Move an event domain out of a personal registrar account: handover checklist

Download the handover card

Download the event domain account handover card (Markdown)

Copy the card for each registered domain. It records current account, contact, billing, DNS and notice routes; target owners; the registrar’s exact procedure; and completion evidence. It deliberately excludes passwords, recovery codes, transfer codes, card numbers and identity documents. Store those only in approved secure systems.

Separate four kinds of control

A registrar login, the listed registrant, the DNS operator and the billing owner can be different people or entities. Access to the website or DNS panel alone does not show who may change the registration. In the registrar account, confirm the registered domain, contact record, account reference, renewal status and authorized person. ICANN says current contact information matters because registrars use it for account and registration notices; a public lookup alone cannot establish who can log in.[2]

Design an organization-managed route

The UK NCSC advises organizations to move public domain management away from a personal email account and ensure more than one trusted person can manage it securely. Choose an organization-controlled mailbox or provider account, with named internal owners and a maintained recovery route. If the only recovery email uses the same domain, losing that domain could also cut off recovery mail; confirm an independent method the provider supports. Protect the account and notification mailbox with the provider’s available authentication controls.[1]

Ask the registrar which change is actually needed

Changing a login address, changing registrant contact, moving a registration between accounts and transferring registrars are different operations. Ask the registrar which one fits the verified situation and what approvals it requires. For example, Cloudflare documents a two-account registrar move that requires confirmations from source and target accounts; that is a Cloudflare process, not a universal recipe. Record the support document or case and pause if an unverified person requests control.[3]

Verify the new route before removing the old one

Before the current access is removed, confirm that the new account can view the domain and its renewal settings, receive the expected change notifications and reach registrar support. Check nameservers and DNS service separately so an account change does not mask an unrelated DNS issue. Keep the old authorized contact available through the provider’s required confirmations, then remove obsolete personal access after the handover is verified and documented.

Watch the renewal and recovery path

Test the organization’s ability to receive renewal and account-change notices. Identify the billing owner and verify auto-renewal or the manual renewal workflow in the actual registrar account. ICANN notes that stale email can hide important notices. Set an owner for the next contact review and for backup access; a role mailbox nobody monitors is not a recovery plan.[2]

Stop at disputed control

If the current holder disputes authority, the registrar requests proof the team lacks, or records conflict, stop. Use the registrar’s formal support or dispute route and qualified local advice rather than sharing credentials, guessing at ownership or changing contact details to force access. The card is an operational evidence trail, not a legal title decision.