yodai Academy Domain and email

Academy › Publishing › Domain and email

The right order for locking the door when someone leaves

You'll come away knowing what order to revoke access in on the day someone leaves, so you don't leave a door open for them or lock yourself out of your own domain.

By Yodai · Published September 6, 2026 · Updated October 12, 2026

4 min read

A partner leaves, an agency stops managing your website, or the employee who handled your email quits. That same day you have to decide what to cut off first. Get the order right, and you lock the door without locking yourself out too. Get it backward, and one of two bad things happens: they can still get back in weeks later, or you end up locked out of your own domain.

This isn't about speed, it's about sequence: some accesses, if you touch them in the wrong order, undo what you just did.

Why order matters more than speed

Behind your domain there are three separate keys: who owns the domain registration, who points the DNS, and who manages the email. If that person held all three, revoking them in any order wouldn't matter. But that's almost never the case: usually they had two, or they knew a shared password that also opens another door.

That's where the risk is. If the password recovery for your registrar or your DNS goes to an email account that person can still read, they can get back in just by requesting a password reset, even after you've changed the password. And if you cut off their email but don't change the registrar password, the one they had saved still works. That's why the order starts with your own access and moves to the most valuable key next.

The sequence you don't skip
  1. 1Secure your own access first
    Before you touch anything of theirs, log in to the registrar yourself and check that the recovery email and two-factor authentication are yours, not theirs. If they're not, change them now, before you tell anyone.
  2. 2Lock down the registrar
    Change the master password for whoever owns the domain. This is the most valuable key: whoever holds it can transfer the entire domain to another account.
  3. 3Lock down the DNS
    Remove their access to the panel that points the domain, or change the password if it was shared. Without this, they can still move your website and email somewhere else even without the registrar.
  4. 4Lock down email administration
    Remove their admin role in Google Workspace or Microsoft 365, and check the full list of admins: while they had that role, they could have created another account with the same access, and that account won't disappear when you remove theirs.
  5. 5Last, their personal inbox
    Only once everything above is locked down do you touch their name@yourdomain.com account: set up forwarding first, then deactivate it.

Revoke right away, or give notice first?

Revoke immediately or give advance notice
Revoke immediately
  • Zero risk window: the moment the departure is announced, they can't get into anything.
  • Requires having the five-step sequence ready ahead of time, not improvised.
Give notice and a short window (48 hours, for example)
  • Gives them time to hand over their own passwords or export their files before losing access.
  • Every hour that passes is an hour they can still get in, if the departure wasn't friendly.

Which one do I pick? If it's an agreed-upon separation and you still trust them, end the contract with notice, an agreed sale, give them a short window to hand over their work. If there's tension, a firing, or any suspicion they might try to cause damage, revoke access immediately and sort out the rest of the recovery afterward.

The last step usually gets botched in one of two ways: leaving their inbox open, same old password, just in case something needs forwarding, or deleting it the same day. The second one is the costlier mistake.

Deleting the inbox the same day, without redirecting it
If you deactivate their email account before setting up forwarding or an auto-reply, any customer who writes to that address gets a bounce, not you. Before closing it, set up forwarding to your own email for a few weeks, let the customers who used that address know, and only then delete it.

This same sequence, secure your own access, registrar, DNS, email administration, personal inbox, is also what you'll need the day the domain actually changes owners, though there's one more step you'll see in the next lesson.

What you'll walk away with
  • First, you check that your own access to the registrar doesn't depend on the person who's leaving.
  • You revoke starting with the most valuable key, the registrar, then the DNS, then email administration, and their personal inbox last.
  • You decide whether to revoke immediately or give a short window, depending on whether the departure is on good terms or not.
  • Before deleting their inbox, you set up forwarding so you don't lose any customer who writes to it.

In Yodai you connect the domain you already have to your site, and it stays registered where it is, in your name. See how your own domain for your website works.

NextThe domain transfer happens in three steps, not one