Staff Handover Risks
Home / Notes / Staff Handover Risks

Notes

Staff Handover Risks

When a staff member leaves, domain access can be one of the first things forgotten and one of the last things recovered. If admin details, renewals and registrar logins sit with former employees, a business can lose names it spent years building.

Why domain handover gets missed at resignation stage

Most businesses remember laptops, keys and company cards at exit interviews. Domain records often slip through because they are hidden inside old emails, shared passwords or one person’s notes. The trouble starts when the company finds out a renewal notice went to a personal inbox that no longer exists, or the account recovery details were tied to an ex employee’s mobile number.

In South Africa this is not a small admin issue. A missed renewal on a .co.za name can interrupt email, quoting, card payments and supplier communication in the same day. For firms that rely on municipal tenders, invoices or customer support lines, a single expired domain can create confusion and bad timing across the whole business.

  • Renewal notices go to a personal email address
  • The registrar login is stored on one person’s phone
  • Two factor codes are sent to a work SIM that has been cancelled
  • No one else knows the payment card or banking details used for renewals
  • DNS changes are handled only by one former staff member

What control looks like when one person holds the keys

Domain control is practical. It means knowing where the name is registered, who controls the login, who receives renewal notices and who can change nameservers, contacts and transfer codes. If those answers are vague, the business is already at risk. The danger increases when the person who managed the account left on good terms and still answers messages now and then, because people assume the setup is fine.

A common Cape Town pattern is a growing company that started with one founder and a helper. Years later, the original helper has moved on, but their email still sits as the contact for a group of domains. The business may have several addresses, landing pages and campaign names. Yet the real owner cannot reset access without waiting on someone who is no longer staff.

If a registrar account is tied to a former employee, you can face delays with verification, locked transfers and missed changes during a campaign or rebrand. That is how a simple admin gap becomes a commercial problem.

How a missed handover can cost a business real money

The costs are not limited to losing a name. A late renewal can trigger downtime while email stops working and staff scramble to explain bounced messages to clients. If the domain is tied to an online quotation form or a booking system, leads can vanish for days before anyone notices. That can mean lost sales, extra support calls and awkward conversations with suppliers and customers.

There is also reputational damage. People often trust the domain first and the company second. When an email address suddenly changes, or a site disappears after a lapse, it can look like the business has closed or moved without warning. For a law firm in Bellville, a contractor in Paarl, or a guesthouse in Somerset West, that kind of confusion can push clients elsewhere.

We have also seen cases where former staff kept hold of transfer codes out of habit rather than bad intent. The issue is not always malice. More often it is poor exit process, weak documentation and no second layer of control. Still, the effect is the same: the business no longer has clear command of its own online address.

A Cape Town example: one handover, three expiring names

Consider a Claremont business that used three related domains for its main site, a campaign page and a service email setup. The original office manager left after seven years. During the handover, the company collected payroll files and supplier contacts, but not the domain admin logins. Months later, the renewal notices still went to the former employee’s personal inbox, and the backup email on file was one that no longer existed.

By the time management noticed, one of the domains was near expiry and the registrar record still showed an old contact number. The transfer code had to be requested, verified and checked against the company records. Nothing dramatic happened but the business spent two days making calls instead of serving customers. That delay would have been avoidable with a proper exit checklist.

The lesson is simple. If the domain matters to revenue, marketing or email, it must be treated like a company asset not a personal favour.

What every South African business should secure before staff leave

Before an employee exits, make a point of reviewing the full domain picture. Start with the registrar account, then move to contact details, renewals, two factor access, DNS records and any attached services such as forwarding or hosting. If the business uses more than one domain, check each one separately. A single shared login is not enough protection when several trading names are involved.

For businesses in the Western Cape, this matters just as much during load-shedding and holiday periods, when the office is quieter and mistakes can go unnoticed. Coastal humidity in places like Muizenberg or Somerset West does not affect the domain itself, but admin gaps do not wait for a calm week. They tend to surface when staff are away, the power is off, or the finance person is at year end.

  • Keep a live register of all domains owned by the business
  • Use company email addresses, never personal ones, for admin and recovery
  • Assign at least two authorised internal contacts
  • Update renewal cards, banking details and billing contacts before staff exit
  • Test transfer and recovery access every few months

How DropCatcher helps restore oversight before expiry

Once a business has lost track of domain admin details, speed matters. Monitoring expiry dates, watching release windows and checking ownership records can prevent a lapse before it becomes public. A proper portfolio audit shows which names are active, which ones are tied to old staff accounts and which ones need transfer support or renewal reminders.

For South African companies with offices or teams in Cape Town, Bellville, Stellenbosch, Paarl or Somerset West, this is especially useful when different people have handled different parts of the domain portfolio over time. Remote monitoring also helps when directors are travelling or when internal admin is spread across more than one branch. The aim is to keep control with the business, where it belongs.

Domain handover risks are usually fixable, but only if they are seen early. Once the deadline passes, the options get narrower and more costly. That is why a clean process, regular reporting and clear ownership records matter long before a resignation letter lands.

Questions we get asked

What is the biggest risk when a former employee still has domain access?

The biggest risk is loss of control. The business may miss renewals, fail to reset logins, or lose the ability to change DNS and transfer details quickly.

Should domain logins be kept in one person’s name if they handle the admin?

No. The account can be managed by one person, but ownership, recovery details and oversight should sit with the company and at least one backup contact.

How often should a business review domain admin details?

At least twice a year, and again whenever someone leaves, changes roles, or a new domain is added.

Planning something? Email the team.

domains@dropcatcher.co.za