In digital marketing, web design, and managed IT services, few situations turn ugly as fast as a client-agency offboarding that goes wrong.
A client decides to move to a new provider or bring their marketing in-house. They ask for access to their website, DNS records, and domain portfolio. The agency replies with an invoice for “transition fees.” Or it points out that the domain sits inside the agency’s master GoDaddy, Namecheap, or Cloudflare account, so the client has no account to log in to. A routine vendor transition becomes a dispute over digital custody.
The root cause is usually confusion between technical administrative access and registrar account ownership. Being able to edit DNS records does not make an agency the owner of a domain. And paying a monthly retainer does not mean the client controls the account where the domain actually lives.
This audit framework explains how the two differ, how to check where your domains actually sit, and how to structure agency-client access so nobody can be held hostage.
Technical Admin Rights vs. Account Ownership
Domain governance mixes two layers that are easy to blur: who is named as the registrant and who controls the registrar account.
A domain registration is not a deed to physical property. It is a registration held through an ICANN-accredited registrar, recorded at the registry (Verisign operates .com), and governed by the registrar’s terms and ICANN policy. Whether that registration counts as “property” depends on the jurisdiction. The U.S. Ninth Circuit held in Kremen v. Cohen (2003) that a registrant has an intangible property right in a domain name, at least under California law. Other jurisdictions treat the question differently. Either way, practical control usually comes down to who can log in to the account the domain sits in.
+-----------------------------------------------------------------------------------+
| REGISTRAR ACCOUNT (OWNER) |
| - Controls account-level login, MFA, recovery email, and payment methods. |
| - Can unlock the domain and obtain the Transfer Authorization Code (TAC). |
+-----------------------------------------------------------------------------------+
|
+-------------------------+-------------------------+
| |
v v
+-------------------------------------+ +-------------------------------------+
| REGISTRANT (ON RECORD) | | DELEGATED / TECH ACCESS |
| - The person or organization | | - Edits DNS records (A/CNAME/MX). |
| named as holder of the domain. | | - Scope set by the account owner. |
| - The party ICANN policy treats | | - Can be revoked at any time. |
| as the Registered Name Holder. | | |
+-------------------------------------+ +-------------------------------------+
Contact Roles: What Still Exists
Domains historically listed four contacts: registrant, administrative, technical, and billing. That model is largely gone for generic TLDs such as .com.
- The Registrant (Registered Name Holder): The person or organization that holds the registration and is the contract party under ICANN’s policies. Under the ICANN Registration Data Policy, which took effect August 21, 2025, the registrant contact is the only contact universally required for gTLDs.
- Administrative, technical, and billing contacts: These are no longer part of the required data set. Many registrars have stopped collecting them for most gTLDs, and some registries still accept them. Where they exist, they are just designated people, such as an employee or a web developer. Being listed there conveys no ownership.
- Historical note: ICANN’s older Transfer Policy let either the registrant or the administrative contact (the “Transfer Contact”) authorize transfers. The Transfer Policy Review working group recommended replacing those references with “Registered Name Holder.” The ICANN Board adopted the review’s recommendations on June 7, 2026, and implementation is still to come.
The point of this audit is not to find a technical contact. It is to find out who controls the registrar account and who is listed as registrant. These are often two different parties.
The Core Conflict: Agency Master Account vs. Client-Owned Account
- Agency master account (high risk): The agency registers the client’s domain inside its own registrar account (for example, GoDaddy Pro or a Cloudflare account it owns). Even if the client is named as registrant, the agency holds the login, recovery email, and MFA device. To transfer the domain to a new registrar, the client needs a Transfer Authorization Code (TAC). The client can only get one through the account holder, so in practice the client needs the agency’s cooperation.
- Client-owned account with delegated access (best practice): The domain sits in a registrar account created under the client’s legal entity and a corporate email address. The agency is invited as a delegate or member with limited permissions, enough to edit DNS records without touching billing, recovery settings, or transfer controls.
Anatomy of a Domain Custody Battle
Most of these disputes do not start with bad intent. They start with onboarding shortcuts that nobody revisits.
