A domain name is the one asset every other part of your online presence hangs off. The website answers on it, email is delivered to it, and the password resets for your accounting software, your social profiles and your booking system all land in an inbox that depends on it. When a domain lapses, all of that stops at once, usually on a weekend, and usually with nobody sure who is supposed to fix it.
We have seen it happen to businesses that were otherwise well run. Domain, DNS and hosting are part of our web development and SEO work, and the rules below are the ones we apply to every domain we register for a client.
Four things that are not the same
People say “our domain is with our web guy” as if that settles it. It does not, because four separate things are involved, and each can sit with a different provider.
- The registration. The record that says who owns the name, held by a registrar under rules set by auDA for .au names. Whoever holds the registrar login holds the front door.
- DNS hosting. The nameservers that answer “where does this name point?” These can live at the registrar, at Cloudflare, or with a host.
- Website hosting. The server or platform that serves the pages. Losing this is an inconvenience; losing the registration is a crisis.
- Email. Microsoft 365 or Google Workspace, wired in through DNS records. If the domain goes, so does every message and every password reset addressed to it.
How control gets lost
- It was registered by someone else. A former agency, a freelancer or an employee registered the name in their own account, sometimes in their own name. When the relationship ends, the login goes with them.
- Renewal reminders go to a dead inbox. The registrar emails the address on file. If that was the agency’s address, or a personal email nobody checks, the first warning you get is the site going dark.
- The card on file expired. Auto-renew only works if the payment does.
- The registrant details are wrong. For .au names the registrant must be an eligible Australian entity, typically the business itself with its ABN. If the record names the wrong party, proving ownership in a dispute becomes an argument rather than a lookup.
Once a .au domain expires and passes through its grace period, the name is released and anyone can register it, including someone who wants to resell it back to you or wear your brand for phishing.
What to check this week
- Look up the registrant. Run a WHOIS check on each of your domains. The registrant should be your business, with your ABN, and the contact email should be one your business controls.
- Get the registrar login. If you cannot sign in to the registrar account yourself, that is the first thing to fix. Ask for the account to be transferred to the business, not just for the password.
- Turn on MFA and transfer lock. The registrar account deserves the same protection as your bank.
- Fix the renewals. Auto-renew on a business card that will not expire soon, renew for several years at a time, and put the expiry date somewhere a human will see it.
- Write it down. Registrar, nameservers, DNS host, web host, email provider, and who holds each login. One page is enough.
- Consider the .au version. If you hold example.com.au, registering example.au is cheap insurance against someone else taking it.
How we handle it for clients
When we buy a domain for a client, it is registered to the client’s business, in an account the client owns, with our access added as a delegate that can be removed at any time. Renewals are tracked, DNS is documented, and the handover notes would let another provider take over without asking us anything. That is the standard we would want if the roles were reversed.
A domain you truly control also anchors the trust in your email, which is why this pairs with proper SPF, DKIM and DMARC. If you are not sure who holds yours, book a consultation and we will find out together.