A client calls on a Monday morning. The website was rebuilt over the weekend — looked great on Friday. Now nobody can receive email. The new agency is baffled. The old agency isn’t returning calls. The business owner has no idea who registered the domain, where the hosting lives, or who set up the email in the first place.
This happens constantly. Not because websites are complicated, but because nobody tells business owners that a website is actually four separate services sharing one name. The domain, the DNS, the hosting, and the email are independent layers. They can be managed by different companies, break independently of each other, and get lost one piece at a time — without you noticing until something stops working.
Here’s how each layer works, how they connect, and what you need to know to stay in control of your own website.
Four services, one name
Think of your website like a physical business address. The street address is the domain. The postal routing system that gets mail to you is the DNS. The building where you actually operate is the hosting. And the letterbox next to the door is the email. Same address on the sign, four different systems doing four different jobs.
These layers can be — and often are — managed by completely different companies. Your domain might be registered with one provider, your DNS handled by a second, your website hosted by a third, and your email running through Google or Microsoft. That separation is useful when everything is documented. When it isn’t, it’s a mess waiting to happen.
The domain: your address on the sign
A domain name is the human-readable label you type into a browser. Computers find each other using numerical IP addresses, and the entire domain system exists so humans don’t have to memorise strings of numbers. You don’t actually buy a domain outright — you lease the right to use it, typically for one or more years at a time, with the option to renew. Stop renewing and someone else can register it.
Worth being clear on: a domain and a URL are not the same thing. A URL like https://www.yourbusiness.se/services contains a protocol, a subdomain, the domain itself, and a path to a specific page. The domain is just one piece of every URL on your site.
The companies you pay to register a domain are called registrars. In Sweden, common options include Loopia, One.com, and Binero. Internationally, GoDaddy, Namecheap, and Cloudflare Registrar are widely used. Behind the registrars sit registries — Internetstiftelsen runs .se, Verisign runs .com — and above them all, ICANN coordinates the system globally.
According to the Domain Name Industry Brief for Q4 2025, there were 386.9 million registered domains worldwide, up 6.2% year on year. The report is published by Verisign, which also operates .com, but it is the established industry census. A significant portion of those domains go dark every year — not because businesses close, but because renewal notices went to an email address nobody monitors any more. The most common cause is a domain registered years ago using a former employee’s personal email, or a freelancer’s address that nobody thought to update. Use a permanent business email as the registrar contact, enable auto-renewal, and make sure the domain is registered in your company’s legal name.
DNS: the system that connects everything
DNS, the Domain Name System, translates the domain name a human types into the IP address a computer needs. A useful analogy is the postal sorting system: letters addressed to a specific street, city, and country get routed correctly because the postal network reads the address step by step. DNS works the same way, narrowing down from root servers to the registry to the specific records for your domain — all in milliseconds.
DNS does more than just translate names. The zone file for your domain contains different record types, each doing a specific job. The A record points your domain to your web server’s IP address. CNAME records create aliases, so www.yourbusiness.se can point to yourbusiness.se. MX records route incoming email to the correct mail server. TXT records carry text used for verification and email authentication.
One thing that confuses almost everyone: registering a domain and hosting its DNS are separate jobs that can be done by different companies. Your registrar controls which nameservers are authoritative for your domain. Whichever provider those nameservers point to is your DNS host — it could be the same registrar, your web host, or a specialist like Cloudflare. Changing nameservers moves the entire DNS zone to a different company. Changing a single record just edits one entry inside whichever company is currently in charge.
DNS changes also don’t take effect instantly. Every record carries a TTL (time-to-live) value telling other servers how long to cache the answer. A typical TTL means the world can see your old record for an hour after you change it; nameserver changes can take up to 48 hours. Before any planned migration, lowering TTLs to 300 seconds a day in advance means the switch happens in minutes rather than days.
Web hosting: where your website actually lives
Web hosting is renting space on a computer that’s permanently switched on, connected to the internet, and configured to send your website files to anyone who requests them. Without it, your website is just files on a hard drive that nobody else can reach.
Hosting choice has a direct impact on your visitors. In Google’s review of 900,000 mobile landing pages across 126 countries, the probability of a visitor leaving rose 32% when load time went from one to three seconds, and 90% from one to five. Worth knowing that the dataset is advertising landing pages rather than the web at large — but the direction is hard to miss, and the first few seconds decide a great deal. Cheap shared hosting puts hundreds of sites on one server and can slow significantly during busy periods. Managed WordPress hosting (from providers like Kinsta, SiteGround, or Swedish options like Oderland) is optimised specifically for WordPress, includes caching and security, and is the right default for any business taking its website seriously.
For Swedish businesses, there’s also a practical argument for choosing a Swedish or EU data centre. Pages load faster for local visitors, and keeping data on EU infrastructure simplifies GDPR compliance. Loopia, Oderland, GleSYS, and Miss Hosting all run servers in Sweden.
SSL: the encryption behind https
SSL is the encryption layer that turns http:// into https://. It encrypts data in transit, verifies to the visitor that they’ve reached your actual site, and confirms that data hasn’t been tampered with along the way. SSL stands for Secure Sockets Layer, though the current version of the technology is called TLS. Everyone still calls it SSL.
