Ownership
- The registrant is the organisation, not an individual. See who should be the registrant.
- Registrant details are accurate and match the organisation’s legal name.
Access
- At least two people can log in to the registrar account.
- Two-factor authentication is on for the registrar account and for Nominet Online Services (The UK Domain).
- The contact email is a role inbox the organisation controls.
- Access is removed promptly when a trustee, volunteer or supplier leaves.
Renewals
- Auto-renew on, payment card current, renewal date in the trustees’ calendar. See renewals and expiry.
Records
- A note of the registrar, expiry date, who has access, where DNS is managed, and the current DNS records for email and website.
- Your web designer or IT volunteer’s responsibilities written down.
If something goes wrong
The Charity Commission’s guidance on cyber crime says trustees should decide what their expectations are on preventing cyber crime, and points small charities to the NCSC’s free Cyber Action Toolkit. The NCSC’s small organisations guide covers securing email and important online accounts, which includes your registrar account.
- Know how to contact your registrar quickly.
- Know who will contact the bank if a payment was made.
- Report live cyber attacks to Report Fraud on 0300 123 2040, the number given in the Charity Commission guidance (checked 20 October 2026).
Questions people ask
Who in a charity should be responsible for the domain?
Trustees are collectively responsible for protecting the charity’s assets, but it helps to name one trustee to own the checklist and a second with access as backup.
Is two-factor authentication really necessary?
It’s one of the simplest protections for important online accounts. Nominet offers it for Online Services accounts and recommends authenticator apps.
Related guides
Who should be the registrant?
Why a charity’s domain should be registered to the organisation, not a volunteer, and how to set it up properly.
Renewals and expiry
How .UK renewals work, the expiry timeline, and how to make sure your charity never loses its domain.
Fake renewal notices & scams
How to spot fake domain renewal invoices, misleading offers and spoof ‘Nominet’ emails, and what to do.
Moving or transferring a domain
Switching registrar versus changing the registrant: the two different ‘transfers’, and how each works for .UK domains.