Hosting, DNS, and Cloudflare: the accounts you should still own after launch

You should own four accounts after any website launch: the domain registrar, the DNS, the hosting, and the CDN or firewall in front of it (often Cloudflare). The agency can operate them. It should not own them. When ownership sits on a vendor's card and a vendor's inbox, you are renting your own website, and you will find out at the worst possible moment.

We see this almost weekly in Montreal briefs. A founder wants to change a phone number on the site and discovers that the hosting is billed to a developer who moved to Lisbon in 2022. Nobody is malicious. It is just default behaviour: whoever set it up used their own login because it was faster that day.

What "own" actually means

Ownership is not a feeling. It is four checkable facts per account:

• The account is registered to a company email you control, ideally a role address and not one person's inbox
• The billing method is your company's card or invoice
• At least two people at your company hold admin access, so a departure does not lock you out
• Multi-factor authentication is on, and the recovery codes are stored somewhere your company, not your vendor, controls

If any of those is missing, you have a dependency, not an asset. That is fixable in an afternoon, and it is cheaper before an incident than during one.

The four accounts, in order of how badly they hurt

1. Domain registrar. This is the one that can end the business of your website outright. If the domain lapses or is transferred away, everything built on it goes with it. The registrant should be your company. Auto-renew should be on, with a card that does not expire quietly.

2. DNS. Your DNS zone decides where the site, the email, and every verification record point. Mail delivery, Microsoft 365 or Google Workspace, your CRM's sending domain, and Search Console all hang off it. Whoever holds this login can reroute your email without ever touching the host. Treat it like a bank login.

3. Hosting. Servers, containers, or a managed platform. This is the easiest to rebuild if you still have the code and the database dump, which is why it ranks third. It is still the account that gets suspended when a card fails.

4. Cloudflare or another CDN and firewall. If the site sits behind it, the settings there can break the site just as thoroughly as the host can. Page rules, redirects, and bot rules live here, often undocumented.

Why "the agency manages it for you" is not the same as ownership

Managed hosting is a fine product. The risk is when managed means *held*. A good test is a single question: if this vendor disappeared tomorrow, how many business days before we could change a record?

If the honest answer is "I don't know who to call", the setup works only while the relationship stays good. Relationships end for ordinary reasons: a founder retires, a studio gets acquired, a retainer is paused for budget. The accounts should survive all of those.

What AERVIO does by default

We work from Montreal on weekdays between 9 and 17 ET, and our standard setup is dull on purpose:

1. You create the registrar, DNS, hosting, and Cloudflare accounts under your company, or we create them with you on a screen share so the first login is yours.
2. We are added as named users. Not a shared login, not a password in a Slack thread.
3. A one-page map goes into the hand-off: what lives where, who is billed, when each renewal falls, where the last restore test is recorded.
4. If the retainer stops, you remove us. Nothing needs to be migrated, because nothing was ours.

The same principle applies to the rest of the stack. It is the reason Hands-off IT works inside your tenant and not in ours, and it is written into the hand-off section of every growth retainer. The site, the CRM, and search only behave as one system if the system is also yours.

A fifteen-minute ownership audit

You can run this without any technical help. Sit down with whoever pays the bills and answer these in writing:

• Who is the registrant on the domain, and which email receives the renewal notice?
• Who is billed for the hosting each month, and which card is on file?
• Which email address is the owner of the DNS zone?
• Who else has admin access in each of those places?
• Is the Cloudflare account, if there is one, under a company email?
• Where are the MFA recovery codes, and who can reach them?

Any "I think it's the developer" is your to-do list. Most companies find two or three gaps, and most can close them within a week.

How to take back an account without a fight

If the accounts are under a vendor's name today, you do not need a confrontation. You need a calm, written request. Ask for one of two things: an account transfer to your company email, or a user invitation at the admin level for a named person on your side. Registrars, hosts, and Cloudflare all support both. Keep the tone administrative. Most freelancers are relieved to hand it over, because holding a client's infrastructure is a liability for them too.

If the vendor is unreachable, the registrar can usually verify you through the domain contact records and company documents. That process is slower, so start before you need it. Do not wait for an outage to learn who answers the support line.

Changes that should wait until ownership is clear

Do not start a redesign, a platform move, or a DNS cutover until the audit is done. Changing hosts while the DNS is held by a third party is how companies lose a week of email. If a cutover is on your list, the order is: ownership first, then a documented plan, then the move. We write the plan into the hand-off notes for every project, and keep it current through the growth retainer when you have one.

The short version

Own the registrar. Own the DNS. Own the hosting bill. Own the Cloudflare login. Let anyone operate them, as long as you can remove them in one click. The test is simple: could you change a DNS record on Monday morning if your agency stopped answering?

If the answer is no, send a note to hello@aervio.io or call +1 438-498-3913 between 9 and 17 ET, weekdays. A short list of the accounts you think you have is enough to start. We will tell you what is yours, what is not, and what to fix first. Our hosting service is built around exactly this: you keep the account, we keep it healthy.

Questions

Can an agency manage hosting and still let us own the account?

Yes. You create the account with your company email and billing, then add the agency as a named user with the access it needs. If the relationship ends, you remove one user. Nothing moves.

Why does DNS ownership matter more than hosting?

DNS decides where your website, your email, and your verification records point. Whoever holds the DNS login can take the site offline or reroute email without touching the host. Hosting can be rebuilt in a day; DNS control lost to a former vendor can take weeks.

Is Cloudflare required?

No. It is a common and good choice for DNS, caching, and basic protection, but the rule is the same for any provider: the account sits under your company, not under a freelancer's personal email.