# Agency Client-Onboarding Audit

*A free VigilDog resource — vigildog.com. Run it on every new client domain.*

When you inherit a client's domains, you inherit their time bombs. Run this audit at onboarding so
the expiring cert or lapsing domain surfaces on your terms — not as a 2 a.m. outage on your watch.

---

## 1. Domain

- [ ] Registration + **expiry date** (from the registry, not just the dashboard).
- [ ] **Auto-renew** on, with a valid payment method.
- [ ] **Registrar lock** enabled.
- [ ] Who actually controls the registrar account? (Get access or a documented owner.)
- [ ] Registrant email is a monitored inbox.

## 2. SSL / TLS

- [ ] Certificate **expiry** on every hostname — apex, www, app, api, mail, staging.
- [ ] **Complete chain** (intermediate installed) on each.
- [ ] TLS 1.2/1.3 only; auto-renewal actually running.

## 3. DNS

- [ ] Full record inventory (A/AAAA, CNAME, MX, TXT, CAA, NS).
- [ ] **Dangling CNAMEs** pointing at decommissioned services (subdomain-takeover risk).
- [ ] Sensible TTLs; nameservers where you expect.

## 4. Email authentication

- [ ] **SPF**: one record, ≤10 lookups.
- [ ] **DKIM**: enabled per sender.
- [ ] **DMARC**: published, and legitimate mail aligns.

## 5. Deliver the finding

- [ ] Summarize what you found and fixed in a **one-page, client-ready** report.
- [ ] Set up ongoing monitoring so nothing you cleaned up quietly breaks again.

---

## Automate the whole audit

Running this by hand per client does not scale. **[VigilDog](https://vigildog.com/monitoring)**
watches domain, SSL, DNS and email across your entire client book and warns you before anything
breaks — with **white-label reports** you can hand straight to clients.
Start free: **https://vigildog.com/signup**