A company website rests on two things you rent: the domain, which is the address people type, and the hosting, which is the server the site runs on. Both are cheap and quick to buy, so they usually get bought in a hurry, often by whoever happens to be building the site. The trouble comes years later. The web studio has closed, the freelancer doesn't answer, the renewal notice went to a mailbox nobody reads, and on paper the domain belongs to someone else.
All of this can be checked before you pay, and most of it takes minutes.
Who runs .md
The .md domain is run by the public institution "Serviciul Tehnologia Informației și Securitate Cibernetică" (STISC), Moldova's national registrar. IANA's root database lists it as the manager of .md. You register a name on nic.md, either directly or through one of the dealers the registry has accredited.
The current rules are the "Rules for registering subdomain names in the .md top-level domain", approved by STISC order no. 301 of 10 October 2023 and applied since 10 November 2023. Three points in them matter to a business:
- Anyone can register a .md name, company or individual, resident of Moldova or not, first come, first served, for at least one year. You don't need an office or an address in the country.
- Once registered, a name can't be changed. Change one letter and it's a different domain with a new registration, and the fee you paid isn't refunded.
- Registration gives you the right to use the name. It gives you no rights over a trademark, and if the name is close to someone else's brand, the responsibility is yours.
Put the domain in the company's name
One line in the rules decides who the domain really belongs to. The person listed as the administrative contact is presumed to be the holder for the whole registration period, and for a company that contact has to be the director or an employee the company has delegated. If a web studio or a freelancer registered your domain under their own name or their own email, on paper they are the ones holding it.
You can check this yourself in a minute. The WHOIS service on nic.md shows, for a domain held by a company, the company's name, its IDNO, the country, the registration and expiry dates and the name servers. For a domain held by a person it shows only the country, the dates and the name servers. If you look up your domain and your company's name and IDNO aren't there, the domain isn't registered to the company.
The registry's FAQ on nic.md even answers the question of an employee who leaves and takes the domain along: keep permanent control of your nic.md account and of the email address listed as the administrative contact. In practice that means:
- the account on nic.md (or with the dealer) is opened for the company, and the password is in the company's password manager rather than in one person's head (more on that in our article on company passwords);
- the administrative contact uses an address the company controls, preferably a shared one rather than someone's personal mailbox;
- the billing contact, which also gets the notices, uses a different address. Our own suggestion is to keep one of the two outside the domain itself: if the domain lapses, the mail on it stops too.
What happens when a .md domain expires
The registry sends a notice to the administrative contact 30 days before the expiry date. After that date the domain enters a 30-day grace period:
- For 5 days the domain keeps working.
- For the next 25 days it's inactive, so the site and the email on that domain stop working. Only the current holder can renew it, and it can't be transferred.
- If nobody has paid by the end of the grace period, the domain is deleted and anyone can register it, first come, first served.
The registry processes bank transfers by hand, on the following working days. The rules recommend paying at least three banking days before the reservation or grace period ends.
The rules describe renewal as generating a payment note in your nic.md account and paying it. If you bought through a dealer, ask whether the domain renews automatically and from which card. Either way, put the expiry date in the company calendar six weeks ahead.
Moving a domain to another holder
A transfer starts from the account on nic.md. The transfer code goes to the administrative contact's email and is valid for 72 hours. The expiry date doesn't change with the transfer. An expired domain, or one under dispute, can't be transferred at all.
So if the administrative contact is still the freelancer who built your old site, the code goes to the freelancer. Fix the contact details now, while everyone is still on good terms.
DNS: who can change the records
The name servers for a .md domain are set in the nic.md account. The records themselves, the ones that send the domain to your site and your mail to your mailbox, live wherever those name servers point: at the hosting provider or at a separate DNS service.
Find out who has the login there. Whoever can edit your DNS can send your site and your email anywhere they like.
What to ask the hosting provider
Before paying for hosting, get an answer to each of these:
- Where are the servers? Ask for the country and the data centre. It affects how fast the site loads for visitors in Moldova and where the data people send through your forms ends up.
- How are backups done? How often, where they are kept, for how long, and whether you can restore one yourself. A copy the host keeps on the same server isn't enough on its own; see the 3-2-1 rule.
- Which PHP versions are available, and can you choose? According to php.net, 8.1 and older no longer get security fixes, so a host that still puts new sites on 8.1 is a bad sign. Why that matters is in our article on website maintenance.
- Is the HTTPS certificate included, and does it renew by itself?
- Is email on the domain part of the hosting or a separate service, and who sets up SPF, DKIM and DMARC? Without them company mail lands in spam, as we explained in the article on why company emails end up in spam.
- Can you download all the site's files and its database at any time, without asking anyone?
A list to keep
- The WHOIS on nic.md shows your company's name and IDNO.
- The company has the login to the nic.md account, or to the dealer's.
- The administrative contact is an address the company controls.
- The expiry date is in the calendar and one person knows it's theirs to watch.
- You know who can change the DNS records, and the company has that login too.
- The hosting has backups, a supported PHP version, automatic HTTPS and email set up with SPF, DKIM and DMARC.
On the sites we build, the domain is registered in the client's name; more on website development. If you'd like us to check whose name your company's domain is in today, write to us.