A sending domain is held by its registrant, the person or company named at the registrar as the domain name holder. Under ICANN's registrant FAQ, it is that holder who has the right to move the domain to another registrar.
The mailboxes on the domain are controlled by whoever holds the top admin role on Google Workspace or Microsoft 365. Paying the invoice changes neither.
If an agency bought your cold email domains in its own account and its own name, they stay under its control until it transfers them to you.
No platform rule decides who keeps the rest of a campaign.
Each agency sets its own terms for the lead list, the sequences, the reply history and the CRM records, and the agreement settles who keeps them, ideally before the first domain is bought.
This is not legal advice. Every platform rule and price here was checked in September 2026.
One disclosure. Smirnov Consulting Group is a Prague-based B2B outbound lead generation agency that runs cold email and LinkedIn campaigns for founder-led B2B companies and books qualified sales calls.
I work on the agency side of this question, so everything below is what a buyer should settle with any agency, us included.
Who controls each piece of an outbound campaign?
Here is the default home of each piece, and the line that should cover it in your agreement.
| Asset | Where it sits unless you arrange otherwise | What to get in writing |
|---|---|---|
| Sending domains | The registrar account they were bought in, under that account's registrant name | Registered to your company, or transferred to you on request by a stated date |
| Mailboxes | The Google Workspace or Microsoft 365 account they were created in, run by its top admin | Your own admin login from the first week, and the account handed to you at the end |
| LinkedIn profiles | The person each profile belongs to | Whose profiles send, and how warm conversations reach your team when you stop |
| Lead list and verification data | The agency's files and data-tool accounts | A full export in a format you name, with the verification status of every address |
| Sequences and copy | The agency's sending-tool workspace | Your right to keep and reuse every message sent in your name |
| Reply history | The mailboxes and the sending tool's shared inbox | An export of every conversation, dated, including the "not now" replies |
| CRM records | Whichever CRM the meetings were logged in | Meetings and contacts logged in your CRM, or exported to it on a fixed schedule |
An agency holding some of these is not a problem in itself. Raise it in the sales call anyway: ask which ones it plans to keep in its own accounts, and have the agreement say how and by when each one moves to you.
Three platforms have rules here worth knowing before you sign.
Microsoft 365. The person who bought the subscription becomes a Global Administrator automatically.
A Global Administrator can reset passwords for any user and every other admin, and can add and manage domains (Microsoft's page on admin roles). If the agency signed up, it holds that role until someone changes it.
Google Workspace. Google's recovery route shows where the real power sits. When the administrators are unreachable, an active user on the account can be promoted to super admin with proof of domain ownership, which means adding a record in the domain's DNS settings (Google's admin recovery help).
So when no admin can be reached, Google treats control of the domain's DNS as the proof that decides who gets admin access back.
LinkedIn. The LinkedIn User Agreement (effective November 3, 2025) says "your account belongs to you", and every member agrees not to transfer any part of an account, with transferring connections given as the example.
If an agency sends from its own people's profiles, those connections and conversations stay with those profiles when the engagement ends. Agree now how the live conversations get passed to your team.
Why a warmed sending domain cannot simply be replaced
A sending domain is more than a name. It carries a sending record.
Google's Postmaster Tools help says reputation "is determined by the sending behavior of a domain or IP address", and that its Domain Reputation dashboard shows only mail from the specific domain that authenticates it through DKIM and SPF (Gmail Postmaster Tools help).
In Google's own tool, each exact domain has its own reputation.
Warm up 15 domains, send well from them for three months, then lose access. In Google's reporting, those three months belong to the 15 old names.
The 15 replacements are judged on what they send themselves. That is why every rebuild starts with warmup again, as the next section shows.
What it costs to rebuild or recover 15 domains and 30 mailboxes
Here is the arithmetic on a mid-sized build. For a serious campaign I plan 10 to 20 domains and 20 to 40 mailboxes, and the reasoning for those counts is in the full setup guide for sending domains and mailboxes. Take 15 domains and 30 mailboxes.
The table covers both ways out: starting over on new domains and mailboxes (the first three rows), or recovering the old ones from the agency (the transfer and export rows). The last row applies either way.
| Item | What it takes | Source |
|---|---|---|
| 15 new sending domains | Registration at your registrar's price, plus SPF, DKIM and DMARC records in place on each domain before it sends anything | Your registrar's price list; the records are my own setup rule, from the setup guide above |
| 30 new mailboxes | About EUR 204 a month at the Google Workspace Starter plan's list price of EUR 6.80 per user (30 x 6.80) | Google Workspace pricing, price in euros as served, checked September 2026 |
| Warmup before any prospect sees them | 10 days at the very least, 10 to 14 on most builds | My own planning rule, from the setup guide above |
| Moving domains to your own registrar | Up to 60 days of waiting if the domains are new or the registrant just changed | ICANN Transfer Policy |
| Exporting the old mailbox history | On Google Workspace, typically 72 hours and up to 14 days, run by a super admin | Google Workspace help |
| Lists, copy and replies you did not export | Sourced, verified and written again | Depends on what you exported |
The EUR 204 is the small part. The bigger cost is the 10 to 14 days in which the new mailboxes warm up and no new prospect hears from you.
