The “Who Gets the Notice?” Audit: Mapping Provider Billing Contacts vs. Actual Account Owners

It is a quiet Friday afternoon when a client calls in a panic. Their website has stopped loading, business email has stopped routing, and the landing pages built for next week’s launch have vanished.

You try to log into the domain registrar account, only to hit a wall. The login belongs to a developer who left the agency two years ago. The renewal reminders, receipts and card-expiry alerts have been going to that person’s work inbox, which was deleted during offboarding. The domain expired overnight, the clock on recovery is running, and nobody at your agency ever saw the warnings.

For agencies, web shops and in-house IT teams, domains, SSL certificates, hosting servers and SaaS licenses are the foundation of client work. Yet ownership and billing details tend to go unreviewed until something breaks.

This guide walks through a “Who Gets the Notice?” audit. You map who actually receives each provider’s notices against who actually owns and pays for each asset. Then you fix the gaps with a shared notification address such as renewals@agency.com, without running afoul of registrar rules or ICANN policy.

1. Why Agencies Lose Control of Their Own Assets

Infrastructure sprawl happens gradually. A founder registers the first few client domains with a personal card and a work email. As the agency grows, team members buy hosting, spin up cloud instances and add client subscriptions using whatever payment method is closest. Three failure patterns follow.

• The single-person inbox. When renewal alerts go to john.doe@agency.com instead of a role-based address, John’s departure breaks the feedback loop. Once his mailbox is decommissioned, notices bounce or vanish.
• The orphaned payment method. Cards expire, get reissued with new numbers, or are cancelled when a cardholder leaves. If the failed-payment notice goes to an unmonitored inbox, nobody notices until the service is suspended.
• The ownership mismatch. A freelancer or vendor registers a domain or hosting plan “on behalf of” the agency but lists themselves as the owner. When the relationship sours, recovering the asset can mean a dispute process or legal action.

2. What ICANN’s Domain Contact Model Looks Like Now

Many guides, including older versions of this one, say every domain registration requires four contacts: registrant, administrative, technical and billing. That is outdated for most generic top-level domains (.com, .net, .org and similar).

ICANN’s Registration Data Policy took effect on August 21, 2025. Under it, the registrant is the only contact that is always required. Administrative, technical and billing contacts are optional for most gTLDs, and some registrars have stopped collecting or storing admin and billing contacts entirely. Some registries may still require additional data, and country-code domains (.uk, .de, .in and others) follow their own national rules rather than ICANN’s.

Two related changes matter for the audit:

• WHOIS has been replaced by RDAP. Since January 28, 2025, gTLD registries and registrars must provide RDAP and are no longer required to run the legacy WHOIS service, with exceptions including .com. You can look up public registration data through ICANN’s Lookup tool, but personal contact data is typically redacted, so the registrar dashboard is the real source of truth.
• The Organization field decides who the owner is. Some registrars now treat a company named in the registrant “Organization” field as the registered name holder, with the named person recorded only as that organization’s contact. An agency that registers a client domain under a freelancer’s personal name, or under the agency’s own name, may not have recorded the owner it intended.

Registrars differ in which of these fields they show and which address gets which message, so check each provider rather than assuming.

The Common Mistake: One Person in Every Field

Listing the same founder or IT admin everywhere is convenient, but it creates a single point of failure. If that person goes on leave, changes roles or leaves the company, every notice goes dark at once.

3. Why the Registrant Email Matters Most

The registrant email is the address that carries compliance consequences. Under the accuracy requirements in ICANN’s Registrar Accreditation Agreement (the Whois/RDDS Accuracy Program Specification), registrars must verify the registrant’s email or phone, typically by sending a link, when a domain is registered or transferred in, or when the registrant’s name or email changes.

If the registrant doesn’t respond within 15 calendar days, the registrar must verify manually or suspend the domain. Suspension usually means a clientHold status, which takes the website and email offline. Registrars must also act if they receive inquiries about inaccurate contact data and the registrant fails to respond within 15 days.

So the registrant address cannot be a dead mailbox. A verification email sent to a departed employee’s account can take a domain offline for reasons that have nothing to do with payment.

Expiry notices also go to the registrant. ICANN’s Expired Registration Recovery Policy requires registrars to send at least two pre-expiration reminders, roughly a month and a week before expiry. Registrars also have some flexibility on timing. For gTLDs, a 30-day Redemption Grace Period follows deletion. During it the name can be restored, but DNS resolution is disabled and transfers are blocked. Restoration usually costs more than a normal renewal. The registrant’s inbox is therefore the main place the warning lands.