┌─────────────────────────────────────────────────────────────────────────┐
│ CHRONOLOGY OF A CUSTODY FAILURE │
├─────────────────────────────────────────────────────────────────────────┤
│ 1. ONBOARDING SHORTCUT │
│ Agency registers the client's domain in its own master account │
│ to move faster on DNS setup. │
├─────────────────────────────────────────────────────────────────────────┤
│ 2. OPERATIONAL BLIND SPOT │
│ Client pays monthly invoices and assumes that covers ownership. │
│ No asset inventory records where the domain actually lives. │
├─────────────────────────────────────────────────────────────────────────┤
│ 3. RELATIONSHIP BREAKDOWN │
│ Client ends the engagement over performance or pricing. │
├─────────────────────────────────────────────────────────────────────────┤
│ 4. DEADLOCK │
│ Agency withholds the TAC or account handoff pending disputed fees. │
│ Client cannot move DNS, email, or the domain itself. │
└─────────────────────────────────────────────────────────────────────────┘
1. The Convenience Trap During Onboarding
When a non-technical client cannot find their old registrar login, the account manager says, “We’ll register it in our account for now and sort it out later.” Three years later the developer who set it up has left, the client’s marketing lead has changed, and the domain is still in the agency’s portfolio.
2. The Personal Employee Registration
A client employee registers a core brand domain using a personal email address or personal credit card. When that person leaves on bad terms, the business loses the password-reset emails, MFA codes, and renewal notices tied to that account.
3. The Reseller Trap
Many agencies resell domains through their own registrar or reseller accounts and invoice the client for renewals. A line item like “Domain Renewal – $25/yr” feels like proof of ownership, but it is not. If the agency disappears or a dispute arises, the registrar deals with its own account holder, and the client has no direct account relationship to rely on. GoDaddy’s complaint policy, for example, says it will not release customer or account information without the customer’s permission, and it acts on court orders, not on one party’s claim to a domain.
The “Who Holds the Keys?” Audit: Five Steps
Run this audit across your own and your clients’ portfolios.
┌────────────────────────────────────────────────────────────────────────┐
│ DOMAIN AUDIT FLOWCHART │
├────────────────────────────────────────────────────────────────────────┤
│ [Step 1: Registration data] ─> Identify registrar & visible registrant│
│ │ │
│ [Step 2: Account mapping] ──> Who owns the registrar login? │
│ │ │
│ [Step 3: MFA & recovery] ───> Where do resets and codes go? │
│ │ │
│ [Step 4: DNS & nameservers] > Who can change where the domain points? │
│ │ │
│ [Step 5: Contract review] ──> Does the MSA match technical reality? │
└────────────────────────────────────────────────────────────────────────┘
Step 1: Check Registration Data (RDAP)
WHOIS has been replaced by RDAP for generic TLDs. ICANN removed the requirement for gTLD registrars and most registries to run WHOIS on January 28, 2025, and ICANN’s own lookup tool at lookup.icann.org is RDAP-based.
-
What to check: The registrar of record, the creation and expiry dates, the EPP status codes (such as
clientTransferProhibited), and the nameservers. - Limitation: Registrant name, email, and phone are redacted by default for most gTLD domains, in RDAP as in WHOIS before it. The registrant field may therefore show nothing useful. You cannot rely on a public lookup to prove who the registrant is.
- What to do instead: Log in to the registrar account that holds the domain and read the registrant details there. Where you do not have access, ask the account holder to show you.
- Red flag: The registrant, where visible or shown in the account, names the agency instead of the client.
Step 2: Map the Registrar Account
Identify where the domain actually lives. It might be AWS Route 53, Cloudflare Registrar, GoDaddy, Namecheap, or Squarespace Domains (which took over Google Domains).
- What to check: Who owns the account’s primary login email? Is it a role-based client address or a person?
-
Red flag: The account email is an agency address (
ops@agency.com) or an ex-employee’s personal inbox.
Step 3: Audit MFA and Recovery Channels
- What to check: Where do password resets, SMS codes, and authenticator prompts go?
- Red flag: MFA is tied to one person’s personal phone, which makes that person a single point of failure.
