Custody of the Name: Who Owns Your Domain and Your Mail

Ask an operator who owns the business's domain and the answer usually names a person rather than the organization. A designer registered it. Someone who has since left set up the mail. A relative who was good with computers put it together over a weekend and moved on. The business has run on that arrangement for years and it has never caused a moment of trouble, which is precisely why nobody has looked at it.

Custody of the name is an operating question rather than a technical one. It belongs with the lease, the license, the insurance, and the client list, and it stays with the principal no matter who set the systems up. An operator who would never let an outsider hold the only copy of the engagement letters will let an outsider hold the address those letters are sent from, because the second arrangement does not look like custody. It is.

An address you were given is not a name you own

A great many organizations correspond from a free mailbox at a large provider, or from an address on a domain that a vendor registered on their behalf and still holds. Printed on a card, those look no different from a domain the organization owns outright. In practice they are different arrangements. One is property the organization holds and can move at will. The other is a courtesy, revocable in the ordinary course, dependent on a person remaining reachable and willing.

The test is not what the address looks like. It is whether the organization could, this afternoon and without anyone's cooperation, sign in to the registrar, move the mail, change who has access, and take the whole arrangement elsewhere. If the answer begins with a phone call to somebody who no longer works there, the name is not in the organization's custody.

Ownership is a set of powers, not a receipt

What ownership confers is administration, and administration is a short list of concrete powers. An organization that administers its own mail can require a second factor on every account and know the requirement is genuinely in force rather than merely encouraged. It can end a session on a device that is no longer in the building. It can see a record of who signed in, from where, and when. It can open an account the day someone arrives and close it the hour someone leaves, and it can show afterward that it did.

None of that exists on an address issued to a person. There is no console, because there is no administrator. There is no record, because nobody is keeping one. There is no way to end a session, because sessions belong to the account holder rather than to the organization. The correspondence of the business runs through an arrangement the principal can describe but cannot govern, and the distance between describing and governing is the entire subject.

A name is also a statement about your own mail

Alongside the domain, an organization publishes settings that tell a receiving system which messages are genuinely its own and what should be done with messages that are not. This is ordinary configuration, published once and thereafter left alone. Where it is present and correct, a recipient's mail system can separate the organization's correspondence from correspondence that merely resembles it. Where it is absent, the system cannot, and neither can the reader.

This is the part principals are most often surprised by, because it is not a question about the organization's own systems at all. It is a question about what the organization has told everyone else concerning its name. A domain that says nothing about its own mail has left that judgment to strangers, and they will make it either way.

Standing is published in advance or it is not available

Consider the ordinary sequence. Correspondence goes out over an organization's address to people who have every reason to trust it, and the organization did not send it. The first thing any principal wants to do is write to the client list and say so plainly. That correction travels on the same name, into inboxes that have just seen something irregular carrying it. Where the domain has never published anything about its own mail, the correction is treated exactly as the imitation was, and it is set aside before it is read.

The general point is more useful than the sequence. The standing to be believed is not something an organization can acquire in the hour it becomes necessary. It is settled in advance or it is not available: custody of the domain, administration of the mail, a record of access, the ability to close an account the same day, and a published statement about one's own correspondence. Each is worth very little on an ordinary day. None can be assembled on any other.

It stays with the principal

Whoever set the systems up, the obligation did not transfer to them. A vendor who registered the domain holds an asset. The principal holds the answer for it, to clients, to a board, to an insurer, and to anyone who asks a reasonable question about how the organization's affairs are kept. This is not a complaint about the people who built these arrangements. They were generally asked to make something work quickly and inexpensively, and they did exactly that. Custody was never among the questions put to them.

The practical consequence is that no one else will raise it. A mail provider will not write to say the organization has no administrator. A registrar will not write to ask whether the person named in its records still works there. The question is the principal's to ask, and it does not get asked by accident.

What settling it looks like

Settling custody is documentary work rather than a project. It resolves into a register. Who holds the domain and where the mail is administered, named to a person or an entity. Which accounts exist, who uses them, and which of them stand behind a second factor. What the domain publishes about its own mail, read the way a recipient's system reads it. What would have to happen for the organization to end someone's access on the day it decides to. Every line has a holder and a next step, and a good number of them are closed in an afternoon at no cost.

An organization can do this for itself. The register is the whole method, and a principal who works through it patiently will find most of what there is to find. What an outside reading adds is that it actually gets done, that it is written down in a form somebody can act on, and that the person doing the reading has no stake in the answer being comfortable.