4. Running the Audit

Step 1: Inventory every asset

List every domain, SSL certificate and hosting account your agency owns or manages for clients. Don’t rely on memory or a single spreadsheet. Check twelve months of corporate card and expense statements, your DNS provider’s zone list, and the accounts of departed staff to find forgotten registrations.

Step 2: Check each registrar and host profile

For each domain, log into the registrar dashboard (for example GoDaddy, Namecheap, Cloudflare Registrar, Porkbun, or Squarespace Domains, where former Google Domains registrations now live) and review the contacts. Google sold its domain business to Squarespace in 2023, and Squarespace announced in November 2024 that the migration was complete. Ask of each domain:

• Is the registrant organization your agency’s or your client’s legal name?
• Does any contact, or the account login itself, point to a former employee?
• Does the registrant email reach a role address that several people can see?

Step 3: Audit payment methods

Check the card or payment method on each account. Flag cards tied to individuals or soon-to-leave employees. A company-level virtual card from a spend platform such as Ramp or BILL Spend & Expense (formerly Divvy) can be reassigned or locked without any individual’s name attached. If a card is replaced, each vendor’s billing profile still needs the new details.

Step 4: Record owner, payer and notice address separately

For every asset, write down three things: the legal owner, the payer, and the address that receives notices. A mismatch between any two is a finding. This distinction is the core of the audit, because many assets have an owner nobody has recorded and a payer nobody remembers.

5. Building the Central Notification Address

The fix for the departed-employee problem is a shared address such as renewals@agency.com or domains@agency.com, backed by a group instead of a single user.

[ Registrar / Host ]
        │
        ▼  (renewal notices, invoices, verification emails)
[ renewals@agency.com ]  (shared mailbox or group with archive)
        ├── Operations lead (primary reviewer)
        ├── Finance (billing and receipts)
        └── IT / DevOps (technical escalations)

Practical setup tips:

1. Use a group or shared mailbox, not a person’s seat. In Microsoft 365, a shared mailbox doesn’t need its own license up to 50 GB, though the people who access it need licenses. Google Workspace offers groups and collaborative inboxes. A shared mailbox or collaborative inbox keeps a searchable history, which a plain distribution list does not.
2. Make sure it accepts outside mail. Group settings in both platforms can restrict posting to internal senders, which would silently block registrar emails.
3. Allowlist registrar senders. Registrar mail sometimes lands in spam. Add the sending domains of your providers to your allowlist, and route messages from renewals@ to a priority folder or alert.
4. Name an owner. A shared inbox everyone owns is an inbox nobody checks. Assign a rotating weekly reviewer to clear the queue, file receipts into accounting software such as QuickBooks or Xero, and log upcoming renewal dates on a master calendar.

6. Does a Shared Address Break Registrar Rules?

Generally no, provided the data stays accurate and the address is monitored.

• The registrant must be accurate and reachable. ICANN requires registrant data to be truthful and current. Don’t use a fake name or placeholder. Use the real legal entity and an address that can complete the email verification described above.
• Role addresses are fine. Nothing in ICANN’s requirements bars a functional address like domains@ for the registrant or any optional contact, as long as someone reads it and can respond within the 15-day windows.
• Privacy services need a forwarding check. WHOIS privacy and proxy services are useful for hiding personal details, and much public data is redacted anyway. Confirm that your registrar still delivers verification and renewal notices to your role address, and test it.
• Check ccTLD rules separately. Country-code registries set their own contact, eligibility and verification requirements.

7. Keeping It From Drifting Back

After the audit, put some guardrails in place.

• Use a team password manager. Store registrar and hosting logins in a business password manager such as 1Password or Bitwarden, with role-based access, so credentials survive staff turnover. Enable multi-factor authentication on every registrar account and register the MFA method to the team, not one phone.
• Turn on auto-renewal, with a backup. Auto-renew for core assets, backed by a company payment method that someone monitors, and treat manual reminders as a safety net rather than the main plan.
• Review quarterly. Check user access, confirm active cards, and send a test message to renewals@agency.com to confirm it reaches every stakeholder. Add offboarding steps to your HR checklist so no registrar or host account stays tied to a departed employee.

Treat domain and hosting administration with the same care as your financial accounting. A Friday-afternoon scramble is far more expensive than a quarterly review.