Who Owns the Domains, Inboxes, and Lead Data When You Leave an Outbound Agency?
Wesley Hoang
·
13 min read
Quick answer
If you hire a cold email agency, the contract should say you keep the domains, inboxes, lead data and copy. Ask for domains in your name, super admin on your Google Workspace, a full data export and the opt-out list on exit, and written copy ownership. At Cymate, clients keep the domains, inboxes, lead data and copy.
Key takeaways
Access isn't ownership. The registrar account, the Google Workspace and the sending tools should be in your company's name or open to you, because under ICANN's rules only the domain's registered holder can approve a transfer.
A restart costs weeks. A domain's reputation stays with the domain, and at Cymate new inboxes get at least 3 weeks of warm-up before they send.
Domain moves follow fixed rules. A registrar without self-service has 5 calendar days to send the transfer code, and a change of registrant can lock a domain at its registrar for 60 days unless the registrar lets you opt out first.
Copy and opt-outs need their own lines in the contract. U.S. law says a copyright transfer isn't valid unless it's in writing and signed, and the FTC says you can't contract away your CAN-SPAM responsibility.
Cymate works month to month, and clients keep the domains, inboxes, lead data and copy when they leave.
Say you've worked with a cold email agency for six months, and now you want to run outbound in-house. You ask for the domains.
They sit in a registrar account you've never seen, and the inboxes live in a Google Workspace you can't log in to. Nobody did anything wrong. The contract just never said whose they were.
I run Cymate, an outbound agency, so I'm biased. That's why the rules below come from ICANN, Google, the FTC and U.S. law, and why our own terms come last. We checked every rule against its source in November 2026.
Ownership is one of the 10 checks in how to choose an outbound agency. This post goes deep on that one.
Who should own the domains, inboxes and lead data when you hire a cold email agency?
You should, and the contract should say so. Ownership isn't automatic. The registrar account, the Google Workspace and the sending tool each belong to whoever's name is on them, so ask who holds each login before you sign.
Having a login isn't the same as owning it. You can send from an inbox and still have no way to renew the domain, reset a password or export the mail. Paying the invoice doesn't settle it either, the same way paying rent doesn't put your name on the deed.
A registrar is the company you register and renew a domain through. DNS is the set of records that tells the world where a domain's email goes. SPF, DKIM and DMARC are DNS records that prove your email is really from you.
A super admin is the top admin role in Google Workspace. Here's what to get in writing:
What | Ask for | Why |
|---|---|---|
Sending domains | Registered in your company's name, in a registrar account you control, with auto-renew on | Only the registered holder can approve a transfer |
DNS | Your own login at the domain host, where the SPF, DKIM and DMARC records live | You need it to change records and to verify domains in Google Postmaster Tools |
Google Workspace | Your company as the customer, with at least two of your own people as super admins | Under Google's terms, the customer keeps the rights to the data |
Sending and enrichment tools | Your own login, or CSV exports of campaigns, leads, replies and unsubscribes | You can check the numbers now and keep the history later |
Lead data | Full lists with enrichment fields and statuses, plus a plain answer on which fields come with you | Some enrichment data is bought from outside providers |
Copy and sequences | A written, signed assignment of ownership to you | U.S. law requires a signed writing to transfer copyright |
Opt-out list | The full list, with dates, in the handoff | You stay responsible under CAN-SPAM |
Transfer steps | Who does what, by what date, and any fee | Registrars and Google have fixed waiting times |
Some agencies run sending on accounts they own. That can work if the contract says what happens at exit and what moving costs. The problem is a contract that says nothing.
An agency can also fairly keep its own templates, playbooks and know-how. Ask which parts are yours and which are theirs, and write that down.
At Cymate, clients keep the domains, inboxes, lead data and copy. Our full terms are near the end.
Why does ownership matter for deliverability?
Because inbox providers build trust in a domain over weeks, and that trust stays with the domain. If the domains and inboxes stay behind when you leave, you start over.
Google's sender guidelines tell senders to "start with a low sending volume to engaged users, and slowly increase the volume over time." Its list of common sender issues adds that steady volume "is particularly important for new domains as they establish their sending reputation."
