Whose Name Is on Your Front Door?

It’s a Monday morning in February. The practice manager walks into the managing partner’s office holding a printout.

“This came to the old info@ address. Someone forwarded it.”

“What is it?”

“It says our domain expired three weeks ago.”

“We pay for that. Don’t we?”

“The card on the account belongs to the bloke who built the website. In 2016.”

“So ring him.”

“His agency closed. The number’s disconnected.”

Nobody in the room knows which company the domain is registered with. Nobody has a login. And under the rules that govern .au names, the clock is already running.

Thirty days, then anyone

The .au Licensing Rules give a registrant 30 calendar days after expiry to renew. After that, in auDA’s own words, the name “will become available to the public on a First Come, First Served basis.”

Read that again with your firm’s name in it. The address on every business card, every engagement letter, every email your clients have sent you for a decade. Thirty days, and then it belongs to whoever gets there first with a credit card.

Depending on the registrar, the website and email can stop working well before day 30. That’s usually how firms find out.

I’d love to say this is rare. It isn’t, mostly because a domain is the one piece of the business that works perfectly for years without anyone touching it. That’s exactly the problem.

You’d never let your conveyancer put the Collins Street office on the title in the conveyancer’s name because it was quicker at the time. But that’s roughly what’s happened to a lot of firm domains, and nobody noticed, because nothing went wrong.

Here are the four things I hear most often, and why each one is less comforting than it sounds.

“We pay for it, so it’s ours.”

Paying the invoice doesn’t make you the owner. In Australia you don’t really own a domain at all. You hold a licence for one to five years, and the holder is whoever is recorded as the “Registrant” in the registry.

If the person who set it up registered it under their own business, with their own ABN, then legally it’s their licence. You’ve been paying for their name to point at your firm.

The rules anticipated this. They say an agent registering on someone’s behalf “must ensure that the Person on whose behalf they are applying is recorded as the Registrant.” Most did the right thing. Some didn’t, and some just didn’t know.

Whoever set yours up probably wasn’t being careless. They were trying to get a site live before a Friday launch, and putting it in their own account was the fastest way to get there.

This is getting more important, not less. In August 2026 auDA’s Board approved in-principle the recommendations of an external review of the rules, including one that would effectively limit a .com.au to names matching the registrant’s own name, business name or trade mark. Draft rules still have to go out for consultation and no date has been set. But the direction is clear: the name on the registration is going to matter more.

Beware: A blank or “private” public lookup doesn’t tell you much. The answer that counts is the Registrant name and ID in the registry record, and the account it sits in.

“The web designer looks after that.”

They might. They might also be holding your domain in one big account alongside two hundred other clients, which means they can’t give you the login even if they want to, because it would hand you everyone else’s as well.

That’s fine while they’re trading. It’s less fine when they retire, sell up, or close.

We pick up expired domain names of other agencies/companies from time to time. The number one query we receive from them is “where is my domain?”

That’s the easy version. The hard version is the supplier who’s still around, still holds the licence, and has an unpaid invoice they’d like to discuss first.

The fix isn’t to sack the designer. It’s to ask them to move the domain into an account created for your firm, in your firm’s name, with your details on it. They can keep managing it from there. The difference is that you could recover it without them.

“It’s on auto-renew.”

Auto-renew depends on a card, and cards expire. It also depends on the reminder emails reaching somebody, and those often go to whoever set it up, or to a staff member who left in 2019. Offboarding usually covers laptops and passwords; it rarely covers registrar contacts, which is why it’s worth adding to the list of things you do when someone leaves.

There’s a second catch that’s specific to .au. The rules say a licence is renewed where the registrar is “satisfied that the Person continues to meet the eligibility and allocation criteria.” In plain terms, renewal isn’t automatic just because the payment goes through. If the ABN on the registration belongs to an entity that’s since been restructured, merged or deregistered, renewal can stall, and auto-renew won’t save you.

The rules also require your details to be “complete, true and accurate throughout the Licence Period,” and a licence can be suspended if they aren’t updated within 14 days of a change. For a firm that changed its structure five years ago and never told the registrar, that’s worth ten minutes of someone’s time.

Tip: Put the expiry date in the firm calendar with a reminder 60 days out. Not to renew it. Just to check that someone in the firm can see it, and that the card and contact email are still yours.

“Our IT provider has it.”

Possibly. But our side of the industry created a fair bit of this. For years it was normal for an IT company to register client domains through its own reseller account, because it was convenient and it made the provider harder to leave.

That second part shouldn’t be a business model.

Your IT provider can absolutely manage the domain and the DNS day to day. That’s a normal part of the job. But you should know which registrar holds it, have your own login, and be able to recover the account if we vanished tomorrow. If you’re thinking about changing IT providers, this is one of the first things to sort out, ideally before you give notice.

The domain also controls where your email goes and how other mail systems decide whether a message really came from you. Your Microsoft 365 subscription can be paid up and working perfectly, but if someone changes the records behind the domain, your mail goes somewhere else.

The settings that stop people sending email pretending to be you live there too.

So ask your provider for one thing, in writing: the registrar, the Registrant name and ID, the expiry date, and who has access to the account.

How to transfer domain ownership back to your firm

I don’t enjoy reading auDA’s rules any more than you would. But the useful part fits on a page.

There are two different kinds of transfer, and people mix them up constantly.

Changing the registrar moves the domain from one provider to another. You need the transfer code (auDA calls it the authInfo code), which the current registrar can give you, or you can get through auDA’s password recovery tool. It can take up to three days, and auDA’s transfer page says there’s no fee for moving a .au licence between registrars. This doesn’t change who the licence belongs to.

Changing the registrant is the one that actually moves the licence to your firm. It’s started through the current provider, your firm has to be eligible on the day, and it signs a new licence agreement and pays the licence fee. Full years left on the licence carry across, up to five. Part years don’t.

If the domain moves as part of a contract, such as buying a practice or restructuring into a new entity, the rules say the transfer must be requested within 28 days of entering the agreement, unless the agreement says otherwise. Buying a business doesn’t move its domain automatically.

That’s how to transfer domain ownership when everyone’s cooperating. The awkward case is the one where the current registrant won’t cooperate, or can’t be found. That’s slower, and there’s no shortcut I can offer you. Pull together what you have: the original invoices, payment records, emails from when it was set up, any contract that mentions the website. Your registrar can tell you what evidence they’ll accept. If it turns into a genuine dispute over who owns what, that’s a conversation for your lawyer, not your IT provider.

Once it’s in your name, lock the front door behind you. Turn on multi-factor authentication on the registrar account, put the login in the firm’s password manager rather than someone’s head, and make sure at least two people in the firm know which registrar you use.

Five minutes, this week

Go to auDA’s WHOIS lookup, type in your firm’s domain, and read the line that says Registrant.

If it’s your firm’s name and ABN, good. Check the expiry date while you’re there and you’re done for the year.

If it’s a name you half remember from a web project in 2016… now you know, and you’ve got time.

If the name on it isn’t yours, we can do the change of registrant paperwork with you and hand you the registrar, logins and renewal details in writing. It’s usually an afternoon’s work, and it’s a lot cheaper than day 29.

Yener

Where these numbers come from

• .au Domain Administration Rules: Licensing, auDA, amended June 2026 (late renewal window, renewal eligibility, accurate information, agents, 28-day transfer rule)
• How to transfer your .au domain name, auDA
• .au Licensing Rules review completed by external Policy Advisory Panel, auDA statement, September 2026
• Licensing Rules Review 2025: Policy Advisory Panel Final Report, auDA, August 2026
• .au WHOIS lookup, auDA