Should Your Domain, Email and Hosting Live in One Place?
You already have all three. The domain came from whoever built the first site, the email was set up by a nephew who was good with computers, and the hosting is a charge on a card you stopped looking at. Nothing is broken. So the question is whether any of it is worth an afternoon.
Three Things, Usually Three Vendors
Most small businesses have never chosen this arrangement. It accumulated. Each piece was set up by whoever was around at the time, and the seams only show on the day something stops working.
One question matters more than where things live.
Whose name is on the domain?
Putting your domain, email and hosting with one company is a convenience decision, not a safety one. It saves you from three vendors blaming each other when something breaks. What actually protects your business is having the domain registered in your own name and transferable on request, and that is true whether you use one vendor or four.
Internet Crafters sells all three. For plenty of Tucson businesses the right move is still to leave everything where it is and go find out who the registrant is.
What Are the Pieces You Actually Own?
Three things get bought and four have to work. Most owners can name two of them, because the pieces arrive at different times from different companies, which is how a business ends up unable to say where its own website lives.
They fail differently. Only one is unrecoverable.
The domain is the one to care about. Hosting can be moved in an afternoon and mailboxes can be rebuilt, but a name that lapses and gets picked up by somebody else is gone, and every business card you printed points at it.
What Breaks When Three Companies Hold Three Pieces?
Nothing, until one of them changes something. Then you have a website that loads and email that does not, three support queues, and each company able to say truthfully that their part is working. The problem lives in the gaps between vendors, and nobody owns a gap.
Imagine a Tucson landscaper whose mail stops arriving the week the monsoon finally breaks and everyone wants their yard cleaned up. The host says the site is fine, which it is. The email provider says the records are wrong, which they are. The records live at the registrar, and the registrar account is in the name of a developer who stopped answering in 2019.
Nobody in that chain is lying and nobody can fix it. Four questions get you out of it, and they are worth answering on a quiet afternoon rather than a loud one.
Whose name is on the domain?
Not who pays for it. Who is listed as the registrant. If a developer registered it on their own account years ago, the business does not control its own name and usually finds out at the worst possible moment.
What email address gets the renewal notice?
Domains expire. If the notice goes to an address nobody reads, or to someone who left in 2021, the first sign of trouble is the website going dark.
Where do the DNS records actually live?
Sometimes at the registrar, sometimes at the host, sometimes at a third company somebody used once. The answer decides who you call when mail stops arriving.
Can you move it without permission?
A registrar has to unlock a domain and give you the transfer code on request. That is ICANN policy, not a favour.
The question is not where your domain lives. It is whose name is on it.
Everything else is a convenience decision you can reverse in a week.
Do You Need PHP Hosting, or Will a Static Site Do?
You need PHP hosting if your site runs WordPress or anything like it: a dashboard you publish from daily, customer logins, a store with inventory. You do not need it for a site that describes what you do, where you are, and how to reach you. That kind of site is files, and files are cheaper and harder to break.
Internet Crafters builds the second kind, and we now host both. We have written elsewhere about when a CMS earns its keep, and the short version is that a few businesses genuinely need one and get talked out of it, while many more are carrying one they never use.
The distinction matters here because PHP hosting comes with a standing obligation that static hosting does not.
Why Does Business Email Need Records on Your Domain?
Because receiving mail providers check whether you are allowed to send as your own domain, and the proof lives in DNS records on that domain. Google has required every sender to have SPF or DKIM configured since 1 February 2024, and senders pushing more than 5,000 messages a day need both plus DMARC. Get them wrong and your quotes land in spam.
This is the part that surprises owners. Email feels like a product you buy, and the half that decides whether anyone receives it sits with the domain, which is often at a different company entirely.
It is also why the address on your van matters more than it looks. A quote from a free consumer address and the same quote from your own domain are read differently, and the second one is the one that survives a spam filter set up by somebody cautious.
Not sure who holds your domain?
Send us the name and we will read what is public on it, tell you who the registrant is, and say plainly whether anything needs doing. No charge and no obligation to move it anywhere.
What Does It Cost to Keep WordPress Patched?
Time, or money, and there is no third option. WordPress powers a large share of the web, and the plugins are where the holes are. A site nobody updates is not holding steady. Every month it sits, more of what is wrong with it is public.
These numbers explain why hosting a CMS costs more than hosting files.
11,334
New vulnerabilities found in the WordPress ecosystem in 2025, a 42% increase over 2024, per Patchstack's State of WordPress Security in 2026.
91%
Share of those found in plugins rather than WordPress itself. Six were in the core, all rated low priority. Same Patchstack report.
5 hours
Weighted median time between a vulnerability being disclosed and the first exploitation attempt, per Patchstack. Nearly half of high-impact flaws are attacked within a day.
