Hosting and maintenance

Your company's domain and hosting: who owns them, and what should you check before you sign?

The ScaleLab teamPublished 11 min read

In short: The domain should be registered to the company, not to the agency or to a former employee. For .bg domains a transfer between two registrants needs a contract that is either notarised or signed with the qualified electronic signatures of both sides, so fixing this later is slow. Renewal is paid up to 30 days before the support term expires, and 40 days after expiry the registration is terminated and the name is released to anyone. Ask any supplier for five kinds of access: registrar, DNS, hosting, content management system and backups.

Domains and hosting look like a small technical detail at the start of a project. They become important on the day the site goes down, the certificate expires, or the company decides to change supplier. The facts below come from the terms of register.bg, the official registry for .bg domains, from Let’s Encrypt documentation and from the CA/Browser Forum requirements, with the date of each source.

Who should be the registrant of the domain?

The answer is short: the legal entity behind the business. Not the agency, not the developer, and not the employee who opened the registration from a personal mailbox.

The register.bg terms state that each domain name is registered to one registrant. The same terms also say something that is often misread: registering a domain name grants no legal rights over the name itself. You are not buying a name, you are maintaining a registration you are responsible for. Which is exactly why that registration needs to sit with the company.

  • Registrant: the company, under its exact registered name.
  • Administrative contact: a person inside the company. Changing them requires the signature of the legal representative, submitted with an electronic signature or on paper, not a password change.
  • Registrar: the intermediary you pay. This one can change: the terms state a registrant may move to another registrar at any time, once the new registrar’s fees are paid.
  • Company details: when they change, the registrant is obliged to update them within one month.

If a registrar ceases trading, its registrants are moved to the registry’s own in-house registrar with no extra payment, until their support term runs out. That is a protection, but it only helps if the registration stands in your company’s name.

ScaleLab tip: Ask your current supplier for a statement or a screenshot of the domain’s registrant details and compare it with your company’s entry in the commercial register. If the two do not match, start the transfer today rather than on the day you change agency.

What does register.bg require, and when does a .bg domain expire?

As of 16 September 2026 the version in force is 4.12, effective 9 August 2026. Here is what it says.

Documents at registration

Two things are needed: an application through a registrar of your choice, and identification documents. If the application is signed with a qualified electronic signature, no further documents are required. Otherwise you submit the original signed application together with a certificate of good standing, and a notarised power of attorney if a proxy signs.

There is no requirement for the name to match a trademark. The registrant chooses: present grounds for using the name and the domain is protected, present none and it is unprotected. Both are valid registrations, and the difference matters in a dispute. A domain registered and continuously supported for more than 5 years becomes protected without any grounds being filed.

Deadlines that do not forgive

  • Renewal: paid up to 30 calendar days before the support term expires.
  • 7 days after expiry: support is suspended. In practice the site and the mail on that domain stop working.
  • 40 days after expiry: with no payment, the registration is terminated and the name released.
  • No reservation: the registry does not hold names for registrants who have ended their support. The name can be taken by someone else.

Transferring between two companies

A transfer requires a contract between the old and the new registrant that is either notarised or signed with the qualified electronic signatures of the representatives of both sides, and is filed through a registrar. Technically it is entered as a new registration application on the ground of transferring the registration. It is a documentary procedure, not a button in a control panel.

For reference, at the registry’s own registrar the registration itself is EUR 0.00 and yearly support for a .bg domain is EUR 30.00 excluding VAT under version 4.12. Other registrars set their own prices, but may not fold domain registration into a combined price with another service.

What about .com and the other generic domains?

There the rules are ICANN’s, not register.bg’s. Two things are worth knowing. First, after a change of registrant the registrar applies a 60 day lock on transfers to another registrar, unless the registrant waives it beforehand. Second, life after expiry is different: there is a redemption period in which the domain is held for 30 days and can be restored, after which it moves towards deletion. The status codes clientTransferProhibited, clientUpdateProhibited and clientDeleteProhibited are useful too, because they block transfer, changes and deletion without your knowledge.

Why do you need access to DNS, not just to the site?

DNS is the directory that turns a domain name into a server address. It decides where the site goes, where the mail goes, and who may send messages in your name.

  • A and AAAA records: point the domain at the web server.
  • CNAME: makes a subdomain point at another name.
  • MX: says where mail is delivered. This record can point at an entirely different provider.
  • TXT: where SPF and DMARC live, and often ownership verification for other services.
  • TTL: how long an answer is cached. A low value before a move means a faster switch.

Without DNS access you cannot change hosting, fix mail delivery, or verify ownership in Search Console. So that access belongs in your hands, whoever maintains the site.

How long does a certificate last, and who renews it?

A secure connection rests on a certificate that expires. When it does, visitors see a browser warning instead of your site.

Lifetimes are getting shorter, and that has been decided at industry level. The CA/Browser Forum requirements reduce the maximum certificate lifetime on a schedule: up to 200 days for certificates issued from 15 March 2026, up to 100 days from 15 March 2027 and up to 47 days from 15 March 2029.

At Let’s Encrypt, as of 16 September 2026, the standard certificate runs 90 days with a recommendation to renew every 60. Since 15 January 2026 there are also short certificates valid for 160 hours, a little over six days, which are opt-in rather than the default and are recommended for renewal every three days. A schedule for shortening the standard lifetime has been published too: 64 days from February 2027 and 45 days from February 2028.

