"Our web company handles all that." It may be the most expensive sentence in small-organization web management, and I have heard it in boardrooms, bakeries, and church offices for twenty years. Sometimes it is even true. The trouble is that "all that" is at least three different jobs, performed by companies that may or may not be the same company, and each one controls something different. When an outage or a dispute arrives, the organizations that know which company controls what make one phone call. The ones that do not make five.
The purpose of this post is to separate those roles clearly, show what each one can take away from you, and explain why knowing the difference is a security practice as much as a filing exercise. If an earlier Saturday quick win left you with your registrar, host, and platform written on one page, this is the argument for why that page matters, and for what to add to it this week.
Three landlords and a construction system
The book uses a property metaphor because it holds up under pressure.
Your domain name, such as yourorganization.org, is not something you buy outright. You register the right to use it, one year at a time, through an accredited company called a registrar. The registrar runs the leasing office: it records your right to the name, collects the renewal, and handles transfers. Everything else in your digital presence attaches to that lease.
Your web host owns the building. It is the company whose computers store the website's files and serve them to visitors. Wednesday's podcast companion covered the four kinds of tenancy, from shared apartment to full-service managed building.
Your DNS provider maintains the directory in the lobby. The Domain Name System (DNS) is the set of records that tells the rest of the internet where to send visitors and where to deliver email. It is often the registrar or the host doing this job, but not always, and it is the quiet fourth party in most outages.
Your platform is the construction system: the framing, wiring, and plumbing the site is built from. WordPress, Squarespace, Wix, Webflow, and Shopify are platforms, and the choice determines what the site can do, what it costs to maintain, and how hard it would be to move out.
Role | In the metaphor | What it controls | If it fails or you leave it |
|---|---|---|---|
Registrar | The leasing office | Your right to the name; renewals; transfers | You can lose the name itself |
Web host | The building | The site's files and the server that serves them | The site goes down; the name survives |
DNS provider | The lobby directory | Where visitors and email get sent | Everything misroutes; the name survives |
Platform | The construction system | What the site can do and how it is maintained | Moving out means a migration project |
Why they get confused
One vendor can legitimately play several of these roles. Hosted platforms such as Squarespace and Wix bundle the building and the construction system together, and many will sell you the domain too. Large hosts offer registration and DNS alongside hosting. The bundle is convenient, and convenience is not the problem.
The problem is not knowing which roles a vendor is playing, and discovering during a crisis that the lease is written in someone else's name. While a bundled arrangement feels simpler, the decision you are actually making is who holds the keys to each role. Your registrar does not host your site, your host does not own your name, and a company can stop doing one job without affecting the others. An organization that understands this can change any landlord without losing the property.
What each one can take away
This is where the distinction becomes a security matter, which is why it belongs in Security Month.
The registrar can take away the most. A lapsed or hijacked domain takes down the web stack, the email, and the organization's public name in a single stroke, and it can hand all three to a stranger. I once watched a Fortune 500 client spend several thousand dollars and months of negotiation recovering a domain registered years earlier under a departed employee's personal email address. The registrar account is the one that deserves the strongest password, two-factor authentication (2FA), auto-renew, and a payment card that will still be valid next year.
The host can take away the site and, as Monday's post explained, every backup stored inside the same account. Suspension over a billing dispute or a compromise suspends both. That is the reason one backup copy should always live somewhere the host does not control.
The DNS provider can misroute everything without deleting anything. A careless record change can send your email into nowhere while the website hums along, which is why changes to DNS deserve a snapshot first and a note afterward.
The platform takes away options rather than assets. Its lock-in is measured in what it would cost to leave, and the honest question to ask of any platform is not what it can do but what leaving it would cost.
Knowing which one to call
There is a practical payoff beyond ownership: faster support. When the website is down but email still arrives, the problem usually lives with the host. When email breaks while the website works, suspect DNS, because the two are separate directory entries. When a browser says the domain does not exist at all, or a renewal notice names a company you have never paid, call the registrar. When the site loads but a feature broke after an update, that is a platform question. Support tickets resolve dramatically faster when they open with the right company.
The recommendation
Three actions turn this distinction into practice.
First, finish the one-page record if you have not: registrar, host, DNS provider, and platform, with the renewal date, the account login's email address, and the payment card on each. ICANN Lookup (lookup.icann.org) gives you the registrar and expiration date in a minute; a stack scanner such as BuiltWith gives you the platform.
Second, check the name on every lease. Each account should be registered to an organizational, role-based email address, such as [email protected], not to a person. Any account tied to a former employee or a vendor's personal address moves to the top of next month's list.
Third, put 2FA on the registrar, the host, and the DNS provider this week, in that order. Those three accounts can each, alone, take the organization offline.
None of this requires technical skill. It requires knowing that "our web company handles all that" is three or four sentences pretending to be one, and writing each of them down.
Read the full treatment. DNS records in plain English, the hosting scorecard, and what to do when ownership is disputed are in Chapters 3 through 5 of Strategic Web Management: First Steps for the Accidental Web Manager. The companion worksheets for those chapters are free with a Web Managers account at https://webmanagers.com/register, and they arrive with the weekly Web Managers letter.