How Who Has The Keys works
Who Has The Keys checks the public records for a business's web address and shows where its domain, website and email are held, then keeps a register of who controls each account, without ever asking for a password.
What the free check reads
The free check reads two public sources for the address you type: the domain’s registration record, through RDAP, the service registries use to publish who holds a domain and until when, and the domain’s DNS records, which tell the internet where the website and email live. Both are public so that the internet can work. Reading them needs no password and no permission, and the check signs in to nothing.
Each answer goes into a numbered field. The numbers are the same on your register, in the fix guides and in the handover pack, so instructions can say “see field 1.1”.
| Field | What it shows | Where it comes from |
|---|---|---|
| 1Domain name | The address you typed, cleaned up | The address you type |
| 1.1Registered with | The registrar that holds the domain | The domain’s public registration record |
| 1.2Renews | The date the registration runs out | The domain’s public registration record |
| 1.3Registered keeper | Whose name is on the domain | Usually hidden. You fill this in |
| 2Nameservers (DNS) | Who runs the domain’s DNS | The domain’s nameserver records (NS) |
| 3Website host | Where the website is served from | The domain’s website address records (A, AAAA, www) |
| 4Email | Who handles email for the domain | The domain’s email records (MX) |
| 4.4Email admins | Who can add and remove mailboxes | You fill this in |
| 5Other services | Services that have verified the domain, such as newsletter sending | The domain’s verification records (TXT) |
What you fill in
Public records show where each account is held, not who controls it. When you start a register, you add each account the business depends on, such as the registrar, the website host, email, payments and social media, and fill in the same fields for each one:
- who the registered keeper or account owner is
- who has admin access, and whether there is more than one admin
- which email address signs in, and whether it belongs to the business or to one person
- whether two-step login is on
- who pays for it, and when it renews
The register then gives a score: how many of the keys the business holds itself, such as “7 of 12 keys held by the business”. Every field that is worth fixing gets a red note and a fix guide with the plain steps for that service.
What we watch
Once a domain is on a register, Who Has The Keys checks it again every day. You get an email 60, 30 and 7 days before the domain renews, and whenever its registrar, nameservers, email host or website host change. Once a month you get a short summary.
The handover pack
The handover pack is the logbook as a printable A4 PDF, every field numbered. It is for the day someone else needs the full picture: a buyer, a new web developer, an insurer, or your solicitor.
Break-glass
Break-glass sends people you name the map of your accounts and your instructions if you stop checking in. You choose how long the silence lasts, and a delay follows that you can cancel. It never sends a password, and it isn’t a will. What happens to your accounts if you can’t act.
What we never hold
No password, recovery code or two-step code is ever asked for, and the register has no field to put one in. Card payments are taken by Stripe, which holds the card details. What we keep, and how it is protected.
See your own fields.
Or see an example logbook first.