Who owns the domain if a web vendor registered it?

The registrant recorded at the registrar holds the domain, not whoever paid for it. If the vendor registered it in their own name or a personal email, the company depends on that vendor's goodwill.

What does Indonesia's ITE Law say about domain names?

Article 23 of the ITE Law says domain names are obtained on a first-registrant basis, but owning and using them must be in good faith, must not breach fair competition, and must not infringe others' rights. A harmed party may sue to cancel the domain name.

What if someone else has already taken our domain?

For .id domains there is PANDI's domain dispute resolution (PPND); for international domains such as .com there is UDRP. Both require proof of rights, usually a registered trademark, plus time and cost, and the outcome is not guaranteed. Prevention is far cheaper.

What is the first step to secure a company domain?

Check the registrant data, make sure it is the company with a company email, move the registrar account to a company-owned login with two-step verification, and turn on auto-renew and transfer lock.

Guide · Digital foundation

Who really owns your company domain?

Many companies hand their website to a vendor or freelancer, including registering the domain and hosting. The site goes live and everyone is happy. What rarely gets checked is whose name the domain is in. Of everything involved, the domain is the most exposed.

DT-TEKNO.COM · Updated 27 October 2026

Line drawing of an office building connected to a key on a platform, with a padlock, a browser window and an envelope

Short answer: whoever is recorded as the registrant holds the domain, not whoever paid. If it was registered in a vendor's name or an employee's personal email, your website and company email depend on that person. When the brand grows or the domain is neglected, it can be lost, and getting it back is not cheap.

Why the domain is the weak point

Hosting can be moved and a website can be rebuilt. A domain cannot be replaced without changing your business identity. It carries:

Your website, the address customers search for and share.
Company email, including mail to clients, banks, and government offices.
Service verification for Microsoft 365, Google Workspace, and e-signature platforms.

Whoever controls the domain can point the website and email anywhere.

How domains get lost

Registered to a vendor or employee. When the relationship ends, access leaves with them.
Missed renewal. An expired domain can be registered by anyone, and some people hunt for exactly that.
Lost registrar account. The recovery email no longer works, or only one person knows the password.
The brand grows first. Variations (.id, .co.id, .com) get registered by others and offered back at a high price. This is cybersquatting, often called domain trolling.

What Indonesian law says

Article 23 of the ITE Law (Law 11/2008 and its amendments) covers domain names:

First registrant. Domains go to whoever registers first, without the examination a trademark gets.
Good faith. Owning and using a domain must be in good faith, must not breach fair competition, and must not infringe others' rights, such as a registered trademark or a registered company name.
Cancellation claim. A party harmed by a domain used without right may sue to cancel it.

For .id domains, PANDI runs an out-of-court domain dispute resolution (PPND) process based on Government Regulation 71/2019, which can cancel or transfer a domain. For international domains such as .com, the route is ICANN's UDRP.

The catch: these routes need proof of rights (usually a trademark registered with DJKI), time, and panel and legal fees, and the outcome is not guaranteed. That is why people who take domains often dare to offer them back for sale: they know a legal recovery is expensive.

Checklist to secure your company domain

Check the registrant. It should be the company (PT/CV), not a person or the vendor.
Use a generic company email for domain contacts, such as admin@ or it@, not an employee's personal address.
A company-owned registrar account with two-step verification and at least two admins.
Auto-renew, ideally for several years, with a card or balance that will not quietly expire.
Turn on the transfer lock so the domain cannot be moved without permission.
Register your trademark with DJKI. It is the strongest proof of rights in a dispute.
Secure the main variations of your brand, such as .id, .co.id, and .com.
A clear vendor contract: domain and hosting in the company's name, with access handed over when the project ends.

A .co.id domain requires company documents at registration, so it is tied to the business by design. That is one reason it is worth considering for companies in Indonesia.

Frequently asked questions

Our vendor registered the domain. Does that mean they stole it?

Not necessarily. It is often just convenience. The risk still sits with the company, so move it into the company's name while the relationship is good.

How do we check whose name the domain is in?

Through a WHOIS/RDAP lookup or the registrar panel. Personal data is often hidden, so the surest way is to log in to the registrar account and check the registrant details.

Someone already took our domain. What now?

Collect proof of rights (trademark, deed of establishment, history of use), then consider PPND for .id or UDRP for .com with a lawyer.

Sources

Main legal basis: Article 23 of Law No. 11 of 2008 on Electronic Information and Transactions (ITE Law) and its amendments, and Government Regulation No. 71 of 2019. Further references (mostly in Indonesian):

This article is general information, not legal advice. For disputes, consult a lawyer.

Not sure whose name your domain is in?

Ask us to check →