Domain and SSL renewal clauses for agency contracts (copy-paste wording)
By the RenewRoster team · · 7 min read
When a client's domain lapses, the first question is always "whose job was that?" If your contract doesn't answer it, the answer defaults to whoever the client phones, which is you.
A clear renewal clause fixes that before it happens. It says who owns the domain, who pays for it, who gets the registrar's emails, and what happens if a renewal is missed. Below are three common setups and wording you can adapt for each.
This is practical wording, not legal advice. Have your own lawyer review anything before it goes into a signed agreement, especially across countries.
First, decide which setup you're in
Most agencies fall into one of three arrangements per client:
- The client owns and pays, you just build. The domain sits in the client's registrar account, on the client's card. You have access only while you work.
- The client owns, you manage. The domain is registered in the client's name, but you hold the registrar login (or are invited to it), keep auto-renew on and bill renewals back.
- You register and renew, the client reimburses. The domain sits in your agency's registrar account for convenience, but the client is still the legal registrant and owner.
The wording changes depending on which one you pick, so pick deliberately for each client and write it down.
Clauses every setup needs
Ownership
Domain ownership. Every domain name used for the Client's website is registered in the Client's legal name, and the Client is the registrant and owner at all times, regardless of payment status or how this Agreement ends. The Agency will never hold a domain as security for payment.
Agencies that hold domains hostage get bad reviews and, in some places, legal trouble. Saying up front that you won't do it builds trust.
Transfer on request
Transfer. Within five (5) business days of the Client's written request, the Agency will unlock the domain and supply the transfer authorisation code, or move it into a registrar account the Client controls. Any amounts owed remain payable but will not delay the transfer.
Contact details
Contact information. The Client will keep the registrant contact details accurate and respond to any registrar verification requests. A domain may be suspended by the registrar if these are not verified.
Unverified registrant emails are a quiet cause of suspensions, so it's worth naming.
Setup 1: the client owns and pays
Renewals. Domain and hosting renewals are the Client's responsibility and are billed by the registrar or host directly to the Client's payment method. The Client is responsible for keeping that payment method current. The Agency is not responsible for any outage, loss of email, or loss of the domain caused by a missed renewal, and any work needed to restore service after an expiry is billable at the Agency's standard hourly rate.
Optional add-on (recommended):
Courtesy reminders. As a courtesy, the Agency may send the Client reminders before known renewal dates. These reminders do not transfer responsibility for renewal to the Agency.
The courtesy line matters. The most common failure here is the registrar's renewal email landing in an old inbox while the card on file has expired. A reminder from you, under your name, often catches it.
Setup 2: the client owns, the agency manages
Managed renewals. The Agency will keep automatic renewal enabled on the domains listed in the Order Form and will notify the Client at least thirty (30) days before each renewal date. Renewal fees are invoiced to the Client at cost plus the domain administration fee stated in the Order Form. If the Client declines or does not pay a renewal invoice within fourteen (14) days of notice, the Agency may disable auto-renew, and the Agency is not liable for the domain expiring. Registrar fees to recover an expired domain are the Client's responsibility.
Put the domain list in the Order Form, not in the body of the contract. Clients add and drop domains over time, and you want to update one table, not the agreement.
Setup 3: the agency registers, the client reimburses
Agency-held registrations. For convenience, the Agency may hold the domains listed in the Order Form in its own registrar account, with the Client named as registrant. The Agency will renew these domains before expiry and invoice the Client annually in advance. The Client remains the owner, and the Transfer clause applies at any time.
This setup gives you the most control, and the most exposure, because a missed renewal is clearly on you. If you choose it, you need a reliable way to see every expiry date across every client, not just the reminder emails from one registrar account.
Don't forget SSL certificates
Domains get a clause; certificates usually don't, and that's where outages now come from. Public TLS certificate lifetimes are shrinking in steps under CA/Browser Forum ballot SC-081, falling to 47 days by 2029. A certificate that was renewed by hand once a year will soon need renewing about every six weeks.
SSL certificates. Where the Agency provides hosting or maintenance, the Agency is responsible for keeping TLS certificates valid on the hostnames listed in the Order Form, using automated renewal where the host supports it. Where the Client or a third party provides hosting, certificate renewal is that party's responsibility.
List hostnames, not just the main domain. The www. site might renew automatically while an old shop. subdomain or a client portal on another server quietly expires.
A short Order Form table
| Domain or hostname | Registrant | Registrar account held by | Auto-renew | Who pays | Renewal notice to | Certificate managed by |
|---|---|---|---|---|---|---|
| example.com | Client | Client | Yes | Client direct | Client + Agency | Agency (managed hosting) |
| shop.example.com | n/a | n/a | n/a | n/a | n/a | Third-party store platform |
Filling this in for each client takes five minutes and settles most "whose fault was it" arguments before they start.
Making the clause work in practice
A clause tells you who is responsible. It doesn't tell you a renewal is coming. For that you need every client's expiry dates in one place, wherever the domain is registered:
- Pull expiry dates from public RDAP/WHOIS records instead of relying on each registrar's emails.
- Check the certificate each hostname actually serves, so a broken auto-renewal shows up before visitors see a warning.
- Send the client a reminder in your agency's name when the contract says you will, and keep a record that you did.
That's what RenewRoster does for agencies: import a list of client domains, see every domain and SSL expiry soonest-first, get team alerts at 60, 30, 14 and 3 days, and send white-label reminders to clients. It's free for 5 domains, and you can check a domain or certificate right now with the free domain and SSL expiry checker.
Related guides: Agency domain renewal billing · Why registrar renewal emails get missed · What happens when a client domain expires
Let RenewRoster watch every renewal for you
RenewRoster tracks every client's domain and SSL expiry dates, sends reminders at 60, 30, 14 and 3 days (under your agency's brand if you like) and gives you a monthly renewals report. Free for 5 domains, no card needed.