Quick quiz: if your domain name expired on Friday, who would receive the renewal reminder, whose card is on file, and which account controls where your website and email point?
For a solo operator, family business or small team, the answer is often not written down. That is a continuity risk. The domain name is not merely your website address: it is also part of every email address at that domain. If a .au licence expires, both website and email stop working during the grace period. This checklist is for sorting out who controls what before you have to do it during an outage.
What actually happens when a .au domain expires?
According to auDA’s renewal guidance, a .au licence can be renewed up to 90 days ahead of expiry. After expiry there is a 30-calendar-day grace period: you can renew, but you cannot use or update the domain. Your website and email will not work. If you do not renew in time, the domain is removed from the registry and may become available to another eligible registrant. Recovering it then is not assured. Keep that renewal date somewhere other than the registrar’s reminder email.
Separate the three roles
The registrant
The registrant is the licence holder. Check that the registrant details identify the right person or entity and remain eligible for the chosen .au namespace. A web designer’s name or a former employee’s details may be difficult to untangle later. Domain registration is not ownership of a name as intellectual property: business.gov.au explains the distinction between a domain address, business name and trade mark.
The registrar or reseller
The registrar or reseller manages the registration. Your host or developer might have registered it for you, but that does not tell you who can sign in or change nameservers. Ask which company holds the account, whose name it is in and how an authorised owner would regain access.
The billing and administrative contacts
Check which email receives renewal reminders, which payment method is charged, and who can approve transfers or reset a password. A reminder address on the domain itself is a trap: once the domain stops resolving, you might lose access to that mailbox. Where possible, keep a monitored recovery contact independent of the domain.
Check which email receives renewal reminders, which payment method is charged, and who can approve transfers or reset a password. A reminder address on the domain itself is a trap: once the domain stops resolving, you might lose access to that mailbox. Where possible, keep a monitored recovery contact independent of the domain.
Your access and renewal checklist
It is worth checking the actual account, not just asking whether the business has a domain. A registrant record, renewal contact and DNS control can sit with three different organisations. Start with a written inventory and have the person responsible for each system confirm it. If you cannot tell which mailbox receives a transfer approval, that is a useful warning sign.
- Confirm registrant details. Check the licence holder and contacts against your current business structure. Keep eligibility and contact details current.
- Find the registrar account. Can the authorised owner sign in without a former developer? Document the registrar or reseller and a recovery method.
- Check the reminder mailbox. Use a monitored address that does not depend on the domain being renewed where possible.
- Check payment and expiry. Replace expired cards, confirm auto-renewal, and add your own calendar reminder. auDA says .au names can be renewed up to 90 days early.
- Secure administrator access. Apply MFA to the registrar, primary mailbox and hosting account. The Australian Government cyber security checklist recommends MFA, strong passwords or passphrases and backups.
- Keep an independent record. Store the domain, DNS, renewal and emergency access details in a controlled location, not only in someone’s inbox.
Changing DNS or email without breaking the business
A move to new hosting or email can interrupt both services even when registration is current. Before changing anything, export or record the live DNS zone: address records for the website, MX records for mail, TXT records for verification and email authentication, and any subdomains. Find out who actually hosts the authoritative DNS. A registrar and DNS provider may be different companies.
Prepare the new provider first. Decide whether the change is to records in the current DNS zone, the nameservers at the registrar, or both. If you switch nameservers, ensure the new DNS zone includes all needed records, not just those for the website. Plan a quiet change window and keep the old service available during an overlap period rather than cancelling it immediately.
Afterward, test the site and send mail both ways. Check that the new provider’s SPF, DKIM and DMARC configuration matches the services that actually send on your behalf. Test contact forms, invoicing, booking systems and account resets – these are often forgotten because the owner’s own mailbox still works. Then remove unused access, update billing and record the new setup.
Domain registration is not trade mark protection
business.gov.au makes this distinction clear: registering a domain does not give you intellectual-property protection for the name. A business name, domain registration and trade mark do different jobs. If a sole trader changes to a company, revisit the registration details and .au eligibility rather than assuming the original account details are still right.
Make the handover survivable
For a small business, the most dangerous gap is often that one person knows where everything lives. Write down the registrar, registrant, expiry date, billing contact, DNS provider, mail provider, recovery contacts and people with administrator access. Restrict the document appropriately, but make sure it is accessible to an authorised person if the usual contact is unavailable. Review it after a contractor leaves or a business structure changes.
If you also support staff or collaborators from home, read the accessible and secure remote-work guide. For website administrators, use the existing WordPress security checklist to review who can administer the website too. Domain continuity and site security are separate jobs, but the same forgotten administrator account often causes trouble in both. SenseICT can help untangle domain and email dependencies, document the setup and plan a controlled migration. See our ICT consulting and hosting solutions or talk to Matt about your setup. DomainCastle handles managed WordPress hosting, but hosting your site is not the same as controlling its domain registration and email. Getting those boundaries clear is the whole point.
