The “Who Holds the Keys?” Audit: Mapping Registrar Account Ownership vs. Agency Operational Access
In digital marketing, web design, and managed IT services, few situations turn ugly as fast as a client-agency offboarding that goes wrong. A client decides to move to a new provider or bring their marketing in-house. They ask for access to their website, DNS records, and domain portfolio. The agency replies with an invoice for “transition fees.” Or it points out that the domain sits inside the…
The "Who Holds the Keys?" audit provides essential guidance for digital marketing, web design, and managed IT services firms when a client wishes to transition from an agency to a new provider or bring marketing operations in-house. A client may request access to website files, DNS records, and domain portfolio, but agencies often respond with a demand for transition fees or clarify that they control the domain due to their master registrar account.
The core issue lies in the confusion between technical administrative access and registrar account ownership. Simply editing DNS records does not equate to owning a domain, and a monthly retainer does not grant control of the account where the domain resides. This audit framework aims to clarify the distinctions between the two and outline how to structure agency-client access securely.
Technical administrative rights refer to the ability to log in to the registrar account, manage MFA, recovery emails, and payment methods. The actual owner of a domain, however, is identified through the registrar account owner. This owner controls the TAC, which is necessary for transferring the domain to a new registrar. The registrant, on the other hand, is the person or organization recorded as the domain holder, and their authority is recognized by ICANN policies.
Domains used to list four contacts: registrant, administrative, technical, and billing. However, these are often no longer required for generic TLDs like .com. The registrant contact is now the only universally required contact. The technical and administrative contacts, while historically present, do not equate to ownership. The audit focuses on identifying the actual account owner and the party listed as the registrant, as these roles can frequently be held by separate entities.
The central conflict in these scenarios typically involves an agency master account versus a client-owned account. In the former, the agency registers the client's domain under its own registrar account, holding all login credentials and recovery processes. Transferring the domain to a new registrar then becomes problematic, as the client must rely on the agency's cooperation to obtain the Transfer Authorization Code (TAC).
In contrast, the preferred practice involves the client owning their own registrar account with the agency granted delegated access or membership permissions. This limited scope allows the agency to manage DNS records without interfering with billing, recovery settings, or transfer controls.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