Our rule at Cymate is at least 3 weeks of warm-up before a new inbox sends a real campaign. After that, each inbox sends 10 emails a day. Warm-up means sending small amounts of email from a new inbox so providers learn to trust it.
And a full setup is big. Constructable's campaign launched with 35 domains and 105 inboxes. Our first build for Eventual Treasury was 33 domains and 100 inboxes, configured and warmed up in under four weeks.
Reputation sticks to the domain, too. Google's Postmaster Tools rates each domain you send from as Bad, Low, Medium or High. If you take over a domain, you take over its history, good or bad, so ask for its Postmaster data first.
Google also asks senders to keep the spam rate shown in Postmaster Tools "below 0.10%" and never let it reach 0.30%. To see that number, you verify the domain with a DNS record, which is one more reason to hold the DNS login.
If the setup stays behind, you lose the warm-up, the domains' reputation, the reply history in those inboxes and the Postmaster data.
How can you check who owns your setup today?
Try to log in to each account and change something. If you can't, you don't control it.
Run these six checks:
Registrar: log in where the domains are registered. Pass if the sending domains sit in your company's account.
Public lookup: search one domain in ICANN Lookup. It shows the registrar and whether a transfer lock is on, but it often hides the owner's name, so check 1 is the real test.
DNS: log in where the domain's DNS is hosted. Pass if you can add or edit a TXT record, which is where SPF, DKIM and DMARC live.
Google Workspace: sign in at admin.google.com. Pass if you're a super admin and the billing is in your company's name.
Sending and enrichment tools: pass if you have your own login, not just the agency's reports.
Postmaster Tools: pass if your domains are verified under an account you control, or the owner has added you as a user.
If you fail a check, get the fix in writing now, while the relationship is good.
What should your Google Workspace setup look like?
Your company should be the Google Workspace customer, with at least two of your own people as super admins. Agency staff can have their own logins with only the access they need.
Google's admin security advice says your organization "should have more than one super administrator account, each managed by a separate individual." It also says not to share admin accounts, and to give each super admin a separate account for daily work.
Then check who the customer is. Google's terms define the customer as "the entity or person agreeing to these terms," and say the customer "retains all Intellectual Property Rights in Customer Data." If the agency's company signed up for the Workspace, the agency is the customer.
Get super admin in month one. Google's export tool needs a super admin account "that is at least 30 days old." Get the role on your last day, and you'll wait a month to export.
The export itself "typically takes 72 hours but can take up to 14 days." Google deletes the files 60 days after the export starts, so download them.
If the Workspace is billed through a reseller, a super admin can move the subscription to Google. Google says transfers "don't affect your data or availability," and that they're nonreversible. Afterward, remove any admin access you don't need.
A domain can only sit in one Google Workspace at a time. If you rebuild on your own Workspace, the old one has to release the domain first. After that, Google says to allow up to 24 hours, or up to 7 days if the old account came through a reseller.
Google also warns that "using the same IP address or domains for multiple senders can result in a low domain or IP address reputation." At Cymate, each client gets its own Google Workspace.
How does a domain transfer work, and how long does it take?
Plan on up to 10 days once the transfer starts. Under ICANN's rules, a registrar without self-service has to give you the transfer code within 5 calendar days.
There's one catch if the domains are in the agency's name. Moving them into yours can lock them at their registrar for 60 days, unless you ask for the opt-out first, where the registrar offers one.
Here are the rules, from ICANN's Transfer Policy and Cloudflare's transfer guide:
Rule | What it says | Source |
|---|---|---|
Who approves | Only the Registered Name Holder, the person or company the domain is registered to | ICANN |
Transfer code and lock | Without self-service, the registrar must send the code and remove the transfer lock within 5 calendar days | ICANN |
New or recently moved domains | A registrar may refuse a transfer within 60 days of registration or of an earlier transfer | ICANN |
Change of registrant | A 60-day lock on moving to another registrar, unless the registrar allows an opt-out before the change | ICANN |
Registry step | The transfer goes through unless the current registrar objects within 5 calendar days | ICANN |
Typical total time | Up to 10 days, depending on the registrar; most finish their part within 5 business days | Cloudflare's guide |
If you're refused | You can file a Transfer Complaint with ICANN | ICANN |
The transfer lock is a status called clientTransferProhibited. While it's on, the registry rejects transfer requests, so ask your registrar to remove it first.
