The agency guide — managing domains for clients

There's no separate "agency account" — your existing nameyarn login becomes an agency login once we approve your application. This guide covers the whole programme, from applying through to deciding who pays for what.

Two ways to work with a client

Once approved, you connect to client accounts in whichever direction fits the relationship:

• Manage a client's own account. The domains live in your client's nameyarn account, under their name. You get invited access to handle DNS, renewals, or support, while they keep their own login and can see everything you do.
• Manage names inside your account. You hold the domains in your own reseller account. Your client gets a scoped login of their own, limited to just their names, so they can check in without seeing your other clients.

Most agencies use both, and you can mix them freely across your client list.

Whichever way you work, nothing changes without consent: an invite is inert until the account owner approves it — from an emailed link, or from their own Account Access page. You're never granted access silently, and access can be revoked from either side at any time.

Becoming an approved agency

Agency access lets you ask to manage another customer's account, so we review applications before turning it on — it's what lets a client trust that whoever's asking is a real, vetted business.

Before you apply, turn on two-factor authentication from your Security page. Because an agency can act inside other people's accounts, we require 2FA both to apply and to step into any client account — it protects your clients as much as you.

To apply:

1. Open Agency programme from your account sidebar (visible on any account that isn't already an approved agency).
2. Enter your business name and, optionally, your website. A website speeds up review.
3. Submit. Your application shows as Applied while it's pending, and we email you the outcome.

Once approved, an Agency section appears in your sidebar — Clients, All client domains, Search clients, Bulk DNS, DNS templates, Onboard clients, Your team, and Bulk jobs — and you can start inviting clients immediately.

If you're rejected, the reason is shown on the application page. Update your details and resubmit — it goes back into our review queue as a fresh application.

Your agency dashboard

Clients is your home base. At the top, a roll-up across every account you manage shows, at a glance:

• how many client accounts you hold,
• how many domains expire in the next 30 days,
• how many domains have a protection gap (renewal-price lock, transfer lock, WHOIS privacy or DNSSEC switched off),
• and how many auto-renewals you pay for have failed and need rescuing.

Below that, each managed account is listed with its own expiring-soon and gap counts, so you can see which clients need attention without switching into them one by one. Manage steps into an account; Remove ends your access.

You can also have this snapshot emailed to you once a week — toggle the weekly digest on or off from the same page. The digest only arrives when there's something worth acting on (expirations, failed renewals, invites awaiting approval), so it stays a signal rather than noise.

Inviting a client

From Clients, enter the client's email, pick an access level, and choose one of two modes:

• They already have an account — we email them your request. Nothing changes until they open the email and approve it.
• Create a new account for them — we create a nameyarn account under their email and send an activation link. Setting their password activates the account and confirms your access in the same step.

Tick "Copy me on their renewal notices" if you'd like their reminder and expiry emails cc'd to you.

Invites you've sent sit under Pending invites until accepted, and can be withdrawn any time before then. Once accepted, the client appears in your dashboard's managed-accounts list.

Onboarding many clients at once

To bring on a whole book of clients, use Onboard clients instead of inviting one at a time. Paste (or upload) a CSV with one client per row — email,role — and we process the lot as a single background job: existing nameyarn accounts get an access request, and new email addresses are provisioned and sent an activation link, exactly as with a single invite. When it finishes you get a per-row result showing which succeeded and which need a second look. You can onboard up to 500 clients in one run.

Adding your team

If more than one person at your agency manages clients, add them as team members rather than sharing a login. Open Your team, enter a colleague's nameyarn email, and they become a staff seat on your agency.

• A team member can act under the client grants your agency holds — the ones marked shareable — and switch into those client accounts just as you can.
• Every action a team member takes is logged under their own name on the client's activity log, so the audit trail always names the actual person.
• Each team member needs their own nameyarn account and their own two-factor authentication before they can step into a client account.

