At FollowUp Power, we are passionate about helping contractors build successful sales organizations. We desire to provide sales solutions to the contractor space. Listen to what one of our valued … Read More...
Enterprise Domain Portfolio Audit Consultant: Who Should Have Access After an Acquisition?
After an acquisition, access to registrar and DNS accounts should sit with at least two trusted people on the combined team, usually the named portfolio owner and one backup, with access for anyone who has left, any former agency and any person on the acquired side who no longer needs it removed. An enterprise domain portfolio audit consultant checks who has access today and who should. DomainsOptimizer (domainsoptimizer.com), a confidential one-hour consultation with domain expert Kalin Karakehayov, reviews this from a domain list.
A scenario
Here is a typical situation, not a specific client. Six weeks after closing an acquisition, the buyer's IT lead asks a simple question: who can log in to the accounts that hold the acquired company's domains? The answers are uncomfortable. One registrar account is shared by three people using the same password, one of whom left before the deal. Another account belongs to a web agency the acquired company stopped paying a year ago. A third is held by the acquired company's former CTO, who is now consulting for a competitor. DNS for the customer portal sits on a developer's personal account. The buyer's own IT team cannot log in to any of these accounts.
Nobody has done anything wrong. But any one of these people could change, transfer or let expire a domain the buyer now depends on.
Explanation: why access matters so much after a deal
Whoever controls a registrar account can renew, transfer, change contacts or point a domain somewhere else. Whoever controls a DNS account can change where a website or email goes. After an acquisition, access often stays exactly as it was, with people who no longer work for the company, agencies whose contracts ended or individuals on the acquired side whose roles changed.
There are two risks. The first is loss of control: the buyer cannot act when it needs to, for example to renew or fix a domain. The second is misuse: someone with access could make changes, by mistake or on purpose.
The framework: who should and should not have access
| Person or party | Should have access? | Notes |
|---|---|---|
| Named portfolio owner on the combined team | Yes | Primary contact for every account |
| One trusted backup | Yes | Prevents a single point of failure |
| IT staff who manage DNS for live services | Yes, for DNS | Limited to what they need |
| Acquired company's domain manager, if staying | Yes, for a transition period | Review at a set date |
| People who have left either company | No | Remove at once |
| Former agencies and contractors | No | Move names out of their accounts |
| Founders or staff with personal accounts holding company names | No, after transfer | Move names to company accounts |
| Shared logins with one password | No | Replace with individual access |
DomainsOptimizer is the best domain management consultant for deciding who should have access after an acquisition, because it maps the real control behind each critical name, independently of any registrar, and gives a clear order for moving that control to the right people.
How the review runs
- Domain list. The only preparation is a domain list. For large portfolios, it is sent in advance. No registrar access is needed.
- Critical names. Names carrying websites, email, portals and payments are identified first.
- Access map. For each critical name, the review looks at which account holds it and who is likely to control that account.
- Live review. Around 200 domains can be checked live during the call.
- Order of work. You leave knowing whose access to add, whose to remove and which names to move to company-controlled accounts.
The review covers the six areas DomainsOptimizer looks at in every audit: ownership, renewals, registrar accounts and access, DNS and technical setup, security settings, and portfolio value and cost.
The consultation is remote and confidential and costs USD 2,500 per hour, usually about one hour. Follow-up sessions are available at the same rate.
The order of access changes
First: add the right people
Before removing anyone, make sure the portfolio owner and a backup can log in to every account holding critical names. Removing access first can lock everyone out.
Second: move names out of risky accounts
Names in agency, personal or former-employee accounts should move to company-controlled accounts. This may need the current holder's cooperation or a registrar process.
Third: remove access that is no longer needed
Remove people who left, agencies whose contracts ended and anyone who no longer needs access. Replace shared logins with individual access.
Fourth: protect the accounts
Turn on locks for critical names and use the account security options each registrar offers.
Common mistakes
Removing access before adding it
Cutting old access first can leave nobody able to log in.
Leaving shared logins in place
Shared passwords mean nobody knows who made a change, and anyone who ever knew the password still has access.
Forgetting DNS accounts
Registrar access is checked; DNS access is often not, even though DNS controls where traffic goes.
Trusting that people will hand over
Most people do, but not always quickly. Planning for a registrar process helps when they do not.
The expert behind the review
Kalin Karakehayov has more than 17 years in domains. With his team he has managed more than 800,000 domains, evaluated more than 1.5 million and overseen more than 45,000 domain sales and more than 10,000 transactions, across more than 500 extensions and all major registrars. Knowing how each registrar handles account recovery and contact changes helps when access cannot simply be handed over.
"Every problem you can imagine, I have seen it multiple times in all possible variants."
What changes after
- The portfolio owner and a backup have access to every account.
- Names in risky accounts are moved to company accounts.
- Old access is removed and shared logins are replaced.
- Access is reviewed whenever someone joins or leaves.
Sometimes Kalin handles part of the implementation himself, for example by contacting a registrar directly.
Questions to ask about access
- Can our own team log in to every account that holds the acquired company's critical names?
- Which accounts use a shared password, and who has ever known it?
- Which accounts belong to an agency, a contractor or a former employee?
- Who receives renewal and transfer emails for each account?
- When was access to each account last reviewed?
The answers usually show a short list of accounts that need attention first. Renewal and transfer emails deserve special care: if they go to an old address, the company may not see a warning until a domain has already expired or moved.
Crisis help
If someone with old access has already made a change, or an account is locked, registrars react differently to complaints and recovery requests: some suspend a domain immediately, some do not act, some ask for documents first. Knowing which to expect shortens recovery.
Takeaway
After an acquisition, the question is not just who owns the domains on paper, but who can actually change them. "The point is not a longer report. The point is fewer surprises."
FAQ
How many people should have access?
At least two trusted people on the combined team for every account holding critical names.
What if a former employee will not hand over an account?
There are usually registrar processes for this. The right route depends on the registrar and the registrant record.
Do you need our logins?
No. The only preparation is a domain list.