In this guide · 8 sections
- 01Registrar vs DNS host vs web host: three different jobs
- 02Who should own the domain: the registrant rule
- 03Options for managing domain and DNS
- 04Share DNS access without sharing passwords
- 05Keep a DNS change log and backups
- 06Security settings: registrar lock, registry lock and DNSSEC
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
The business should own the domain itself, registered in the company's name at a registrar of its choice, with auto-renew on a company card. DNS can sit with the registrar or a DNS host such as Cloudflare. Agencies and IT helpers get their own logins with limited roles, never your password.
Registrar vs DNS host vs web host: three different jobs
People say 'the domain is with X' and mean three different things. Untangling them is the first step, because each one can break your website or email in a different way.
| Role | What it does | What breaks if it fails | Typical providers |
|---|---|---|---|
| Registrar | Holds the registration and renewal of the name with the registry | Domain expires, so website and email both stop | Cloudflare, Namecheap, GoDaddy, Vodien, Exabytes |
| DNS host | Answers the internet's lookups: which server for the website, which for email | Wrong or missing records stop the website, email or both | Cloudflare, the registrar's own DNS, Amazon Route 53 |
| Web host | Runs the website itself | Website down; email usually keeps working | Shopify, Wix, WordPress hosts, Vercel |
The registrar decides where DNS lives through the nameserver setting. Our explainer on nameservers vs DNS records shows how they connect. For .sg names, only registrars accredited by SGNIC can register them; the SGNIC list of registrars is the official list.
Who should own the domain: the registrant rule
The person or organisation in the registrant fields is the legal holder of the domain. If a web designer registered it in their own name, it is theirs on paper, even if you paid. That is why domain recovery from former agencies is such a common job; our guide on getting domain access back from an agency covers the fix.
Domain ownership check
Options for managing domain and DNS
There is no single right set-up. What matters is that the company owns the accounts and someone is clearly responsible for changes.
Everything at the registrar
Simplest- One login, one bill
- Registrar DNS is usually basic but fine
- Weaker access controls at some budget registrars
Best for: A small firm with one website and one email provider.
Registrar + Cloudflare DNS
Most flexible- Free DNS plan with fast changes
- Member roles and audit logs
- Adds a second account to look after
Best for: Firms with several services pointing at the domain, or an IT helper making changes.
Agency or IT provider manages it
- Hands-off for you
- Fine if the accounts stay in your name
- Risky if the agency owns the logins
Best for: Owners who want no admin, as long as ownership stays with the company.
Prices for registration and renewal vary by registrar and extension. Our domain registrar comparison lists current prices for .sg, .com.sg and .com.
Keep a DNS change log and backups
Most DNS outages in small firms come from a well-meant change: a new website host overwrites the MX records, or someone deletes a TXT record they did not recognise, which breaks email authentication. A simple routine prevents most of it.
- Export the zone file (or screenshot every record) before any change
- Write one line per change: date, who, which record, why
- Never delete a TXT or CNAME record without knowing what it does; many are SPF, DKIM or verification records
- After a website move, check that email still works before you close the job
- Lower the TTL a day before a planned switch, then raise it again afterwards
Our guide on connecting a domain to a new website without breaking email walks through the safe order of changes.
Security settings: registrar lock, registry lock and DNSSEC
Registrar lock (clientTransferProhibited) stops anyone moving the domain to another registrar without first unlocking it. Leave it on unless you are transferring. For .sg names, SGNIC also offers RegistryLock, a registry-level lock aimed at preventing domain hijacking, worth considering for a brand you cannot afford to lose.
DNSSEC signs your DNS answers so resolvers can detect forged responses. Cloudflare's DNSSEC guide shows the two steps: enable it at the DNS host, then add the DS record at the registrar. It is worth having, but it adds a trap: if you later change DNS host without turning DNSSEC off first, your domain can stop resolving. Note it in your change log so the next person knows.
Do it yourself or get help?
If your domain is already in the company's name with auto-renew on, managing DNS yourself is reasonable. Use member roles, keep a change log and check email after every change. Set expiry alerts too; our guide on what to do when a domain expires shows how fast things break.
If the domain is in someone else's name, renewal is on a personal card, or nobody knows where DNS is hosted, it is worth having it sorted once. Our Domain & DNS Setup (S$99) registers or transfers the domain into your name, sets the records for website and email, checks HTTPS and turns on auto-renew. Registrar fees are paid by you directly to the registrar.
Frequently asked questions
No. The domain should be registered in your company's name, in an account the company controls. A designer can manage it through their own login with limited access. If the designer is the registrant, they legally hold the domain and you depend on them for renewals, changes and any move to a new provider.
Both work. Registrar DNS is simplest for a small firm with one website and one email service. Cloudflare's free DNS adds fast updates, member roles and audit logs, which helps when several people or providers make changes. The key point is that the company owns whichever account holds the DNS.
Invite them as a separate member with their own email address and a limited role, such as a DNS-only role, rather than sharing the owner password. Keep MFA on the owner account. When the work ends, remove the member. Check the audit log, if your provider has one, after any change.
It is useful but not urgent for most small firms. DNSSEC protects against forged DNS answers, but it must be set up at both the DNS host and the registrar, and it must be turned off before changing DNS host. Turn it on once your DNS is stable and documented, and record it in your notes.
The domain expires, and after a short period the website and email stop working. Most registrars offer a grace period to renew at the normal price, followed by a redemption period at a higher fee. Keep auto-renew on with a valid company card and set a calendar reminder a month before the renewal date.