Domain access

# Does a second domain admin protect your startup?

It helps if a founder disappears. It may not stop that founder removing other users or changing the domain. Test both cases separately.

[Do the three-question check](https://whoownswhat.xyz/tools/domain-safety-check)

By Matt Warcholinski, co-founder of Brainhub · Updated 22 October 2026

## The short answer

A second founder needs a working login at the registrar, a recovery route that does not depend on the first founder, and a clear record of who can make critical changes. Writing “backup: Ana” in an app does not create any registrar permission. Even a tested second login does not prove that one admin cannot remove another.

If you only have a minute, use the [free check and copyable prompt](https://whoownswhat.xyz/tools/domain-safety-check). This guide explains what its three questions mean and what to do when the answer is “not sure”.

## What changes when a founder leaves?

| What happened | Likely gap | First check |
| --- | --- | --- |
| They are unavailable or leave cooperatively | Nobody else can renew, change DNS or recover the registrar account | Have the other founder sign in and inspect their own permissions |
| They deliberately remove access | The second login may be removed or DNS may be changed | Ask who has removal and transfer powers, and what the provider can restrict |
| Neither founder can get into the app | The ownership notes are inaccessible when they are needed | Use the dated offline handover record and contact the registrar through its official channel |

A founder leaving does not automatically take the website offline. The failure may surface at renewal, during an outage, or when someone needs to change DNS. This is why “the site still loads” is not a useful access test.

## 1. Can the other founder really sign in?

Ask them to use their own authorised login at the registrar. They should find the domain, renewal date, payment or auto-renew settings, and their role. They can inspect the documented DNS and transfer process without changing records, requesting a transfer code or starting a transfer. Record the date and exactly what they saw. If they can edit DNS but cannot see renewal or recovery, record “DNS access checked”, not “domain protected”.

Provider roles differ. [Cloudflare documents who can transfer a domain out](https://developers.cloudflare.com/registrar/account-options/transfer-out-from-cloudflare/). [GoDaddy’s delegate levels](https://www.godaddy.com/en-ca/help/delegate-access-levels-of-permission-12374) have limitations. [Namecheap distinguishes an account move](https://www.namecheap.com/support/knowledgebase/article.aspx/1187/46/how-can-i-move-a-domain-from-one-namecheap-account-to-another/) from access to related services. Do not assume a role at one registrar means the same thing at another.

## 2. Can the team recover access without that founder?

Check where password-reset messages go, who controls 2FA, and what the registrar asks for if the usual login is unavailable. If recovery email lives only on the same project domain, a domain or mail problem may also block the reset. If the only fallback is one founder’s personal inbox or phone, the team still depends on that person. Set up an authorised, company-controlled route and document it in an appropriate vault. Do not paste passwords, recovery codes or transfer codes into a shared ownership ledger or an AI prompt.

## 3. Can one person still change the domain alone?

A separate backup login is useful for continuity. It is not a vote or veto. Ask the registrar who can remove users, replace recovery details, change DNS and transfer the domain. Ask whether any provider-enforced restriction needs another person’s approval and who can override it. A normal transfer lock alone does not prove multi-person approval; [ICANN’s transfer policy](https://www.icann.org/en/contracted-parties/accredited-registrars/resources/domain-name-transfers/policy) explains the role of transfer restrictions and the registered holder.

Use the least access each person needs, but verify that the remaining founder can still do the jobs they would inherit. If your provider cannot enforce the approval rule you want, write down that limitation. Do not show a “safe” badge based only on two names in a ledger.

## Keep a copy outside WhoOwnsWhat

Write a one-page handover note with the domain, registrar, recorded holder, renewal date, authorised admins, what the backup actually checked, and the official recovery route. Store a dated copy where both founders can get to it without this app or the project-domain email. Keep secrets in a suitable password manager, not in the note.

In the live app, an active partner can export the costs CSV and download a founder record after one has been created. That record includes a snapshot of founders and assets. These downloads are useful evidence, but they are not a full offline copy of the entire app. If both partners lose app access, only copies saved beforehand will help.

## Who owns the domain?

Account access, payment and legal ownership are different questions. Paying the invoice does not by itself settle who holds the registration. Check the actual registration contact information and your written founder or company agreement. [ICANN’s policy](https://www.icann.org/en/contracted-parties/accredited-registrars/resources/domain-name-transfers/policy) uses the registered-name holder for transfer rights; local law and your agreements may still matter in a dispute. If access is already lost, follow the [domain recovery guide](https://whoownswhat.xyz/guides/who-owns-the-domain-when-cofounders-split) and contact the registrar through its official channel.

## What this product does

The [three-question self-check](https://whoownswhat.xyz/tools/domain-safety-check) gives you a short fix list and a prompt to run through your setup. The [app prototype](https://whoownswhat.xyz/demos/domain-safety) shows how a backup’s reported access and two departure scenarios could appear in WhoOwnsWhat. The prototype uses fictional data. Neither the check nor the live ownership ledger grants registrar access, verifies ownership or blocks a transfer.

Is two admins enough to prevent a co-founder locking us out?

No. It helps if one person is unavailable, but you must check whether either admin can remove the other or change DNS and transfer settings alone.

Should we test a transfer to see if access works?

No. Have the backup inspect their role and the provider’s documented procedure. Do not make a live transfer or DNS change just to test permissions.

What if the registrar offers only one account owner?

Ask it for the supported delegation, recovery and transfer procedure. Record who can do what and keep the handover information outside any one person’s inbox or this app.

## Primary sources

- [ICANN Transfer Policy](https://www.icann.org/en/contracted-parties/accredited-registrars/resources/domain-name-transfers/policy) — registered holder, transfer restrictions and authorisation.
- [Cloudflare: transfer out](https://developers.cloudflare.com/registrar/account-options/transfer-out-from-cloudflare/) — role and transfer-code requirements.
- [GoDaddy: delegate access levels](https://www.godaddy.com/en-ca/help/delegate-access-levels-of-permission-12374) — what delegates can and cannot do.
- [Namecheap: move a domain between accounts](https://www.namecheap.com/support/knowledgebase/article.aspx/1187/46/how-can-i-move-a-domain-from-one-namecheap-account-to-another/) — account move procedure and limits.

Checked 22 October 2026. Registrar roles, domain extensions and rules differ. Check current provider instructions before changing access.

About the author

I'm **Matt Warcholinski**. I co-founded Brainhub, a software agency. I bootstrapped it from 3 to 100+ people and $8M a year, with no outside funding. Then I sold it.

Due diligence showed me how much unclear ownership of code, domains and accounts can cost a deal.

Before that I was an R&D engineer at BMW, MTU Aero Engines and GE Energy. I've been a founder for 15+ years. I host the [Better Tech Leadership podcast](https://brainhub.eu/better-tech-leadership): 100+ conversations with tech leaders running $10M+ companies.

I wrote these guides because I wish I'd had them when I split access, equity and assets with partners. Find me on [X](https://x.com/mwarcholinski).

---

Source: https://whoownswhat.xyz/guides/does-a-second-domain-admin-protect-you
Agent index: https://whoownswhat.xyz/llms.txt