This matters most when the domains are in the agency's name. Putting them in your name is what ICANN calls a change of registrant. That starts the 60-day lock, unless the opt-out is chosen first.
The lock doesn't stop the domain from working. It only stops a move to another registrar.
The simplest fix is to have the domains registered in your company's name from day one. Then there's no name to change when you leave.
Two caveats. These are ICANN's rules for generic domains like .com, and country domains like .io follow their own registry's rules, as Cloudflare's guide notes.
Also, ICANN's Board adopted changes to the transfer rules on June 7, 2026. It hasn't set a date for them to take effect, so check your registrar's current terms.
None of this is legal advice, so have a lawyer read the transfer clause in your contract.
What happens to your lead data, replies and copy when you leave?
You get whatever the contract says you get. So name the files, the format and the date, and test an export in month one, not on your last day.
Ask for the full lead lists with every enrichment field and status, the reply history, and who unsubscribed. Get them as files you can open without the agency's tools, like CSVs.
In our own stack, that data lives in two tools. (Cymate is a certified Smartlead partner and a Clay partner.)
Smartlead lets you download a campaign's lead list and its inbox as CSV files. The inbox file includes each reply and the lead's unsubscribe status.
Clay lets you download any table as a CSV. But object fields like HubSpot import context don't show raw values, and integration fields marked "run condition not met" come out blank.
So open each file and check it before you call the export done.
Also ask which fields come with you, since some enrichment data is bought from outside providers.
Keep your CRM and calendar in your own accounts, with the agency invited as a user. That way, the meeting history never has to move.
Who owns the copy and sequences?
Say the agency wrote the email that booked half your meetings last quarter. Unless the contract assigns it to you, the agency may still own it.
Under U.S. copyright law, a "work made for hire" is an employee's work, or a commissioned work in one of nine listed categories with a signed agreement. Sales emails aren't on that list. And under section 204, a transfer of copyright ownership "is not valid" unless it's in writing and signed by the owner.
Get a written, signed assignment of your copy and sequences. The agency keeps its general templates and know-how. This isn't legal advice, so have a lawyer check the wording.
Which opt-out records do you need to stay compliant with CAN-SPAM?
The full opt-out list, with the date of each request. You can't honor an opt-out you can't see, so get the list in the handoff.
CAN-SPAM is the U.S. law on commercial email. The FTC's compliance guide says it "makes no exception for business-to-business email," and opt-outs must be honored within 10 business days. Hiring an agency doesn't take that responsibility off you.
A few more lines from the FTC's guide matter when you switch:
Your opt-out method has to keep working for at least 30 days after you send.
You can't sell or transfer the addresses of people who opted out, except to a company you've hired to help you comply. So the list should go to you and to whoever sends for you next.
Both the company being promoted and the company sending the email can be held responsible.
Every email needs a valid physical postal address, so ask whose address is in the footer.
Each email that breaks the law can cost up to $53,088.
The FTC's guide doesn't list a rule on keeping records, so asking for the list is good practice, not a legal duty. Ask for bounce and complaint data too, labeled separately, so the next team knows why each address is blocked.
Load the list into your new sending tool before the first campaign goes out. This isn't legal advice, and it covers U.S. law only.
What should you ask an agency before you sign?
Five questions cover ownership. Each one comes with what a good answer sounds like:
Whose name is on the registrar account and the Google Workspace? A good answer: yours, with logins in your hands from day one.
What do I get when I leave, in what format, and by when? A good answer: a list, the formats and a date.
Who owns the copy and sequences? A good answer: you, assigned in writing.
Who keeps the opt-out list, and do I get it? A good answer: you get the full list, with dates.
Is any of my setup shared with other clients or rented from a provider? A good answer: no, or a clear time and cost to rebuild it.
A yes on a sales call isn't enough. Put the answers in the contract.
What does a clean handoff look like, step by step?
Start in month one, not on the day you give notice. Most of the waiting is set by registrars and Google, so the order matters more than speed.
