The client should own the domain, registrar, DNS, hosting, CMS, and recovery accounts. A web agency or developer may manage them, but ownership and recovery control should remain with the business that depends on the website. A CMS, or content management system, is the software used to publish and manage site content, such as WordPress or Drupal. The safest launch arrangement separates ownership from day-to-day administration so a vendor can work without becoming the only path back into the site.
Official resources:
- Verify the domain’s current registrar and nameservers — Use ICANN’s live registration-data lookup to check the registrar, expiry details, nameservers, and publicly available registration contacts.
- Secure DNS and registrar administration accounts — Follow CISA’s guidance to protect DNS and registrar accounts with MFA, strong credentials, and recovery controls.
Table of Contents
- Who should own each account?
- What is the difference between ownership and management?
- How should domain and DNS control work?
- Who should control hosting and CMS access?
- How should recovery accounts and handoff be handled?
Who should own each account?
The business or organization should create and control the primary accounts. The agency should receive individual user access, delegated permissions, or administrator access where necessary. The domain is the most important asset because it controls the website address and often supports email, advertising, analytics, and search visibility.
Registering it in an employee's or agency's personal account can create serious problems if that relationship ends. The contract should state who owns the accounts, who pays the bills, who may change settings, and what happens when the project ends. Account ownership should not depend on an informal promise or on a single person's memory.
- Domain registrar: client-owned
- DNS provider: client-owned, with agency access
- Hosting account: client-owned when practical
- CMS administrator account: client-owned
- Recovery email and phone: client-controlled
What is the difference between ownership and management?
Ownership means having the legal and practical ability to access, recover, transfer, renew, and cancel an account. Management means performing tasks such as changing DNS records, updating the CMS, configuring email, or handling backups. An agency can manage DNS without owning the DNS provider account. It can deploy a website without owning the hosting account.
It can administer WordPress or drupal without controlling the client's recovery email. This separation protects both sides. The client retains continuity, while the agency receives enough access to complete technical work. Use named user accounts and role-based permissions when the provider supports them. Avoid shared passwords, especially for registrar and recovery accounts.
How should domain and DNS control work?
The client should own the registrar account and keep the domain registration details accurate. The registrar is the company where the domain is registered; it is not necessarily the same company that hosts the website or manages DNS. DNS, or Domain Name System, connects the domain to services such as the website, email, verification records, and marketing tools.
The client should retain control of the DNS account even if the agency makes routine changes. A practical arrangement gives the agency permission to edit DNS while preserving client access and approval rules for sensitive changes. Before launch, document the important records and their purpose, including: Do not change nameservers or delete DNS records casually. A small DNS mistake can make the website, email, or both unavailable even when the cms and hosting server are working correctly.
- Website records, such as A, AAAA, or CNAME records
- Email records, such as MX, SPF, DKIM, and DMARC records
- Verification records for analytics, advertising, or other platforms
- Any subdomains used for staging, forms, applications, or customer portals
Who should control hosting and CMS access?
The client should generally own the hosting account, billing relationship, and primary hosting recovery methods. The agency can receive a technical user account or delegated access for deployment, maintenance, logs, databases, and backups. The same principle applies to the CMS. The client should have at least one verified administrator account that is not tied solely to an agency employee.
That account should use a unique password and multi-factor authentication where available. Hosting ownership may differ when the agency provides a managed hosting service. In that case, the contract should clearly identify what the client owns, what the agency controls, how data can be exported, and how the site will be transferred after termination. Ask these questions before launch: A hosted service can be convenient, but convenience does not remove the need for an exit path.
- Can the client download the website files, database, media, and configuration information?
- Are backups included, and who can restore them?
- Can the client move the site to another host?
- What access remains if an invoice, contract, or support arrangement ends?
- Are staging and production environments clearly identified?
How should recovery accounts and handoff be handled?
Recovery accounts deserve the same attention as the primary accounts. A person who controls the recovery email, phone number, backup codes, or authenticator device may be able to reset the account even without the ordinary password. Use a client-controlled email address for critical account recovery.
That address should not depend on the website being recovered. For example, recovering a hosting account through an email address hosted on the same unavailable domain can create a circular failure. At launch, complete a short access handoff: The final test is simple: the client should be able to recover the critical accounts and authorize another qualified provider to maintain the website without requiring permission from the original agency.
- Confirm the client can sign in to the registrar, DNS, hosting, CMS, and billing accounts.
- Confirm recovery email addresses, phone numbers, backup codes, and multi-factor devices.
- Save current backups in a location the client can access.
- Record renewal dates, support contacts, account IDs, and major DNS settings.
- Remove former staff and vendors who no longer need access.
