. One wrong change can take both offline.
Attackers target DNS logins. The Cybersecurity and Infrastructure Security Agency (CISA) has warned about attackers who change DNS records to send traffic and email to servers they control. CISA’s advice includes changing passwords on every account that can edit DNS and turning on MFA.
Lost access slows everything down. A website launch, an email switch, or a Google Search Console check may need a DNS change. If nobody can log in, the work stops.
Undocumented changes are hard to undo. If email stops working after a change and nobody wrote down the old value, you’re guessing.

Who this applies to

Every business with a domain. It matters most if:

A designer, developer, or IT person set up your website or email
You use business email on your own domain (see 12.1.1 Business Email Domain)
You’ve changed web hosts or email providers before
You run more than one domain

How to do it

Find your nameservers. Log in to your registrar and look at the domain’s nameserver setting. That tells you which company holds your DNS records. If you aren’t sure who your registrar is, ICANN Lookup (lookup.icann.org) shows it. ICANN is the Internet Corporation for Assigned Names and Numbers.
Log in to that DNS provider with a business account. If the DNS lives in a vendor’s account, ask them to move it into an account your business owns, or to add you as an owner. The login should use a shared business email, not one person’s address (see 13.1.2 Registrar Ownership).
Turn on MFA for the registrar and the DNS provider (see 11.7.3 Multi-Factor Authentication). If a provider doesn’t offer it, that’s a reason to move.
Give access to two business-controlled people. One person leaving shouldn’t lock you out.
Export or copy your current records. Save a copy before anyone changes anything. Many DNS screens have an export button. If not, take a screenshot.
Label every record. Next to each one, write what it’s for, like “website,” “email,” or “Google verification.” Records nobody can explain tend to get deleted by mistake.
Start a change log. For each change, write the date, who made it, what changed, the old value, the new value, and why.
Check your records once a year. CISA recommends confirming that records point where you expect. Anything you don’t recognize should be checked right away.
Add the DNS login to your access inventory (see 11.7.5 Access Inventory).

Changes don’t always show up everywhere at once. Each record has a “time to live” setting that tells other systems how long to remember the old answer. Wait before assuming a change failed.

What proof to keep

A copy or screenshot of all DNS records, dated
The DNS change log
A screenshot of the nameserver setting at your registrar
A screenshot showing MFA turned on for the DNS account
The list of people who can log in

Keep these in your website records folder. Update the copy after every change.

Common mistakes

Letting the web designer own the DNS account. Ask for access before you need it, not after a falling out.
Changing nameservers without copying the old records. When you move DNS to a new provider, your email records don’t always come along. Email can stop that day.
Deleting a TXT record that looks like gibberish. It might be what keeps your email out of spam or proves you own the domain to Google.
Two DNS setups at once. Some owners edit records at the registrar while the nameservers point somewhere else. Those edits do nothing. Always edit where the nameservers point.
No record of what changed. If something breaks, the log is how you fix it fast.

When to get help from a pro

A web or IT professional: if your website or email will move, or if you see records you don’t understand. Ask:

Which records will this change touch, and what are the old values?
Will my email keep working during the switch?
Can you add this change to my DNS log?

Your registrar’s or DNS provider’s support team: if you’re locked out of the account or a vendor won’t give access.

Bill’s note

[Bill: add a short story or lesson here. For example, a client whose website launch was stuck because a past vendor held the DNS login, or an email outage caused by a nameserver change that dropped the MX records.]

If you’d rather have this done for you, SiteSmarty manages domains and DNS for the local businesses it builds websites for.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: where SiteSmarty’s DNS lives, who has access, and how I labeled the records]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the DNS records screen, the nameserver setting, and the change log]
[Result so far:]

Questions people ask

What is DNS? It’s the system that connects your domain name to your website server and your email provider. Your DNS records are the settings that make those connections.

Where are my DNS records managed? Wherever your nameservers point. Check the nameserver setting at your registrar to find out.

Should my web designer control my DNS? They can have access to do the work, but the account should belong to your business. You should always be able to log in without them.

Can I change my web host without transferring my domain? Yes. ICANN notes that changing your host or nameservers doesn’t require moving the domain to a new registrar.

How long do DNS changes take? Often minutes, sometimes longer. It depends on each record’s time to live setting.

Audit check

Question: Does the business control its DNS through its own protected account, with a current copy of all records and a change log?
Pass looks like: DNS provider known. Business-owned login with MFA. Two business-controlled people with access. Every record labeled. A dated copy of the records and a change log kept.
Fail looks like: Nobody knows where DNS lives. A vendor or former employee holds the only login. No MFA. No record of past changes.
Evidence to collect: Screenshot of nameservers and DNS records, the access list, proof of MFA, and the change log.

Where this fits

Do this first: 13.1.2 Registrar Ownership

Do this next: 13.1.6 Domain Transfer Lock

Sources

Cybersecurity and Infrastructure Security Agency, "Mitigate DNS Infrastructure Tampering" (checked October 16, 2026)
ICANN, "FAQs for Registrants: Transferring Your Domain Name" (checked October 16, 2026)
Federal Trade Commission, "Cybersecurity for small business: Hiring a web host" (checked October 16, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.