Chapter 3

The identity root and domain ownership

3.1 Learning objectives

Understand why legal identity is the "last anchor" that is hardest to lose.
Understand that a domain is a time-limited rental, not permanent property.
Check a domain's registrant information (whois) and know why it must match your identity documents.
Design the way back from identity → domain → email → every account.

3.2 Concepts

Legal identity

Identity documents (ID card, passport) are accepted by the state, banks and domain registrars to prove identity. They practically cannot be "account-locked" the way digital services can. That makes them the best candidate for the ROOT tier.

Domains and registrants

A domain is registered through a registrar and managed by a registry (for .vn, the Vietnamese national domain authority).
The person or organization named on it is the registrant. In a dispute or when a registrar account is lost, the right to reclaim the domain rests on the registrant record.
For country-code domains (like .vn), the registrant record is usually tied to an identity document or business licence. This is why a .vn domain suits the ROOT role: documents can prove ownership.

The way back

Lose the registrar account.
Use identity documents with the registrar, or transfer the domain to another registrar.
Re-point the domain's email records and recreate the mailbox.
Use that mailbox to recover the password manager and other accounts.

The biggest risk: domain expiry

If the domain expires and someone else registers it, the whole chain breaks and that person may receive your recovery emails. Renewal is a security task, not an administrative chore.

3.3 Worked example

Mr. A owns 10 domains: 4 ending in .vn and .com.vn, and 6 international ones. Mr. A builds an inventory:

Domain	Registrar	Registrant matches ID?	Expires	Auto-renew	Transfer lock	Role
example.vn	Registrar X	Yes	2031	Yes	Yes	ROOT, recovery email
example.com.vn	Registrar X	Not checked	2027	No	Unclear	Website
example.com	Registrar Y	Yes (whois privacy)	2028	Yes	Yes	Work email
example-shop.net	Registrar Y	***	2026	No	No	No longer used

Mr. A finds that example.com.vn's registrant has not been checked, and example-shop.net is about to expire but is no longer used, so he must decide whether to drop or keep it (if it was ever used as a sign-up email for other services, keep it so nobody else can receive the old email).

3.4 Common mistakes

Having someone else (a friend, a web design agency) register the domain in their name for you.
The contact email in the domain record is on that same domain.
Renewing the ROOT domain one year at a time, without auto-renew, with an expired payment card.
Dropping an old domain that was used as the login email for other services.
Not knowing how many domains you have and at which registrars.

3.5 Checklist

I have an inventory of all domains: registrar, registrant, expiry date, role.
The ROOT domain is registered in my own name, with details matching my documents.
The ROOT domain is renewed long-term (several years) with auto-renew on.
Renewal reminder emails go to a mailbox not hosted on that same domain.
Original identity documents are stored safely; scans are not left openly in the cloud.

3.6 Exercises

Look up the whois of your domain (or a sample domain). Is the registrant information correct?
Write a scenario: "My registrar account is locked; what do I do within 48 hours?".
List the domains expiring in the next 12 months and decide keep/drop for each.

3.7 Summary

Legal identity is the last anchor; a domain in your own name turns identity into control of your email.
A domain is a rental: manage renewal, registrant and transfer lock.
Renewing the ROOT domain is a security task.

I have finished this section