Step 4: Audit Nameserver and DNS Control
Registration and DNS hosting are separate. The registrar holds the registration, while a DNS provider (often Cloudflare, Route 53, or the registrar itself) answers queries for the domain.
- What to check: Which nameservers does the domain use, and who administers that DNS account?
- Risk assessment: DNS control is powerful. Whoever can edit DNS can redirect the website, change MX records to reroute email, and add TXT records that can satisfy domain-validation checks. DNS access alone does not let someone transfer the domain, but it does let them take the site and the email offline or redirect them. Treat DNS access as sensitive even when the registrar account is safe.
Step 5: Review Contract Alignment
- What to check: Does the Master Services Agreement (MSA) state that domain names, DNS zone files, and related accounts belong to the client? Does it require the agency to cooperate with a transfer, and for how long?
- Red flag: The contract is silent, or it says the agency “manages” assets without saying who owns them.
Access Matrix: Who Can Do What
This matrix shows typical outcomes when the client owns the registrar account and delegates limited access. Exact permissions vary by provider and configuration.
| Action / Capability | Account Owner (Client) | Delegated Agency Access (typical) | Billing-Only User | DNS-Only Role |
|---|---|---|---|---|
| Obtain the Transfer Authorization Code (TAC) | Yes | Only if transfer permission is granted | No | No |
| Change account login, recovery email, MFA | Yes | No | No | No |
| Add or change payment methods | Yes | No | Varies | No |
| Edit A, CNAME, MX, TXT records | Yes | Yes | No | Yes |
| Change nameservers | Yes | Depends on permission level | No | Usually no |
| Renew or buy products | Yes | Depends on permission level | Varies | No |
Some platforms let you grant domain transfer permission to a delegate. GoDaddy, for example, lets you give delegates domain management actions, transfer actions, or both. Leave transfer permission off for an agency unless you intend to grant it.
Best Practices: Agency Access Without Sacrificing Ownership
Agencies need real technical access to do their jobs. Clients need legal and practical control over their core assets. Both are possible.
1. Put the Domain in a Client-Owned Account
- Rule: Register or transfer domains into a registrar account owned by the client’s legal entity.
-
Implementation: Create the account with a role-based mailbox, such as
domains@clientcompany.com, rather than an individual’s address. Keep at least two people at the client able to recover the account. The client holds the payment method and the root login.
2. Use Native Delegation Tools
Never share the root password. Use the provider’s delegation features instead.
- GoDaddy: Use Delegate Access. GoDaddy’s “Products & Domains” level lets a delegate use products and manage domains without making purchases or viewing payment details. For domains, you choose whether delegates can perform management actions, transfer actions, or both. Whatever the level, delegates cannot manage payment methods or invite other people to the account.
- Cloudflare: Invite the agency as an account member with a narrow role. Cloudflare’s DNS role can edit DNS records. The Super Administrator role can edit any setting, make purchases, update billing, and manage members, so reserve it for the client’s own staff. Cloudflare recommends keeping more than one Super Administrator so the account does not depend on one person.
-
AWS Route 53: Use a cross-account IAM role with a custom policy limited to the hosted zone actions the agency needs, such as changing record sets. Do not use the managed policy
AmazonRoute53FullAccessfor this purpose. AWS documents that it covers domain registration as well as health checks. For domain registration actions, AWS provides the separateAmazonRoute53DomainsFullAccesspolicy, which an agency should not need for DNS work.
3. Apply Transfer Locks and Consider Registry Lock
-
Registrar lock: Keep
clientTransferProhibitedenabled on production domains so a domain cannot be transferred without someone deliberately unlocking it. -
Registry Lock: For high-value
.com,.net,.cc, and.namedomains, Verisign offers Registry Lock through participating registrars. Changes to a locked domain require out-of-band verification between the registrar and Verisign, such as a phone call and a security phrase. Not every registrar offers it, and reporting in the domain industry has noted that GoDaddy does not offer it to customers. Ask your registrar directly before you rely on it.
4. Write Offboarding Into the MSA
Add a standard asset-handoff clause to every agency agreement. A sample, to adapt with your lawyer:
Digital Asset Handoff
- Ownership. All domain names, DNS zones, SSL/TLS certificates, and related accounts registered or managed for Client are the property of Client. Where any such asset is held in Agency’s account, Agency holds it on Client’s behalf.