The transfer row needs a closer look. Under the ICANN Transfer Policy, a registrar may refuse to move a domain to another registrar within 60 days of its creation.
Changing the registrant name, organization or email also triggers a 60-day lock on moving it, unless the registrar lets you opt out before the change.
Once you are the registered name holder, your registrar has to give you the transfer code within five calendar days of your request, according to ICANN's registrant FAQ.
These locks may change. Domain Incite reported in March 2025 that ICANN's policy council had voted to drop the change-of-registrant lock and require 30-day locks on new and newly transferred domains.
The change still needed board approval at the time, and the report expected at least 18 months after board approval before it took effect. Ask your registrar which rules it applies today.
The history is the last trap. Google's Data Export tool needs a super administrator, and Google says an export typically takes 72 hours and can take up to 14 days.
Google also requires the admin's own account to be at least 30 days old, unless the whole organization's account is newer. A login created for you on your last day fails that test, and even an older one still waits for the export.
How do I check who controls my domains and mailboxes?
Start with the registrar login, since every Workspace or Microsoft 365 mailbox runs on a domain someone holds there. Then work through the other rows of the asset table.
- Log in to the registrar yourself. For each sending domain, write down the registrant name and the expiry date, so no renewal slips through the gap between you and the agency. No login means you cannot act on the domains yourself, whatever the invoices say.
- Find out who can edit the DNS records on those domains. Under Google's recovery route described above, that DNS access is what proves domain ownership.
- Try the mailbox admin console. On Google Workspace, check whether your own login is a super admin. On Microsoft 365, check who holds Global Administrator and whether a Microsoft partner holds the Admin Agent role, which Microsoft describes as "equivalent to a global administrator" apart from managing multifactor authentication.
- Ask for two sample exports: the list with verification status, and last month's replies. Check that each file has every field you would need to load it into another tool.
- Open your CRM and look for the last five meetings the agency booked. If they are not there, find out where they are.
- Write down every LinkedIn profile sending on your behalf and whose profile it is.
- Put the answers in one table and send every gap to the agency as a written question.
The next section turns those gaps into questions.
The questions to settle in writing before the first domain is bought
My advice to any founder is to find out in writing, before you sign or at the latest in month one, what comes back to you if you leave.
Finding out in month five that the answer is "we keep it" makes switching harder than you expected, while early on you still have room to change it.
Agencies answer this very differently. In my view that one question changes more agreements than any negotiation over the fee, and a wrong answer only starts to cost you on your last day with them.
Send these eight questions to any agency you are considering, or to your current one, and ask for the answers in the agreement itself:
- In whose registrar account, and under which registrant name, will each sending domain be registered? Who pays the renewals and receives the expiry notices?
- Who holds super admin or Global Administrator on the mailbox account, and will I have my own admin login from the first week?
- Which LinkedIn profiles send on my behalf, and how are open conversations on your people's profiles passed to my team when we stop?
- Do I get the full list as a file, with the verification status of every address, and do your data provider's terms allow you to hand it over?
- Can I keep and reuse every sequence and message that went out under my company's name?
- How do I receive the reply history: every conversation, dated, including the "try me in March" replies?
- Are meetings and contacts logged in my CRM as they happen, or exported to it, and how often?
- When we part ways, what gets handed over, in what format, within how many days, and does the handover cost anything?
If an answer has no name, format or number of days in it, send the question back until it does.
These eight cover ownership only, not the notice period or what leaving early costs. For the wider vetting call, from sample lists to bounce rates, use my eight vetting questions for any lead gen agency. And a list is only worth fighting for if it was built well, which is its own argument in what makes a list worth sending to.
Questions founders ask about domain ownership
Do I own the cold email domains an agency buys for me? Only if your company is the registrant in the registrar account. Paying for the domains does not make you the registrant. Log in to the registrar and check the name on each domain. If you have no login, ask the agency to transfer the domains or change the registrant to your company.
Can a warmed domain's reputation move to a new domain? Not as Google describes it. Google says reputation is determined by a domain's sending behavior, and its dashboard reports each exact domain separately. A new domain builds its own record from its first message, which is why keeping the old domains matters.
Can I get my lead list back when I switch agencies? You get what the agreement says you get. Ask for the full file with the verification status of every address, and ask whether the data provider's terms allow the agency to hand it over. Settle it before the list is built.
Should I register the sending domains myself? Yes, if you can. It settles who owns the domains before anything else happens. Buy them in your company's registrar account and let the agency add the SPF, DKIM and DMARC records it needs. The registrant never changes, so the 60-day lock that follows a change of registrant never comes into play.