yodai Academy Domain and email

Academy › Publishing › Domain and email

The nine-point checklist that wraps up the handoff

By the end you have a list of nine checks completed and dated, proving the handoff was fully done and now depends on no one but you.

By Yodai · Published on September 6, 2026 · Updated on October 12, 2026

6 min read

Imagine you just switched registrars, moved your DNS, and set up the new mailboxes. Everyone says it's done. But "done" isn't a check, it's a feeling, and feelings don't help the day a customer emails an address that no longer exists.

The question that matters isn't "Did I do it?" It's "Can I prove it's set up right?" And proving it isn't about trusting your memory, it's about logging into each site and checking with your own eyes.

This lesson doesn't add any new step to the handoff. It's proof that the earlier steps were tied up right: who's billed, where things point, who manages email, cutting off access for the person leaving, and the domain ownership transfer.

Why trusting the agency or the outgoing partner isn't enough

Whoever hands you the handoff, whether it's an agency, a partner, or an employee on their way out, might be acting in total good faith. But "all set" from them means what they remember doing, not what actually got configured. A DNS record copied wrong, an old user they forgot to remove, an email forward that's still active: these are slip-ups, not bad intentions, and you won't see them until they fail.

That's why the handoff isn't closed by whoever did it. It's closed by whoever checks it. And you're the one who has to live with the consequences if something goes wrong, not the agency that already sent the invoice and left.

The costly mistake: calling the handoff good because "the website loads"
Your website showing up in a browser says nothing about your email, or about who has access. You can have the perfect website and still lose a customer's order because their email landed in an inbox nobody checks anymore, or stay exposed because the designer you let go three months ago can still log into the registrar's dashboard. The website loading is the first thing you see, not the only thing you need to check.

The nine checks, in the order you do them

The full checklist
  1. 11. Log into the registrar yourself
    Sign out and log back in with your own username and password, without using any session that was left open. If you can't get in that way, the registrar transfer isn't done, it's staged.
  2. 22. Check who else has access to the registrar
    If your registrar lets you grant access to other people, go into the account's user or collaborator list. Only your name should show up, or the name of the trusted person you decided to keep. If the former partner or the previous agency is still listed, remove them now, not "next week."
  3. 33. Check your DNS from the outside, not from the dashboard
    Use a public DNS lookup tool (there are several free ones, like Dig, from Google's Admin Toolbox) and look up your domain from outside your own account. It should point to the server you control, not the previous agency's. Check the MX records too: according to Google Workspace help, those are what the sender's computer checks to know where to deliver your email, and a new one can take up to 72 hours to be recognized. Your dashboard shows you what you saved; the outside lookup shows what's actually published on the internet.
  4. 44. Send a test email to every mailbox you use
    From another account, say the one on your personal phone, email info@yourdomain, reservations@yourdomain, every address you ever gave customers. Confirm it lands in the inbox you actually check, not that it bounces or gets lost in an old forwarding rule.
  5. 55. Check who has access to your email
    Log into your email admin panel (Google Workspace, Microsoft 365, or whatever you use) and look at the list of users and admins. Same as with the registrar: only you, or whoever you decide. That's what the INCIBE guide for small businesses recommends when an employee relationship ends: delete their email accounts and their access permissions to systems and apps.
  6. 66. Look for forwarding and hidden rules
    In every mailbox, check whether there's a rule forwarding a copy to another address. It's an easy slip for a partner leaving in a hurry: they set up a forward to their personal email "just in case," and that "just in case" means your customer's email, with their quote attached, is also landing in someone else's inbox. Don't wait for your email to warn you: according to Gmail help, forwarding sends a copy of every new message except spam, filters can forward too, and the notice that a forward is active only shows up in the first week. So check your forwarding settings and also your rules or filters: INCIBE describes a case where a compromised email account had a rule forwarding mail to an unknown address and moving it to a hidden folder so it wouldn't be noticed.
  7. 77. Change the passwords the handoff inherits
    Even after removing someone from the user list, change the passwords on any accounts you shared anyway. An old password sitting in someone else's password manager is a door you never closed, just hid. For your registrar account, ICANN recommends never sharing your login information with anyone, including your hosting provider or web designer, and using a password that's unique to that account.
  8. 88. Check the renewal invoice
    Make sure the next domain renewal is charged to your own payment method, under your name, not the agency's. A domain that someone else renews is a domain someone else can stop renewing, the day they decide not to. Also check that you're listed as the domain owner and that the contact email is one you actually read: that same ICANN article advises against listing web designers, hosting providers, or other third parties as owners, and recommends keeping that contact current so you get the renewal notices.
  9. 99. Keep the proof, not just the result
    Take a screenshot of each screen above (the user list, the DNS lookup, the email you received) and save it with the date. Not because you distrust anyone: so that if something breaks six months from now, you have proof of exactly what state everything was in the day you closed out the handoff.
Check it yourself or ask whoever did the handoff for a report
Check it yourself
  • You log in with your own account at each site
  • You see exactly what a new customer or vendor would see
  • Done just once, when you close out the handoff
Ask the agency or outgoing partner for a report
  • You're trusting their word about their own work
  • It won't catch what they don't even know they left broken
  • Useful as a second opinion, never as the only proof

Which one to pick: Always check it yourself, even if it takes a while. Ask for the report too, as a second layer, when a third party you paid to do it right handled the handoff: if something breaks down the road, that signed report is what you'll point to.

The test email you send in step 4
Subject: Delivery test Hi, this is a test to confirm this inbox is working correctly after the domain change. If you're reading this in your regular inbox, everything's in order. Test date: [today's date]
Where a handoff that was closed without checking can go wrong
Forgotten email forwardHuman oversight: you'll see it in step 6
Old access never removedHuman oversight: you'll see it in steps 2 and 5
DNS not fully propagatedMechanical check: you'll see it in step 3
Renewal billed to someone elseMechanical check: you'll see it in step 8

Notice the difference between those four: DNS and renewal are mechanical checks, you look at them once and you're done. Email forwarding and old access are human oversights that don't raise any flags: forwarding keeps sending copies until someone removes it, and access nobody revoked stays open. That's why they matter more than they seem.

If you only have time for two of the nine checks, make them step 6 and step 2: hidden forwarding and the access list. These are the two that don't raise any flags: they can stay open long after everyone thinks the handoff is already closed.

What you'll walk away with
  • You've logged into the registrar and the email panel yourself, with your own account
  • You've confirmed from the outside that the DNS points where it should
  • You've tested every inbox with a real email and checked there's no hidden forward left
  • You've removed every access that isn't yours and changed the inherited passwords
  • You've verified the renewal is billed under your name
  • You've saved, with a date, proof that all of this was checked, not just done

Sources

  1. Set up MX records for Google Workspace. Google Workspace Help, accessed October 2026.
  2. Human resources management. Security policies for small businesses. INCIBE, Protect Your Business collection, 2024.
  3. Automatically forward Gmail messages to another account. Gmail Help, accessed October 2026.
  4. Compromised email fraud. INCIBE, accessed October 2026.
  5. Do you have a domain name? Here's what you need to know. Part IV: How to protect your domain name against domain hijacking or unauthorized transfers. ICANN, March 26, 2018.

In Yodai you connect the domain you already have to your site, and it stays registered where it is, in your name. See how your own domain for your website works.

NextThe password you can't reuse here