The conclusion for you is simple. Renewing by hand is no longer an option. Ask your supplier whether renewal is automatic and what happens when it fails: who finds out, and within how many hours.

What should you compare in hosting quotes?

Price on its own tells you nothing. Compare the following, and ask for the answers in writing.

  • Resources: processor, memory and disk space, rather than “unlimited traffic”.
  • Backups and restores: how far back copies go, where they are stored and, more importantly, whether a restore has ever been tested. A backup nobody has restored is an assumption.
  • Versions: which PHP and database versions are supported, and how quickly a new one is rolled out. An old version without security fixes is a risk, particularly on WordPress, where most vulnerabilities come from plugins: we covered that in our article on WordPress security and plugins.
  • Staging: is there somewhere changes are tested before they reach the live site.
  • Support: who answers, in which hours, in which language and within what response time. Round-the-clock monitoring and round-the-clock support are not the same thing.
  • Speed: where the servers sit and whether a content delivery network is included. How the effect is measured is covered in our article on site speed and Core Web Vitals.

For promised availability there is no neutral official source stating what a normal figure is, so treat round numbers without arithmetic with caution. The arithmetic itself is easy and anyone can do it.

Promised availability Allowed downtime per month Allowed downtime per year
99.0% about 7 hours 12 minutes about 3.6 days
99.5% about 3 hours 36 minutes about 43 hours
99.9% about 43 minutes about 8 hours 45 minutes
99.95% about 22 minutes about 4 hours 23 minutes
99.99% about 4 minutes about 53 minutes

Bear in mind as well that a service level agreement usually promises a credit when the level is missed rather than the availability itself, and that scheduled maintenance is often excluded from the calculation. Ask specifically what is counted.

Why should company email not depend on the website?

Website hosting and email hosting are two different services, even when they appear on one invoice. When the site migrates or goes down, mail should not go with it.

There is a second reason to separate them. Deliverability depends on DNS records, and Gmail and Microsoft require SPF, DKIM and DMARC from larger senders. How those records fit together, and why messages land in spam, is explained in our article on SPF, DKIM and DMARC.

What should you receive from every supplier?

This is the list that decides whether you are free to change supplier or dependent on one. Ask for it in writing at the start, not at the parting.

  • Registrar: login details for the account holding the domain, and confirmation that the registrant is the company.
  • DNS: access to the zone, or at minimum written confirmation of who manages it and how changes are requested.
  • Hosting: a user with rights to the files and the database.
  • Content management system: an administrator account in your own name, not a shared one.
  • Backups: where they are kept, how far back, and how a restore is requested.
  • Certificate: who renews it and how it is monitored.
  • Tracking: ownership of the GA4 and Search Console properties, on a company email address.

ScaleLab tip: Once a year, open each of these and check that it still works. If you are not sure what actually sits behind your site right now, a free website and marketing audit is an unhurried way to build that list.

Maintenance is the work of watching these things for you. Under website hosting and maintenance, the site runs on managed cloud hosting with round-the-clock monitoring, updates, backups and certificates kept from expiring.

Frequently asked questions

Do I own my .bg domain if I pay for it?

You pay to maintain a registration, and the register.bg terms state expressly that registration grants no legal rights over the name itself. What matters in practice is different: the registrant must be the company, because that is what keeps decisions about the domain with you.

What happens if I forget to renew?

For a .bg domain, support is suspended 7 days after the term expires, and 40 days after expiry the registration is terminated and the name released. The registry does not reserve names for registrants who have ended support, so the dates belong in two people’s calendars.

Do I need a trademark for a .bg domain?

No. The registrant decides whether to present grounds for using the name. With grounds the domain is protected, without them it is unprotected, and a domain supported continuously for more than 5 years becomes protected without any being filed.

How often is the certificate for a secure connection renewed?

It depends on the issuer, but the periods are shrinking. Let’s Encrypt issues a standard 90 day certificate and recommends renewing every 60 days, while industry requirements already cap new certificates at 200 days and drop that to 100 days from 15 March 2027. So renewal has to be automatic and monitored.

Can email stay with the old provider if I change hosting?

Yes. Mail is governed by the MX records and the authentication records in DNS, and can point at a different provider. That is exactly why DNS access matters: without it you can neither move the site nor fix the mail.

Sources

Related articles

  • Hosting and maintenance

    WordPress security: why plugins are the main risk and how to maintain your site

    According to a Patchstack report, 91% of new WordPress vulnerabilities in 2025 were in plugins, and heavily exploited vulnerabilities were first attacked a median of about 5 hours after disclosure. Hosting-level defences stop only a small share of these attacks. That is why WordPress security rests on regular maintenance: a clear update policy, few plugins, tested backups, secure access and monitoring.

    7 min read

  • Email and automation

    Why do your company's emails land in spam, and how do SPF, DKIM and DMARC fix it?

    SPF, DKIM and DMARC are three DNS records that prove to mailbox providers that your emails really come from your company. Gmail and Microsoft require all three from senders of around 5,000 or more emails a day, and Gmail also watches spam complaint rates and easy unsubscribing. Set them up step by step, start DMARC at p=none and read the reports before you tighten the policy.

    9 min read