In short: The domain should be registered to the company, not to the agency or to a former employee. For .bg domains a transfer between two registrants needs a contract that is either notarised or signed with the qualified electronic signatures of both sides, so fixing this later is slow. Renewal is paid up to 30 days before the support term expires, and 40 days after expiry the registration is terminated and the name is released to anyone. Ask any supplier for five kinds of access: registrar, DNS, hosting, content management system and backups.
Domains and hosting look like a small technical detail at the start of a project. They become important on the day the site goes down, the certificate expires, or the company decides to change supplier. The facts below come from the terms of register.bg, the official registry for .bg domains, from Let’s Encrypt documentation and from the CA/Browser Forum requirements, with the date of each source.
Who should be the registrant of the domain?
The answer is short: the legal entity behind the business. Not the agency, not the developer, and not the employee who opened the registration from a personal mailbox.
The register.bg terms state that each domain name is registered to one registrant. The same terms also say something that is often misread: registering a domain name grants no legal rights over the name itself. You are not buying a name, you are maintaining a registration you are responsible for. Which is exactly why that registration needs to sit with the company.
- Registrant: the company, under its exact registered name.
- Administrative contact: a person inside the company. Changing them requires the signature of the legal representative, submitted with an electronic signature or on paper, not a password change.
- Registrar: the intermediary you pay. This one can change: the terms state a registrant may move to another registrar at any time, once the new registrar’s fees are paid.
- Company details: when they change, the registrant is obliged to update them within one month.
If a registrar ceases trading, its registrants are moved to the registry’s own in-house registrar with no extra payment, until their support term runs out. That is a protection, but it only helps if the registration stands in your company’s name.
ScaleLab tip: Ask your current supplier for a statement or a screenshot of the domain’s registrant details and compare it with your company’s entry in the commercial register. If the two do not match, start the transfer today rather than on the day you change agency.
What does register.bg require, and when does a .bg domain expire?
As of 16 September 2026 the version in force is 4.12, effective 9 August 2026. Here is what it says.
Documents at registration
Two things are needed: an application through a registrar of your choice, and identification documents. If the application is signed with a qualified electronic signature, no further documents are required. Otherwise you submit the original signed application together with a certificate of good standing, and a notarised power of attorney if a proxy signs.
There is no requirement for the name to match a trademark. The registrant chooses: present grounds for using the name and the domain is protected, present none and it is unprotected. Both are valid registrations, and the difference matters in a dispute. A domain registered and continuously supported for more than 5 years becomes protected without any grounds being filed.
Deadlines that do not forgive
- Renewal: paid up to 30 calendar days before the support term expires.
- 7 days after expiry: support is suspended. In practice the site and the mail on that domain stop working.
- 40 days after expiry: with no payment, the registration is terminated and the name released.
- No reservation: the registry does not hold names for registrants who have ended their support. The name can be taken by someone else.
Transferring between two companies
A transfer requires a contract between the old and the new registrant that is either notarised or signed with the qualified electronic signatures of the representatives of both sides, and is filed through a registrar. Technically it is entered as a new registration application on the ground of transferring the registration. It is a documentary procedure, not a button in a control panel.
For reference, at the registry’s own registrar the registration itself is EUR 0.00 and yearly support for a .bg domain is EUR 30.00 excluding VAT under version 4.12. Other registrars set their own prices, but may not fold domain registration into a combined price with another service.
What about .com and the other generic domains?
There the rules are ICANN’s, not register.bg’s. Two things are worth knowing. First, after a change of registrant the registrar applies a 60 day lock on transfers to another registrar, unless the registrant waives it beforehand. Second, life after expiry is different: there is a redemption period in which the domain is held for 30 days and can be restored, after which it moves towards deletion. The status codes clientTransferProhibited, clientUpdateProhibited and clientDeleteProhibited are useful too, because they block transfer, changes and deletion without your knowledge.
Why do you need access to DNS, not just to the site?
DNS is the directory that turns a domain name into a server address. It decides where the site goes, where the mail goes, and who may send messages in your name.
- A and AAAA records: point the domain at the web server.
- CNAME: makes a subdomain point at another name.
- MX: says where mail is delivered. This record can point at an entirely different provider.
- TXT: where SPF and DMARC live, and often ownership verification for other services.
- TTL: how long an answer is cached. A low value before a move means a faster switch.
Without DNS access you cannot change hosting, fix mail delivery, or verify ownership in Search Console. So that access belongs in your hands, whoever maintains the site.
How long does a certificate last, and who renews it?
A secure connection rests on a certificate that expires. When it does, visitors see a browser warning instead of your site.
Lifetimes are getting shorter, and that has been decided at industry level. The CA/Browser Forum requirements reduce the maximum certificate lifetime on a schedule: up to 200 days for certificates issued from 15 March 2026, up to 100 days from 15 March 2027 and up to 47 days from 15 March 2029.
At Let’s Encrypt, as of 16 September 2026, the standard certificate runs 90 days with a recommendation to renew every 60. Since 15 January 2026 there are also short certificates valid for 160 hours, a little over six days, which are opt-in rather than the default and are recommended for renewal every three days. A schedule for shortening the standard lifetime has been published too: 64 days from February 2027 and 45 days from February 2028.
