You have access to the domain (and a webserver and a certificate)... or you are using a third-party service and you are trusting them with managing your identity.

And I would say most of the time it will be the former option.