Business guide
Who controls your business domain? Registration, access and ownership explained
Find out who holds your business domain registration, how agency access differs from control, and what to check before a website handover.
A domain invoice does not tell you the whole story
An agency may have registered your domain, paid the renewal and managed its settings for years. That still leaves important questions: who is recorded as the registrant, whose account contains the domain, and who can recover access if the person managing it leaves? Treat these as separate checks rather than assuming one paid invoice answers them all.
For .au names, the registrant holds a licence to use the domain under the applicable rules. The everyday phrase "owning your domain" can hide that distinction. Your practical objective is to have the correct eligible holder recorded and reliable business control over access, renewals and authorised changes.
Check the registration and the account
Use auDA’s WHOIS service for a .au domain to identify the registrar and public registrant details. The Reseller Name field may also identify a reseller; a registrar’s corporate or retail brand can differ from the name on your invoice. Compare the record with your business information. It is a starting point, not proof that you can sign in or change settings.
Find the provider account and check its recovery email, contact details, billing arrangements and renewal status. Ask the provider to clarify anything that does not match. If an agency is the named registrant when your business should hold the licence, discuss the correct change-of-registrant process rather than simply changing a display name in a website dashboard.
Give a provider access without giving away business control
Where supported, invite the developer through the provider’s delegation or team tools. Grant the access needed for the work and keep a record of the invitation. The person changing website records does not necessarily need control of billing, account recovery or every domain in the account.
A registrar transfer changes the provider managing the registration. A registrant change changes the licence holder. Editing DNS changes where services point. These are different operations, so ask which one is proposed and why. None should be treated as an automatic requirement just because you are changing website designers.
For a .au registrar transfer, the EPP authInfo transfer authorisation code is separate from your account login. The current registrar can send it to the registrant contact email. Use the official transfer process and treat the code as sensitive; it is not a reason to share the whole account password.
- Holder
Who is recorded as the registrant or licence holder?
- Account
Which provider account controls renewal and recovery?
- Access
Who is authorised to change the settings today?
Resolve missing control before an urgent launch
If you cannot access the domain account, contact the provider through its official recovery process. Prepare the business and registration evidence it requests. An old staff member’s inbox or a former agency relationship can complicate recovery; do not assume a new website contractor can bypass those checks.
Buying a business does not automatically transfer its .au domain licence. The seller and buyer need to arrange the eligible change of registrant through the provider. If the recorded holder and your business disagree about entitlement, preserve invoices and correspondence and ask the provider about the appropriate process; do not promise a recovery date.
Keep a small domain record the business can maintain
Maintain a secure inventory with the domain name, provider, account owner, recovery contact, renewal responsibility and DNS host. Record where email is supplied separately. Keep secrets in an appropriate password manager rather than in a general handover spreadsheet, and use multifactor authentication when the provider supports it.
Check this record when changing providers, staff or billing arrangements. It is much easier to resolve an outdated recovery address before something expires. My website handover work starts with this map of control so publishing a new site does not depend on guessing which account belongs to whom.
- Confirm the recorded registrant matches the intended holder.
- Verify a business-controlled recovery method and renewal contact.
- Identify the registrar, reseller and DNS host where they differ.
- Document delegated access and remove it when no longer required.