Lost access to your domain account: recovery steps

If you are locked out of the account that holds your domain, start with the registrar's own password reset, then its account recovery process, which usually means proving who you are with photo ID and details only the real owner would know. Most registrars can restore access within a few days when the domain is in your name. The two things to watch while you wait are the renewal date, so the domain does not expire, and any email that runs on the domain, because it may be the very address the registrar is trying to reach you at.

First, be sure which account you need

Owners often try the wrong company. The account that holds the domain is at the registrar, which may not be the company that hosts your website. Look your domain up at lookup.icann.org and note the registrar name and the expiry date. If you bought the domain through a website builder or your web host, the account is probably with them instead; how to find where your domain is registered explains how to tell.

Step 1: Try the easy routes properly

It sounds obvious, but a careful pass here solves a lot of lockouts:

Use "forgot password" with every email address you have ever used, including old ones from a previous internet provider (like an old Comcast or AOL address) and your personal Gmail.
Try "forgot username" or "forgot customer number" if the registrar signs people in with a number. GoDaddy, for example, accepts a customer number as well as an email.
Check spam folders for the reset email, and wait ten minutes before trying again. Several resets in a row can lock the account for a while.
Look in your browser's saved passwords. On a computer you used years ago, the login may still be stored.

Step 2: The trap where the reset goes to your own domain

A very common lockout: the account's contact email is on the domain itself, such as [email protected]. If that email has stopped working, for example because the hosting that ran it was cancelled, the reset email can never reach you.

Ways around it:

Get the email working first, if you can. If your DNS is managed somewhere you can still log in (Cloudflare, or a host), you may be able to point the mail back at a working mailbox and receive the reset.
Ask for a change of account email. Registrars have a process for this, which is Step 3.

Step 3: Ask the registrar for account recovery

Call or chat with the registrar's support and say you are the domain's owner and have lost access to the account. Ask for their account recovery or "change of account holder" process. Expect to provide some of these:

A copy of a government photo ID matching the name on the account or the domain's registrant record.
For a business, documents showing the business name: formation papers, a DBA certificate, an IRS letter with your EIN, or a recent utility bill.
The last four digits of the card used for past payments, or a copy of a statement showing a charge from the registrar.
The domain's original registration date or a past order number, from old receipts.
Sometimes a signed form, occasionally notarized, especially for higher-value domains.

They will then reset the account email to an address you can reach. This often takes a few business days. Ask for a ticket or case number and the name of whoever is handling it.

If you set up two-step sign-in (a code on your phone as well as the password) and lost or replaced the phone:

Look for the backup codes you were given when you turned it on. People print them or save them in a password manager.
If you used an authenticator app, check whether it was synced to a new phone through your phone account.
Otherwise, the registrar's recovery process is the same as above, usually with extra identity checks. That is a good sign: it is the same protection that stops a stranger from taking your domain.

Keep the domain alive while you wait

An expired domain is far harder to recover than a locked account. While recovery is in progress:

Note the expiry date from the lookup.
Ask support whether you can pay the renewal without signing in. Some registrars can take payment on the phone once you have proved enough.
If the date passes, most .com domains go into a grace period, then a redemption period with a higher fee, before release. Do not let it get that far. What happens if your domain expires lays out those stages.

Your website and email keep working during recovery, as long as the domain has not expired and nobody changes its settings.

When the account is not in your name

Recovery processes only work for the person or business the registrar sees as owner. If the account was opened by a web designer, a former employee or a relative, you need their help or the registrar's ownership dispute process instead. That is a different path, covered in what to do when a domain is registered in an old employee's name.

Once you are back in

Do these straight away, while you are signed in:

Change the password to a long, unique one and store it in a password manager.
Set the account email to one that is not on the same domain, such as a Gmail address kept for business admin, and add a backup email or phone number.
Turn on two-step sign-in and save the backup codes somewhere safe and separate.
Turn on auto-renew and check the card on file has not expired.
Confirm the domain's registrant details show your business's name.
Check the domain lock is on, so nobody can move it away without your approval.
Write the registrar, login email and expiry date in your business records.

The short version

Reset with every email you have ever used.
Watch for the reset going to a dead address on your own domain.
Ask for formal account recovery with ID and business papers.
Keep the renewal paid.
Lock everything down once you are in.

With the domain back under your control, changing your website is a small step. If the site itself also needs work, you can see your site rebuilt first and point the domain at it whenever you are ready.