If you learned to look for the padlock in the address bar, it’s worth knowing that it’s gone. Chrome replaced the icon in version 117 in September 2023, and the reason Google gave was that only 11% of participants in its own research understood what the padlock actually meant. A padlock never meant the business behind the site could be trusted, only that the traffic was encrypted. Firefox and Safari still show a lock, but what to check today is that the address starts with https and that the browser isn’t warning you about anything.
Google confirmed HTTPS as a ranking signal back in August 2014, and Chrome has marked HTTP-only sites as “Not secure” since 2018. Now it goes a step further: Google announced on 28 October 2025 that Chrome will ask the user for permission before loading a public page without HTTPS. The setting was switched on for Enhanced Safe Browsing users in Chrome 147 in April 2026, and becomes the default for everyone in Chrome 154 in October 2026. A site still running plain HTTP will greet its visitors with a warning before any content renders. For any site handling contact forms, bookings, or payments, HTTPS isn’t optional.
The good news is that this layer is now largely automatic with decent hosting. Let’s Encrypt, a non-profit certificate authority, issues free certificates and is closing in on a billion protected websites — since late 2025 it has been issuing more than ten million certificates a day. Every reputable Swedish host offers it with one-click setup and automatic renewal.
The main failure mode worth watching for is a manually purchased certificate that nobody remembers to renew, and that risk is about to grow considerably. The CA/Browser Forum, where the certificate authorities and browser makers sit together, voted in April 2025 to shorten the maximum TLS certificate lifetime in stages: from 398 days to 200 days as of 15 March 2026, to 100 days during 2027, and to 47 days in 2029. A certificate renewed once a year today will need renewing roughly eight times a year. Manual handling simply stops being practical, which makes automatic renewal the only workable option rather than merely the convenient one.
Email: a separate mailbox at the same address
The most useful shift in thinking about email: it’s a completely different service from web hosting that just happens to share your domain name. Your domain is the address on your sign. Your website is the storefront. Your email is the letterbox next to the door. Same address, separate infrastructure, often a separate company.
Sending quotes from a free gmail.com address rather than one on your own domain is one of the cheapest unforced errors a small business can make. Beyond how it looks, there are two concrete reasons. The first is that you cannot authenticate mail sent from somebody else’s domain — the SPF, DKIM and DMARC records below belong to your domain, not Google’s. The second is that the address isn’t yours: change provider, or have the account closed, and it doesn’t come with you. An address on your own domain moves wherever you go.
Most SMEs land on one of two setups. Google Workspace puts Gmail on your custom domain. Microsoft 365 does the same with Outlook, plus Teams and Office — the natural fit for organisations already in the Microsoft ecosystem.
The connection to DNS is where things get dangerous. Email routing is controlled by MX records in your DNS zone. SPF and DKIM records authenticate outgoing mail, and DMARC ties the whole system together with a policy for handling unauthenticated messages. Since February 2024, Gmail and Yahoo impose requirements on every sender: at least SPF or DKIM must be in place, or the mail risks being filtered as spam or rejected outright. Anyone sending more than 5,000 messages a day needs all three. So the baseline applies to small businesses too. When a web agency switches your nameservers to push a new site live, all of those records can disappear in the process. Email loss during a DNS migration is well-documented and entirely avoidable if the records are exported before the switch.
The “who controls what” problem
The real risk for most small businesses isn’t technical failure. It’s having no idea who controls each layer when something breaks.
The classic scenario: a freelancer builds a website, registers the domain in their own name, sets up hosting on their account, and configures email through their cPanel. They go quiet a couple of years later. Nobody at the business has login credentials for any of it. When the domain expires, it gets picked up by a reseller and recovery becomes expensive and slow. The business loses a week of email and a stretch of Google search visibility in the process.
The fix isn’t complicated, but it does require sitting down for an hour. Know which company holds your domain, who runs your DNS, where the website is hosted, and where your email lives. Store the logins for each in a password manager owned by the business, not an agency. Use a permanent business email as the registrar contact. Enable auto-renewal. Make sure the domain is registered in your company’s legal name.
If you’re not sure who controls your domain right now, you can look up the public registration data with ICANN’s Lookup tool. What you find there — registrar, expiry date, and nameservers — tells you most of what you need. If you would rather someone else kept an eye on the layers for you, that is exactly what hosting and maintenance is for.
Frequently asked questions
Can my domain and hosting be with different companies?
Yes, and they often are. Your domain registrar, DNS host, web host, and email host can all be separate providers. The system is designed to work this way. What matters is that someone keeps track of which company handles each layer and holds access to each account.
What happens if my domain expires?
Most registrars offer a grace period of around 30 days where you can still renew. After that, the domain enters a redemption period where recovery becomes expensive. After that, it’s released for anyone else to register. The simplest prevention is auto-renewal with a current credit card and a company email as the contact address.
Why did my email stop working after my website was moved?
Almost certainly because the hosting migration switched your nameservers, which erased your existing MX, SPF, and DKIM records. Whoever handled the migration needed to export all DNS records first and rebuild them at the new provider. If this happened to you, the records can usually be restored — but any mail sent during the outage is gone.
Do I need to pay for an SSL certificate?
For most small businesses, no. Free certificates from Let’s Encrypt are trusted by all major browsers, renew automatically, and are included with every decent hosting plan. Paid certificates offer no practical advantage for a standard business website.
If you’re not sure who owns your domain, which company runs your DNS, or whether your email is set up correctly — it’s worth finding out before something breaks. Get in touch and we’ll run through it with you.