New client invites are shareable with your team by default. Grants that predate team seats stay private to you until you choose to share them. Remove a seat at any time from the same page — access ends immediately.

Access levels

Pick the narrowest level that gets the job done — you can widen it later. Any level can also be scoped to specific domains within the account, rather than the whole thing.

Level	View	DNS	Renew	Contacts, forwards, mailboxes	Support tickets
Admin	yes	yes	yes	yes	yes
Manager	yes	yes	yes	yes	yes
DNS only	yes	yes	—	—	—
Billing only	yes	—	yes	—	—
Read-only	yes	—	—	—	—

Admin and Manager currently cover the same ground day to day — use Admin for your core team and Manager for staff who only need routine operations.

What no level can do

Regardless of access level, including Admin, a delegate can never:

• Transfer a domain to another registrar, or retrieve its auth (EPP) code
• Delete a domain for a grace-period refund
• Change the account's payment methods or settings
• Grant further access to the account

Those stay with the account owner alone, so managing or paying for a domain never quietly becomes owning it. Web hosting (cPanel) and email mailbox management also aren't delegated yet — the account owner handles those directly.

One extra safeguard: replacing a client's whole DNS zone with an imported zone file asks you to re-confirm your identity with a two-factor check first, and always emails the account owner that it happened — even if they haven't turned on action notices.

Switching between client accounts

Once a grant is live, an Acting in dropdown appears at the top of your sidebar, listing your own account plus every client you can reach. Pick one to step into their account — a banner marks the switch clearly, and everything you do there is logged under your own name on the client's activity log. Switch back to your own account from the same dropdown at any point; nothing carries over between contexts.

All client domains rolls up every name you can reach across your whole client list into one table, sorted by soonest expiry, so you don't have to switch into each account just to check for trouble. Click Manage on any row to jump straight into that domain inside its owner's account.

There's no limit on how many clients you can have — these views are built to stay usable as your client list grows.

Finding a domain across clients

When you know the name but not which client it belongs to, Search clients searches every domain you can reach in one box and groups the results by owning account. Manage on any hit drops you straight into that client's context to work on the name.

Bulk changes across clients

Two agency tools let you apply the same change to many domains — across several clients — in one action, run in the background so a large batch never ties up your screen.

Bulk DNS

Bulk DNS lists every client domain you have DNS access to, grouped by owner. Tick the ones you want, choose either a set of nameservers or one of your DNS templates, and apply. We re-check your permission on each domain at the moment the job runs — so a grant that changed since you loaded the page can't be used — and record a per-domain result you can review under Bulk jobs.

DNS templates

A DNS template is a record set you define once and reuse. Open DNS templates, give it a name, and list its records one per line — host type [ttl] content, with @ for the domain's apex. Applying a template through Bulk DNS replaces the records it names and leaves the rest of each zone alone, so "point these ten client sites at our stack" is a couple of clicks rather than ten trips into ten accounts.

Bulk jobs

Every bulk DNS run and onboarding batch appears under Bulk jobs with its status and a success/failure count. Open any job to see the per-item outcome — handy for spotting the one domain in fifty that needs a manual follow-up.

Keeping access current

Access shouldn't outlive the relationship. Two things help keep it tidy:

• Time-limited access. From their Account Access page, a client can set your access to expire after a chosen number of days. About two weeks before it lapses we email them a one-click link to renew it for another year; if they do nothing, access simply ends on the date. You're emailed too, so an expiry never takes you by surprise.
• Dormant-access nudges. If a grant goes unused for months, we quietly remind the client that it's there, so stale access gets cleaned up rather than lingering.

Deciding who pays renewals

Whoever owns a domain keeps full control of it regardless of who's paying, so billing can be arranged however suits the client relationship:

• Client owns, client pays — the default, no setup needed.
• Client owns, you pay — a retainer-style arrangement where you cover a client's own domain.
• You own, client pays — you keep the domain under your reseller account but bill the client's card directly instead of invoicing them yourself.
• You own, you pay — the classic reseller default.

