Domain and hosting ownership checklist

A domain registration, DNS service, website host, content platform and email provider may be supplied by different organisations. List each function separately even when one company invoices for several of them. Date the separate the moving parts review. Record the domain registrar next action. Record separate the moving parts beside domain registrar: registrar, registrant organisation, expiry and renewal owner. Compare domain registrar evidence with separate the moving parts; give each separate the moving parts disagreement to the ledger custodian for domain registrar. Publish separate the moving parts after defining its domain registrar boundary. Date the separate the moving parts review. Record the domain registrar next action.

Ask an authorised person to sign in through the supplier’s known address and confirm the account name, recovery route and administrator list. Use screenshots only after hiding identifiers that a support case does not require. Date the verify control without sharing secrets review. Record the dns provider next action. Record verify control without sharing secrets beside dns provider: nameserver operator and authorised administrators. Compare dns provider evidence with verify control without sharing secrets; give each verify control without sharing secrets disagreement to the ledger custodian for dns provider. Publish verify control without sharing secrets after defining its dns provider boundary. Date the verify control without sharing secrets review. Record the dns provider next action.

Confirm the domain expiry, auto-renew position, payment owner and contact address directly in the registrar or supplier portal. Check hosting and mailbox billing separately because dates may differ. Date the check renewal and billing status review. Record the website host next action. Record check renewal and billing status beside website host: hosting contract, package owner and support route. Compare website host evidence with check renewal and billing status; give each check renewal and billing status disagreement to the ledger custodian for website host. Publish check renewal and billing status after defining its website host boundary. Date the check renewal and billing status review. Record the website host next action.

List current administrators and remove access for departed staff or former suppliers through a controlled change process. Keep at least one appropriate business-controlled recovery route and use multi-factor authentication where supported. Date the review supplier and staff access review. Record the cms or builder next action. Record review supplier and staff access beside cms or builder: platform account owner, administrator roles and licences. Compare cms or builder evidence with review supplier and staff access; give each review supplier and staff access disagreement to the ledger custodian for cms or builder. Publish review supplier and staff access after defining its cms or builder boundary. Date the review supplier and staff access review. Record the cms or builder next action.

A handover should state what each service does, who contracts for it, renewal arrangements, support channel and how access is recovered. Ask the outgoing supplier to identify custom code, licences and dependencies. Date the prepare a handover ledger review. Record the business email next action. Record prepare a handover ledger beside business email: mailbox provider, domain dependency and recovery owner. Compare business email evidence with prepare a handover ledger; give each prepare a handover ledger disagreement to the ledger custodian for business email. Publish prepare a handover ledger after defining its business email boundary. Date the prepare a handover ledger review. Record the business email next action.