When | What to do | Rule or limit |
|---|---|---|
Month one | Confirm every login, become a super admin and run a test export | Google's export needs a super admin account at least 30 days old |
Day 0 (notice) | Ask for the handoff package. If the domains aren't in your name, ask for the transfer code and the opt-out | Without self-service, the code is due within 5 calendar days |
Days 1-10 | Remove the transfer lock, then transfer the domains | Up to 10 days in total, depending on the registrar |
The same week | Start the mailbox export from your own super admin account, move billing if needed, then remove the agency's admin access | Exports typically take 72 hours, but can take up to 14 days |
If you rebuild on a new Workspace | Remove the domain from the old Workspace first | Allow up to 24 hours, or up to 7 days through a reseller |
Weeks 2-4 | Load the opt-out list first, raise volume slowly and set up Postmaster Tools | Keep the spam rate below 0.10% |
If the inboxes can't move | Warm up new ones before the first real send | At least 3 weeks, our rule at Cymate |
The handoff package should include:
the sequences, and the reasoning behind them
the ICP (ideal customer profile) and targeting rules
the lead lists and the data tables behind them
reply history and opt-out records
transfer of the domains and inboxes
registrar and DNS logins
Workspace super admin access and billing
exports from the sending and enrichment tools, plus Postmaster Tools access
Don't delete any inbox until the replies stop. Prospects you emailed weeks ago can still write back.
Plan some overlap so pipeline doesn't stall while new inboxes warm up. If your own hire is taking over, in-house SDR vs outbound agency covers how to budget for that overlap.
What do Cymate clients keep?
The domains, inboxes, lead data and copy. We work month to month, and when a client leaves, they keep all four. It's their asset, and the system stays with them.
Here's how we set it up. Every client gets its own Google Workspace, and we create an admin account in it for the client. They can take over ownership whenever they want. The sending domains look like the client's main domain. If the company is fish.com, we'd set up something like gofish.com, unless they ask for something different.
Once we've built the system, a client can hire someone in-house to run it or keep us running it. Their choice. If you only want the build, our One-Time Funnel Installation is a one-off setup that your team then runs.
The bottom line
Settle ownership before you sign, while it's an easy conversation. Get the domains in your name and your own people as super admins, then put the copy and the opt-out list in the contract. Do that, and leaving means changing who has access, not starting your warm-up over.
If you'd rather have a team build and run outbound for you, you can Run a Trial with Cymate. It starts with a 25-minute call.
Frequently asked questions
How long does it take to transfer a domain away from an agency?
Plan on up to 10 days once the transfer starts, depending on the registrar. If the registrar has no self-service, ICANN's rules give it 5 calendar days to send the transfer code. If the domain also has to move into your name, that change can lock it at its current registrar for 60 days unless the registrar lets you opt out first.
What happens to my domain reputation if I change agencies?
It stays with the domain. Google's Postmaster Tools rates each domain you send from as Bad, Low, Medium or High, so keeping your domains means keeping their history. If they stay behind, new domains start from scratch and need weeks of warm-up.
Who owns the email copy an agency writes for me?
Don't assume it's you. Under U.S. law, copy an agency writes for you isn't a "work made for hire" for your company, and a copyright transfer isn't valid unless it's in writing and signed. Put a written assignment of your copy and sequences in the contract, and have a lawyer check the wording.
Do I need the opt-out list when I leave an agency?
Yes. The FTC says CAN-SPAM covers business-to-business email, opt-outs must be honored within 10 business days, and hiring an agency doesn't take that responsibility off you. Ask for the full list, with dates, and load it before your next campaign sends.
What if the agency already owns my domains?
Ask in writing for the transfer and a date. Only the registered holder can approve it, and moving the domains into your name can add a 60-day lock on changing registrars unless the registrar allows an opt-out first. If the setup can't move, plan at least 3 weeks of warm-up on new domains and inboxes.
How long does a Google Workspace data export take?
Google says an export typically takes 72 hours but can take up to 14 days. You need a super admin account that's at least 30 days old to run it, so get admin access in month one, not on your last day.
About the author
Wesley Hoang
Founder and CEO, Cymate
Wesley Hoang is the founder and CEO of Cymate, a done-for-you outbound agency for B2B companies. He writes about building outbound systems that turn cold outreach into qualified meetings and pipeline.
Work with Cymate
Want outbound that books real meetings?
We build your outbound motion and help your team close the deals it brings in.