To set it up for one domain, open the domain's page and expand Who pays renewals. To hand several domains to the same payer at once, tick them on your domain list and use Propose payer at the bottom. Either way, nothing is billed to the proposed payer until they open the emailed link, confirm, and — if they don't have one on file — add a saved card.

Either side can end the arrangement at any time. Renewals fall straight back to the domain's owner, and both parties get an email confirming the change. Moving a domain to a new owner also clears any standing payer arrangement automatically — it belongs to the old owner, not the domain.

A payer never gains any control from paying: no DNS, no transfer rights, nothing beyond seeing what they cover on their own Domains I pay for page, where they can toggle auto-renewal or stop paying whenever they like. Hosting and email you pay for on a client's behalf show up there too.

Two things worth knowing:

• If the domain's owner clicks "renew now" themselves, that renewal is always billed to them, even with a payer arrangement in place — a standing payer only covers the automatic renewal, not a manual one the owner chose to make.
• If a payer's card fails on an auto-renewal, normal dunning applies to the payer — they get the retry attempts and the failure email. The domain's owner is copied at the point of final failure, and can always step in and renew it themselves.

Consolidated billing and statements

If you pay for a lot of client domains, two features keep the money side manageable.

Automatic credit top-up. Rather than a separate card charge for every client renewal, you can pre-fund a credit pool: set a balance threshold and a top-up amount on your Statements page, and when a renewal finds the pool below the threshold we make one larger card charge to refill it, then draw the renewal from credit. Renewals never wait on it — if a top-up can't go through for any reason, the renewal just charges your card directly as usual.

Monthly statements. Each month we roll up everything you paid on your clients' behalf into one statement, itemised by client and by order, so you have a single record to reconcile or re-bill from. Open any statement to see the per-client breakdown.

Cost report. For your own bookkeeping, export a CSV of everything you covered for others across any date range — date, client, domain, action, amount — straight from the Statements page.

Registering a domain for a client

With Manager or Admin access, switch into the client's account and add a domain to the cart as usual. At checkout, the new name registers into their account — they own it from day one — while the charge goes to your saved card.

The order shows up in both your billing history and theirs, so there's a record on each side with nothing to reconcile by hand.

Co-branding your clients' emails

Add a light touch of your own branding to the renewal notices your clients receive. On the Clients page, set a display name (and optionally a reply-to address) under Client-facing branding, and the renewal reminders your clients get will carry a "managed by your agency" line. For deliverability the sender address never changes — only the in-body line does — and this never touches payment-failure notices.

For clients: reviewing who can access your account

This last section is for the other side of the relationship — the account owner an agency wants to manage.

You'll get an email if an agency requests access to your account. Nothing changes until you approve it — the request is inert until then, and no access is ever assumed. You can also review it without the email, from Account Access in your sidebar, under Requests to approve.

Your Account Access page has three sections:

• Requests to approve — invites still waiting on you. Approve or Decline, no explanation required.
• People who can access my account — everyone with live access. Each can be Revoke-d individually, given a time limit (set a number of days after which access lapses), or removed entirely — one click that revokes all of that agency's access and hands any renewals they were paying for back to you, with an emailed summary of where your domains stand.
• Accounts I can access — if you also hold access elsewhere, it's listed here with a Leave option.

A revoked grant takes effect immediately — if the agency is mid-session in your account when it happens, they're dropped back to their own on their next action.

Every action an agency takes inside your account is recorded on your Agency activity page, so you can always see exactly what was done and by whom. From that page you can also switch on an email notice for a given agency, so sensitive changes — nameserver edits, DNS record deletions, zone imports — are emailed to you as they happen. (Some especially destructive actions, like replacing your whole DNS zone, always email you regardless.)

And even with access to your account, an agency can never transfer your domains away, retrieve their auth codes, delete a domain for a refund, change your payment methods, or grant anyone else access — see what no level can do.