Your Company Accounts Checklist: Email, Bank, DNS, and Everything Else

The Mobile restaurant group didn't know they were at risk. When the office manager who'd registered their domain 8 years ago left, nobody thought to ask about the details.

Two years later, the domain was up for renewal. The renewal notice went to an email address that no longer existed. The domain expired. For 72 hours, their website, their email, and their online ordering system were in limbo.

They got it back. It cost them $2,000 in emergency fees, 3 days of panic, and the permanent lesson that company accounts are company assets.

Here's the checklist of every account type you need to know about.

The Big Five Account Types

1. Domain Names Your companyname.com and any related domains. This controls your website, your email routing, and your online presence.

What you need to know:

• Which domains you own
• Where they're registered (GoDaddy, Namecheap, Network Solutions, etc.)
• Who has access to the registrar account
• When they renew
• What email address receives renewal notices

2. Email Service Where your company email lives—Google Workspace, Microsoft 365, or other providers.

What you need to know:

• Who administers the email system
• What plan you're on and what it costs
• Where the admin credentials are stored
• How to add/remove users
• What happens if the provider has an outage

3. Website Hosting Where your website files live.

What you need to know:

• Who hosts your website
• Who has access to the hosting account
• How to update content (and who can)
• Where the backup is stored
• What happens if the hosting company goes under

4. Banking and Payment Processing Your merchant account, payment processor, payroll service.

What you need to know:

• Who has access to each account
• What the recovery process is if a key person leaves
• Where the statements go
• What the monthly costs are
• Who to call for support

5. DNS (Domain Name System) The settings that direct traffic to your website and email.

What you need to know:

• Who controls your DNS (may be different from your domain registrar)
• Where the DNS management login is stored
• What the key records are (A records, MX records, CNAMEs)
• How to make changes if needed

Other Accounts You Probably Have

Social Media Accounts Facebook, Instagram, LinkedIn, Twitter/X. Who administers them? What email do they use? If the employee who runs your social media leaves, can you still access the accounts?

Cloud Storage Dropbox, Google Drive, Microsoft OneDrive, iCloud. Where does company data live? Who has access?

Software Subscriptions QuickBooks, Salesforce, industry-specific software. Who's the account admin? What do you pay?

SSL Certificates Security certificates for your website. Usually managed by your host or your IT person, but you should know they exist and what happens when they expire.

Email Marketing Mailchimp, Constant Contact, HubSpot. Who has access? What happens to your subscriber list if you switch providers?

What This Costs

Password manager (recommended): $5-$10/user/month. LastPass, 1Password, or Bitwarden Business. This is the foundation of everything else.

Annual domain renewal: $12-$20/domain/year. Sometimes much more if you're paying for premium domains.

IT audit to document all accounts: $500-$1,500 one-time.

Recovery from lost account access: $500-$5,000+ depending on what's involved. Some accounts can be recovered; others may be unrecoverable.

What Can Actually Go Wrong

Email on personal accounts. "The Google account is on Susan's personal Gmail because we didn't set up a business account." When Susan leaves, she takes the admin access with her.

Domain registered personally. The owner registered the domain on his GoDaddy account "just to get it done." When he changed email addresses and forgot to update GoDaddy, renewal notices went to an abandoned inbox.

No recovery process for payment processors. The payroll service requires a phone call from the account owner. The account owner is on vacation. Payroll doesn't run.

SSL certificate expires. Your website shows a security warning. Customers think you're hacked. It takes 3 days to fix. This happened to a Destin hotel during spring break peak season.

Cloud storage under an employee's personal account. Company files on someone's Dropbox that they created with their personal email. When they leave, the files are in limbo.

Vendor Questions (Copy/Paste)

1. What email address is registered as the administrative contact for our domain and email accounts?

2. Can you provide a list of every domain, hosting account, and software subscription we have with you?

3. If I needed to transfer my domain to another registrar tomorrow, what would I need?

4. What security measures are in place for our account (two-factor authentication, backup email, etc.)?

5. Can you send our account information to a shared password manager instead of personal email addresses?

Minimum Viable Implementation (Do This Today)

1. Make a list of every email address your company uses. Look at your email client, your billing records, your bank statements. Find them all.

2. Check your domain registration. Go to whois.com and type in your domain. See when it expires and what email is listed. If it's not a company email you control, fix that today.

3. Ask your team: "What accounts do you have access to for work?" Write down what they say.

4. Set up a shared password manager. Even a free tier of LastPass or Bitwarden. Start adding accounts.

5. Pick one critical account (your email admin panel, your domain registrar, your banking). Document who has access and where those credentials are stored.

6. Set a calendar reminder to review this list annually.

When to Hire Help

Hire now if:

• You don't know where your domain is registered
• You have accounts that are registered to personal emails of employees who have left
• You've had account access issues (couldn't log in, couldn't recover an account)
• You're changing IT vendors and need to audit what you own
• You have regulatory requirements around account access and documentation

You can manage this yourself if:

• You have fewer than 10 accounts and you know where the credentials are
• Your team is stable and account access hasn't been an issue
• You've documented your critical accounts somewhere accessible
• Your IT person handles this as part of their service