The conclusion for you is simple. Renewing by hand is no longer an option. Ask your supplier whether renewal is automatic and what happens when it fails: who finds out, and within how many hours.
What should you compare in hosting quotes?
Price on its own tells you nothing. Compare the following, and ask for the answers in writing.
- Resources: processor, memory and disk space, rather than “unlimited traffic”.
- Backups and restores: how far back copies go, where they are stored and, more importantly, whether a restore has ever been tested. A backup nobody has restored is an assumption.
- Versions: which PHP and database versions are supported, and how quickly a new one is rolled out. An old version without security fixes is a risk, particularly on WordPress, where most vulnerabilities come from plugins: we covered that in our article on WordPress security and plugins.
- Staging: is there somewhere changes are tested before they reach the live site.
- Support: who answers, in which hours, in which language and within what response time. Round-the-clock monitoring and round-the-clock support are not the same thing.
- Speed: where the servers sit and whether a content delivery network is included. How the effect is measured is covered in our article on site speed and Core Web Vitals.
For promised availability there is no neutral official source stating what a normal figure is, so treat round numbers without arithmetic with caution. The arithmetic itself is easy and anyone can do it.
| Promised availability | Allowed downtime per month | Allowed downtime per year |
|---|---|---|
| 99.0% | about 7 hours 12 minutes | about 3.6 days |
| 99.5% | about 3 hours 36 minutes | about 43 hours |
| 99.9% | about 43 minutes | about 8 hours 45 minutes |
| 99.95% | about 22 minutes | about 4 hours 23 minutes |
| 99.99% | about 4 minutes | about 53 minutes |
Bear in mind as well that a service level agreement usually promises a credit when the level is missed rather than the availability itself, and that scheduled maintenance is often excluded from the calculation. Ask specifically what is counted.
Why should company email not depend on the website?
Website hosting and email hosting are two different services, even when they appear on one invoice. When the site migrates or goes down, mail should not go with it.
There is a second reason to separate them. Deliverability depends on DNS records, and Gmail and Microsoft require SPF, DKIM and DMARC from larger senders. How those records fit together, and why messages land in spam, is explained in our article on SPF, DKIM and DMARC.
What should you receive from every supplier?
This is the list that decides whether you are free to change supplier or dependent on one. Ask for it in writing at the start, not at the parting.
- Registrar: login details for the account holding the domain, and confirmation that the registrant is the company.
- DNS: access to the zone, or at minimum written confirmation of who manages it and how changes are requested.
- Hosting: a user with rights to the files and the database.
- Content management system: an administrator account in your own name, not a shared one.
- Backups: where they are kept, how far back, and how a restore is requested.
- Certificate: who renews it and how it is monitored.
- Tracking: ownership of the GA4 and Search Console properties, on a company email address.
ScaleLab tip: Once a year, open each of these and check that it still works. If you are not sure what actually sits behind your site right now, a free website and marketing audit is an unhurried way to build that list.
Maintenance is the work of watching these things for you. Under website hosting and maintenance, the site runs on managed cloud hosting with round-the-clock monitoring, updates, backups and certificates kept from expiring.
Frequently asked questions
Do I own my .bg domain if I pay for it?
You pay to maintain a registration, and the register.bg terms state expressly that registration grants no legal rights over the name itself. What matters in practice is different: the registrant must be the company, because that is what keeps decisions about the domain with you.
What happens if I forget to renew?
For a .bg domain, support is suspended 7 days after the term expires, and 40 days after expiry the registration is terminated and the name released. The registry does not reserve names for registrants who have ended support, so the dates belong in two people’s calendars.
Do I need a trademark for a .bg domain?
No. The registrant decides whether to present grounds for using the name. With grounds the domain is protected, without them it is unprotected, and a domain supported continuously for more than 5 years becomes protected without any being filed.
How often is the certificate for a secure connection renewed?
It depends on the issuer, but the periods are shrinking. Let’s Encrypt issues a standard 90 day certificate and recommends renewing every 60 days, while industry requirements already cap new certificates at 200 days and drop that to 100 days from 15 March 2027. So renewal has to be automatic and monitored.
Can email stay with the old provider if I change hosting?
Yes. Mail is governed by the MX records and the authentication records in DNS, and can point at a different provider. That is exactly why DNS access matters: without it you can neither move the site nor fix the mail.
Sources
- Register.BG: General Terms and Conditions for Registration and Maintenance of Domain Names in the .BG Domain, version 4.12 (in force from 9 August 2026)
- Register.BG: official registry for .bg domain names
- ICANN: Transfer Policy (effective 1 December 2016, updated 21 February 2024)
- ICANN: EPP Status Codes
- Let’s Encrypt: Frequently Asked Questions
- Let’s Encrypt: Certificate Lifetime Rationale and Plans (updated 22 July 2026)
- Let’s Encrypt: 6-day and IP Address Certificates are Generally Available (15 January 2026)
- Let’s Encrypt: Decreasing Certificate Lifetimes to 45 Days (2 December 2025)
- CA/Browser Forum: Ballot SC081v3, Introduce Schedule of Reducing Validity and Data Reuse Periods (11 April 2025)
- CA/Browser Forum: Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates
- Google Search Central: Changing Your Web Hosting and SEO (updated 10 December 2025)