Client offboarding checklist for web agencies: domains, DNS, SSL and logins
By the RenewRoster team · · 7 min read
Clients leave. Sometimes they bring the site in-house, sometimes they move to another agency, sometimes the business closes. However it happens, the riskiest part of the handover is rarely the website itself. It's the quiet things around it: the domain renewing on your card, the DNS zone only you can edit, the certificate that was being renewed by a server the client no longer uses.
Get those wrong and, months later, the client's site or email goes dark and the first call is to you. This checklist covers what to hand over, in the order that avoids outages.
Tip: run the client's domains through a bulk domain expiry lookup before you start, so you know every expiry date and registrar up front.
1. List everything you manage for this client
Before you touch anything, write down what actually exists. Agencies are often surprised by the list.
- Every domain and its registrar (including old campaign domains and typo domains)
- Where DNS is hosted (often not the registrar: Cloudflare, the host, or your own DNS account)
- Every hostname with a TLS/SSL certificate (
www,shop.,portal.,mail.), and what renews each one - Hosting, CDN and email accounts, and whose name and card each sits under
- Third-party logins tied to the domain: Google Search Console, analytics, email sending services, form tools
If you track clients in RenewRoster, the client's domain and certificate list is already in one place, with expiry dates and the "who pays" field for each.
2. Agree the handover date and who pays what until then
Put it in writing: from which date the client (or their new agency) is responsible for renewals, and who pays anything that renews before then. A domain that renews the week after handover on your card is a common source of awkward invoices.
Check your contract's renewal clause here. If you don't have one, our domain and SSL renewal clauses post has wording you can adapt for future clients.
3. Hand over the domains
Pick the right route for each domain:
- Domain is in the client's own registrar account: remove your user or delegate access, and confirm the client can log in and sees auto-renew on.
- Domain is in your agency's account: either push it to the client's account at the same registrar (an internal account change, which most registrars offer) or unlock it and give them the transfer (EPP/auth) code to move it to a registrar of their choice.
Things to check before you send a transfer code:
- The registrant name and email are the client's, not yours. The registrant is the legal owner.
- The domain isn't inside a transfer lock. Under ICANN's current Transfer Policy for generic TLDs such as .com, a registrar may refuse a transfer within 60 days of the domain's registration or its last transfer, and a change of registrant triggers a 60-day transfer lock unless the registrant opted out beforehand. If the domain is moving to a new registrar and a new owner, move the registrar first. (ICANN has adopted changes to these rules, but they aren't in force yet.)
- The domain isn't close to expiry. Transfers near expiry can fail or get messy; renew first if it's within a few weeks.
- WHOIS/RDAP contact email works. Transfer approvals and renewal notices go there.
4. Export and hand over DNS before anything else moves
DNS is where most offboarding outages come from. If the zone lives in your agency's DNS account and you delete it, the client's site and email stop resolving even though the domain is fine.
- Export the full zone file (most DNS providers offer a BIND-format export)
- Include every record: MX, SPF, DKIM, DMARC and verification TXT records, not just the A record for the website
- Let the client (or new agency) recreate the zone in their account, then change the nameservers
- Keep your copy of the zone live for at least 48 hours after the nameserver change, then remove it
5. Check which certificates will stop renewing
This is the step most checklists skip. Free certificates (Let's Encrypt and similar) are renewed automatically by whatever server or service requested them. When the site moves, that renewal often stops silently.
- If you're turning off your hosting, any certificate it was renewing will expire within its remaining lifetime (90 days or less for most free certificates, and shrinking as the industry moves toward 47-day lifetimes)
- If a CDN or proxy issued the certificate, it stops renewing once the domain leaves that account
- Paid certificates bought on your agency's account will not renew for the client unless the account moves too
Run each hostname through the SSL certificate expiry checker and tell the client, in writing, each certificate's expiry date and who will renew it from now on.
6. Remove your agency's card and billing
- Turn off auto-renew on anything still in your account that the client is taking over, or move it first
- Remove your card from any client-owned accounts you added it to
- Cancel any services you were reselling (hosting, email, backups) on a date agreed in step 2
7. Hand over logins, then revoke your access
Give the client a short handover document with each account, its login email and where the password lives. Once they confirm they're in, remove your own users and API keys, and rotate any shared passwords.
8. Send a final summary to the client
Close it out with one email: every domain and certificate, its expiry date, who renews it now, and the date your responsibility ended. It protects you if something lapses later, and it's a professional last impression.
The short version
- List every domain, DNS zone, certificate and account
- Agree the handover date and who pays until then
- Move or release each domain (check registrant, locks and expiry first)
- Export DNS and keep your zone live until the switch settles
- Check which certificates stop renewing when hosting moves
- Remove your card and cancel resold services
- Hand over logins, then revoke your access
- Send a written summary with every expiry date
Starting with a new client instead? See the companion client onboarding checklist for domains, DNS and registrar access.
RenewRoster keeps every client's domains and certificates in one list with expiry dates, registrars and who pays, so an offboarding starts with a complete inventory instead of a hunt. Start a free account and import your domains from your registrar in a few minutes.
Let RenewRoster watch every renewal for you
RenewRoster tracks every client's domain and SSL expiry dates, sends reminders at 60, 30, 14 and 3 days (under your agency's brand if you like) and gives you a monthly renewals report. Free for 5 domains, no card needed.