Domain and website handover checklist

Ask the outgoing agency to stay available until someone at your organisation can renew the domain, restore the site and send and receive email. Book a handover call while both teams can still access the old services. Keep passwords, recovery codes and private keys in an approved password manager or secure transfer channel.

Download the blank handover and sign-off checklist (.txt).

Prove control of the domain

Sign in to the registrar through an organisation-controlled account. Check the registered holder, renewal date, payment details, recovery contact and multi-factor authentication. Give a second authorised colleague a recovery route they can use if your business email is temporarily unavailable. A promise that the agency will renew the name is insufficient evidence of your own access.

If the holder is correct and the same registrar can give you direct account control, an account handover may be all that is needed. Changing registrar and changing the registered holder are separate actions. For a .uk name, start with the current registrar and consult Nominet's registrant guidance if you cannot reach them. Agree separately whether the authoritative DNS service is moving and whether it stays available after the agency account closes.

Inventory the services that use the name

Record other hosts too. A payroll portal or a file-sharing subdomain can depend on a DNS record even when nobody on the web project remembers ordering it. Where DNSSEC is enabled and a DNS provider is changing, have the providers agree the signing and parent DS record sequence before changing delegation. A mismatch can prevent the domain from resolving.

Rehearse the smallest change

Merebridge Recruitment, our fictional agency, wants to move its website while keeping its existing email. Its initial plan was to replace the nameservers. The inventory shows that the business already controls its DNS account. The receiving agency can change only the website records, leaving the existing mail configuration in place. It makes a copy of the old web values, checks both the bare name and www, including any IPv6 addresses, and names the person who can put them back.

Restore a fresh backup of files and database on private staging and disable live mail, payments and scheduled messages there. Open an uploaded file, submit a test form to a controlled mailbox and confirm the recipient can reply. Reconcile anything created since the backup, including enquiries or orders. Agree a brief pause or a final data sync if the site accepts new records during the move.

Switch, observe and sign off

Pick a named decision-maker and a window when both suppliers are available. If you plan to lower a DNS record's time to live, do it in advance and allow its previous cache time to pass. Keep the old host serving during the change. If a rollback becomes necessary, account for new submissions that reached either host.

Test HTTPS on the bare domain and www, old bookmarked pages, a genuine missing URL, inbound and outbound mail, forms and any password resets. Record results from more than one network. Keep an owner and deadline against each outstanding fault. Once the observation period and renewal arrangements are agreed, revoke obsolete agency access, rotate shared secrets and record where the handover evidence is held.