How to Protect Your Business Domain

A domain name is often described as your address on the internet. That is only half the story. The address matters, but the account that controls where the address points is what you actually need to protect. The business that owns the domain is the business that controls the registrar account, not the business whose name happens to appear in the WHOIS record.

If the registrar account is held by an ex-employee, an agency that has stopped responding, or a developer who moved to another country, the business does not own its domain in any practical sense. It merely has access to a service someone else can turn off.

What A Registrar Actually Is

A registrar is a company accredited to sell and manage domain names for a particular top-level domain. For .com.au and .au, the registrar must be accredited by auDA, the Australian industry body. For .com, .net, .org and the longer list of international extensions, the accreditation is with ICANN.

Registrars are different from hosts. A host runs your website. A registrar manages your domain. Many Australian businesses use the same company for both, which is convenient and also means that both the domain and the hosting fail together if the account is lost.

The .com.au And .au Context

A .com.au or .net.au domain in Australia used to require an ABN or ACN that matched the registrant. The policy has shifted over time and now accommodates a wider set of eligibility categories, but the ABN link remains the common pattern. The .au direct extension (the short form, for example yourbusiness.au) can be registered by holders of the matching .com.au or .net.au during the relevant priority or renewal windows.

If your business trades on a .com.au, confirm that the registrant on record is your current legal entity. Historical registrations tied to a predecessor company, a director's personal name, or a former trading entity can quietly become a problem during an audit or a dispute.

The Registrant Email

The registrant email is the mailbox that receives renewal notices, policy updates and verification requests from the registrar. It is routinely overlooked. Businesses often set it to the email of whoever ordered the domain, which may be an ex-staff member or an agency contact.

Set the registrant email to a monitored business mailbox. 'admin@yourbusiness.com.au' is a common choice, as long as more than one person reads it. A single staff member's personal mailbox is a continuity problem waiting to happen.

Multi-Factor Authentication

Most reputable registrars offer multi-factor authentication on the account login. Turn it on. The second factor should be based on an authenticator app (such as 1Password's built-in TOTP, Microsoft Authenticator, Google Authenticator or Authy) rather than SMS, because SIM-swap attacks are the common way domain accounts are hijacked in practice.

If the authenticator is set up on one person's phone, add a second person. Registrars that only allow one administrator on the account should prompt a reconsideration of the registrar.

Nameservers

Nameservers are the DNS servers responsible for your domain's records. They decide where the website resolves, where email is delivered, and where any subdomains point. Write down the current nameservers. If they change without the business's knowledge, something has moved that should not have moved.

Nameservers are often set to the registrar's defaults. Many businesses switch them to a dedicated DNS provider such as Cloudflare for performance and security features. Whichever setup you use, that choice needs to be documented and the credentials for the DNS account need to be in the register.

The Registrar Lock

Most registrars offer a registrar lock or transfer lock that prevents the domain from being transferred to another registrar without an explicit step to remove the lock. Turn it on for anything but a planned transfer. It is a small nuisance for legitimate work and a significant barrier to domain theft.

Auto-Renew And The Expired-Card Problem

Auto-renew is useful. It is not the whole answer. The common pattern is that auto-renew was set up with a corporate credit card that has since been replaced. The card expires, the renewal fails, the renewal notice is sent to an inbox nobody reads, and the domain expires.

Set a calendar reminder two months before expiry to confirm the renewal setting and the payment method, independent of what the registrar's own notifications say. Record the expiry date on the asset so the review is a conversation, not a surprise.

Expiry, Redemption, Drop

A domain that expires enters a grace period where the current holder can usually renew without penalty. If no one acts, it enters a redemption period, during which the holder can still recover it but at a sharply higher cost. After redemption, the domain is released back to the pool and can be registered by anyone, including the specialist drop-catching services that watch for valuable expired names. For .com.au, the exact timing is set by auDA and is not generous.

A dropped domain is often extremely difficult to recover, especially where another party acquires it and begins using it. The practical defence is simply to not let a domain lapse.

The Reseller Trap

Some developers and agencies hold a reseller account with a registrar and sell domains under their own branding. The business sees invoices from the agency, not from the registrar, and the registrar's own records show the agency as the account holder. If the agency closes or the relationship ends, extracting the domain into a direct account can require formal transfer processes.

The remediation is to transfer the domain into a registrar account that the business owns directly, with the business as the registrant and a monitored business email as the contact. This is routine work. It is also the kind of work that nobody does until they discover why it mattered.

A Short Scenario From Regional NSW

A long-running family business in regional NSW ran its .com.au on a card belonging to a founder who had retired four years earlier. The card was eventually cancelled by the bank. The renewal notice went to a Hotmail address the founder had not opened in a decade. The domain expired, entered redemption, and was eventually recovered after a tense fortnight involving auDA, the registrar's dispute process and a sworn statement. The business was offline for most of that fortnight because the DNS also stopped resolving. A single calendar reminder, two months out, with the right email address on the registrar account, would have prevented all of it.

A Second Scenario

An online retailer discovered that a competitor had registered a visually similar .com domain and set up an email server that was being used to impersonate their accounts team. Nothing could be done about the competitor's domain, because they had registered it legitimately. The retailer registered the common variants of their own domain to prevent further lookalikes. The lesson was that the perimeter is a small set of related names, not just the one on the business card.

DNSSEC And Other Advanced Controls

DNSSEC adds a cryptographic validation layer to DNS records and may be appropriate for some domains. If you enable it, document the state and who can manage the keys, because a future provider change without that knowledge can create an outage. Advanced controls are useful; undocumented advanced controls are a trap.

What To Record

For each domain, record the registrar, the registrar account owner, the registrant on file, the registrant email, whether multi-factor authentication is on, whether the registrar lock is on, the current nameservers, the expiry date, the renewal method, and the last date the record was confirmed.

Write down which domains are critical for email and the primary website, and which are only brand-protection redirects. Spend the deepest controls on the names that carry mail and the website. Do not ignore the redirects; old campaign domains can still receive traffic and still expire.

How Business Vault Fits

Business Vault records domains as assets alongside the registrar details, nameservers, expiry dates and the people responsible for them. Monitoring can observe public DNS records and alert on changes between snapshots, so a nameserver swap or a sudden change to mail records surfaces as something to look at rather than something to discover six weeks later. Business Vault does not pay your renewal and does not take ownership of the domain. It is the register, the reminder and the record.

A domain is a small thing on an invoice and a very large thing in a crisis. The handful of practices in this article are what separate a domain the business owns from a domain the business is renting from a former employee.