- Access revocation. On notice of termination, Client may revoke Agency’s delegated access at any time.
- Transfer cooperation. Within five (5) business days of Client’s written request, Agency will provide the Transfer Authorization Code or move the asset into an account Client designates.
- No withholding. Agency will not withhold domain registrations, DNS records, or related credentials as leverage in a fee dispute. Fee disputes are resolved separately under this Agreement.
Emergency Remediation: Recovering a Trapped Domain
If a critical domain is stuck in an agency’s or a former employee’s account, work through these steps in order. Be realistic about each one. Registrars generally do not decide ownership disputes, so the fastest route is almost always cooperation, and the slowest is litigation.
- Document your claim. Gather payment records, invoices, the contract, incorporation documents, and any historical registration data showing your organization registered or paid for the domain. Note the registrar and the current nameservers.
- Send a formal written request. Address it to the agency’s leadership, not just your account manager. Ask for the TAC or a transfer of the domain into your account, and set a reasonable deadline. Refer to the MSA clause if there is one. A short, specific request often works where an angry email does not.
- Protect operations while you negotiate. If you control the DNS provider, you may be able to keep the site and email running. If the agency controls DNS, ask for a copy of the full zone file so you can rebuild it elsewhere.
- Understand what the registrar will and won’t do. Registrars tend to treat the account holder as their customer. GoDaddy’s published complaint process, for example, says it will comply with a court order about a customer’s domain, and points disputes to the UDRP or the courts. It also says it will not release account information without the customer’s permission. Do not expect a registrar to hand over an account because you can show you paid for it.
-
Use the right legal tool.
- UDRP: The Uniform Domain-Name Dispute-Resolution Policy lets a trademark owner obtain transfer of a domain only if it proves three things: the domain is identical or confusingly similar to its trademark, the registrant has no rights or legitimate interests, and the domain was registered and is being used in bad faith. It was designed for abusive cybersquatting. Panels have repeatedly dismissed complaints that turn on a contract or business dispute, such as a disagreement over what an agency agreed to hand over. A fee dispute with your own agency is exactly that kind of dispute, so a UDRP complaint may fail even if you hold the trademark.
-
URS: The Uniform Rapid Suspension system only suspends a domain. It cannot transfer one. It applies mainly to newer gTLDs, not to
.com,.net, or.org. - Courts: For a contractual or ownership dispute with a vendor, a court claim is usually the appropriate route. Registrars act on court orders. Speak to a lawyer who handles domain and commercial disputes in your jurisdiction.
Executive Audit Checklist
Use this list to review your own or a client’s portfolio.
Ownership
- Every domain is listed in a central inventory with its registrar, account owner, and expiry date.
- Each domain sits in an account owned by the client’s legal entity.
- The registrant named on each domain is the client entity, not the agency or an individual.
Access
- The registrar account email is a role-based mailbox, not a personal address.
- At least two people at the client can recover the account.
- MFA is not tied to one person’s personal phone.
- Agency access is through delegation or named members, not a shared password.
- Delegated access excludes billing, recovery settings, and (unless intended) transfer permission.
Security
-
clientTransferProhibitedis enabled on production domains. - High-value domains have been assessed for Registry Lock.
- DNS administration is held by a known party, and changes are logged where the provider allows it.
Contracts
- The MSA states that the client owns domains, DNS, and related accounts.
- The MSA requires the agency to cooperate with transfers within a defined number of days.
- The MSA says assets cannot be withheld in a fee dispute.
Offboarding
- A written offboarding checklist exists and names who revokes which access.
- Renewal notices go to a monitored shared mailbox rather than an individual.
Securing Your Digital Footprint
Technical admin rights are an operational necessity for agencies, but they are not a substitute for owning or controlling the registrar account.
Keep account ownership with the client and give the agency delegated operational access. That lets the agency do its job, lets the client leave when it needs to, and keeps a billing or performance dispute from turning into a hostage situation.
Originally published at https://instarenewal.com/blog/the-who-holds-the-keys-audit-mapping-registrar-account-ownership-vs-agency
Top comments (0)