$3.05B
Losses to business email compromise reported to the FBI in 2025, across 24,768 complaints. Second only to investment fraud, per the FBI's 2025 Internet Crime Report.
Five hours is the weighted median gap between a flaw becoming public and somebody trying it. A monthly maintenance window does not cover that.
The email number sits alongside it. Business email compromise cost reported victims more than $3 billion in 2025 across 24,768 complaints, and the FBI ranks it second only to investment fraud.
A site nobody updates is not sitting still. It is drifting toward the day it gets found.
Patching is the rent on running WordPress, and somebody has to pay it.
Is Putting Everything With One Company Risky?
Less than people think, and for a different reason than they expect. The fear is that one vendor holds everything and you are stuck. The actual failure is a vendor holding the domain in their own name, which can happen with one vendor or with four, and is the thing to check either way.
There were 392.5 million domain names registered worldwide at the end of the first quarter of 2026, according to Verisign's Domain Name Industry Brief. Some unknown slice of them are registered to somebody other than the business using them.
What one vendor actually fixes
- • One phone call instead of three companies each blaming the other two
- • The records get set correctly the first time, by whoever knows where the site lives
- • Renewals land on one bill you actually recognise
- • Somebody has the whole picture when mail stops arriving on a Friday
What it does not fix
- • A bad vendor is now a bad vendor holding everything
- • Consolidation on its own says nothing about who owns the domain
- • Moving becomes one project rather than three small ones
- • You still need to know your own renewal date, whoever bills you
We register domains in the client's name, with the client's email on the record, and we unlock and hand over the transfer code whenever it is asked for. That is not generosity. Under ICANN's transfer policy it is what a registrar is supposed to do, and a vendor treating it as a negotiation is telling you what kind of vendor they are.
What Should a Tucson Business Actually Do About This?
Find out who the registrant is. That is the whole first step. For most businesses it is also the last one, because the answer turns out to be fine and the scattered arrangement keeps working.
If the answer is somebody you have lost touch with, fixing it is worth doing while that person still answers email. We have written about getting a domain back when a developer vanishes, and the recovery gets harder the longer it waits.
Consolidating is a separate decision and a smaller one. It is worth it if you are tired of not knowing who to call, and it is not worth much if you have a setup you understand. Our domains, email and hosting pages spell out what each one covers, and what hosting actually costs covers the money side without our thumb on the scale.
Internet Crafters is in Tucson and most of the businesses we work with are too. If you would rather start with the website than the plumbing behind it, our Tucson web design page is the place to begin, and the domain question will still be there afterward.
Straight Answers
What Owners Ask First
The questions that come up whenever somebody finally looks at where their domain lives.
Who should be listed as the owner of my business domain?
Your business, with an email address somebody at the business reads. Whoever manages the domain can be listed separately as a technical contact. Paying the invoice does not make you the registrant, and the two come apart more often than owners expect.
What happens if my domain expires by accident?
The website and the email both stop, because email records live on the domain. There is a grace period to renew at most registrars, after which the name can be registered by anybody. This is the most common way a small business loses its web presence.
Do I need PHP hosting or will a static site do?
If you need a dashboard to publish daily, accounts customers log into, or a store with inventory, you need PHP hosting and something like WordPress. A site describing your services and how to reach you does not, and runs faster and safer without one.
Why does my business email keep landing in spam?
Usually the authentication records on your domain. Since February 2024 Google requires every sender to have SPF or DKIM set up on the sending domain, and bulk senders need both plus DMARC. These are invisible until they are wrong.
Is it risky to buy everything from one company?
Less risky than most people assume, as long as the domain is registered in your name and transferable on request. The real exposure is a vendor holding the domain in their own name, and that risk exists whether you use one vendor or four.
Can I move my domain away later if I change my mind?
Yes. Under ICANN's transfer policy a registrar unlocks the domain and provides the authorization code when the registrant asks. Transfers sit through a mandatory waiting period, so start one before you need it finished.
Find out who owns your domain before you need to know.
Internet Crafters sells domains, business email and hosting for Tucson and Southern Arizona businesses, and registers every domain in the client's own name. Send us a domain and we will tell you what the public record says about it.
If the answer is that everything is fine where it is, that is what we will tell you.
Written by Steve Bullis
Steve Bullis is the founder of Internet Crafters, a Tucson web studio building flat-rate websites for local businesses.
Sources
FBI Internet Crime Complaint Center - 2025 Internet Crime Report
ic3.gov
Patchstack - State of WordPress Security in 2026
patchstack.com
Google Workspace Admin Help - Email sender guidelines
support.google.com
ICANN - Transfer Policy
icann.org
Verisign - Domain Name Industry Brief, Q1 2026
blog.verisign.com
External links open in a new tab. Internet Crafters has no affiliation with these publications.