To protect a .au domain name, make sure your organisation is the registrant, lock down the registrar account with strong MFA, keep renewals under control and remove DNS records that no longer point anywhere you own. Most domain losses come from a lapsed renewal, a former staff member's login or a forgotten record, not sophisticated attacks. Below are the .au rules that matter and a checklist to work through.
October is Cyber Security Action Month (opens in a new tab) in Australia. The Australian Signals Directorate renamed the former Awareness Month for 2026 to move organisations from awareness to action, and a domain review is a practical start.
How .au domain licensing works
A .au domain name is not owned outright. Under the .au Domain Administration Rules: Licensing (opens in a new tab), the registrant holds a licence for a set period. The key points:
- Australian presence is required. Every registrant needs an Australian presence, such as an Australian company, an ABN holder, an incorporated association or an Australian citizen or permanent resident. It must continue for the whole licence period, or the licence can be cancelled.
- Each namespace has its own eligibility test. A com.au or net.au name must be held by a commercial entity, and the name must match or be an acronym of a relevant name such as a business name or trade mark. A direct .au name (yourbusiness.au) only requires an Australian presence.
- Licence periods run from one to five years. You can renew up to 90 days before expiry; the new period starts from the old expiry date, so renewing early loses no time.
- There is a 30 day window after expiry. After that, the name is released to the public on a first come, first served basis.
What happened to the direct .au names
Direct .au registrations opened on 24 March 2022. Holders of existing names such as com.au and org.au had a priority allocation period, which closed on 20 September 2022. Unclaimed names were released to the public from 4 October 2022. Names with more than one priority claim stayed on hold until the applicants reached agreement.
If you did not claim the direct .au version of your name, check who holds it. If it is free, registering it is cheap protection against lookalike phishing. If someone else holds it and you believe it infringes your rights, see the disputes section below.
Who should be the registrant of your domain?
The registrant should be the legal entity that runs the business, named exactly as it appears on the ABN or ASIC record. It should not be a director personally, a staff member or the web developer who built your site.
If a developer or agency holds the name or the account, you depend on them to renew it, change DNS or move providers. If a staff member's email is the contact address, renewal notices and transfer approvals leave with them. Check your details with a WHOIS lookup and ask your registrar to correct anything wrong.
How to secure your registrar account
Whoever controls the registrar account controls your website and email. Treat it as a privileged account.
- Use a role address. Register the account to an address such as [email protected] that reaches at least two people.
- Require strong MFA. Use an authenticator app or, where supported, a passkey or security key. Avoid SMS codes where you can. Our article on phishing and MFA bypass explains why.
- Limit and review access. Give each person their own login where supported, and remove access when someone leaves.
- Use registry lock for critical names. Registry lock is available for .au names through registrars that offer it. Changes then need a manual check between registrar and registry, so one compromised login cannot move your name servers.
- Keep the registrar transfer lock on and only release it when you are deliberately moving providers.
Why auto-renew is not enough on its own
Auto-renew fails quietly: the card expires, the invoice goes to an unread inbox or the reseller stops trading. Turn it on, and also:
- Renew important names for longer periods, up to five years.
- Align expiry dates so renewals happen in one planned cycle.
- Put expiry dates in a shared calendar with reminders at 90 and 30 days.
- Keep billing and contact details current.
DNS hijacking and dangling records
DNS hijacking happens when an attacker changes where your domain points, usually through a compromised registrar or DNS hosting account. Account security and registry lock are the main defences.
Dangling records are a quieter risk. When a record such as a CNAME still points to a cloud service or marketing platform you have cancelled, someone else may claim that resource and serve content on your subdomain. Microsoft's guidance on dangling DNS and subdomain takeover (opens in a new tab) notes that the attacker can obtain a valid TLS certificate for it, and stale MX records can let them receive email. The fix is procedural: add "remove the DNS record" to every decommissioning checklist and review your zones regularly.
If you are also tightening SPF, DKIM and DMARC, see our guide to email authentication.
Should you turn on DNSSEC?
DNSSEC adds digital signatures to DNS records so resolvers can check that answers came from your zone unaltered. The .au zone is signed; you enable DNSSEC for your name by signing the zone at your DNS host and having your registrar publish a DS record at the registry.
It is worth doing, with two cautions. It does not stop someone who has taken over your registrar account, and a badly managed key change or DNS provider move can make your domain unreachable, so plan those changes carefully.
Keep an inventory of domains and records
You cannot protect names you have forgotten. For each domain, record the registrant, registrar and account owner, expiry date, DNS host, DNSSEC and registry lock status, and what each important record is for. Include defensive and old campaign names. Review it twice a year and whenever a supplier changes. Domain and DNS management is also part of our services.
What to do if a domain lapses or is disputed
If a name has expired, contact your registrar immediately; within the 30 day window you can still renew it. After that, you would need to register it again, if it is still available.
If someone else holds a name matching your business name or trade mark, there are two routes. Eligibility concerns, such as a registrant without an Australian presence, go to the registrar first, then to auDA through its complaints process. Disputes about rights in a name go through the .au Dispute Resolution Policy (auDRP) (opens in a new tab), run by auDA-approved providers for a fee. A successful complaint can see the licence cancelled or transferred to you, if you are eligible to hold it. Get legal advice first.
Domain and DNS security checklist
- Confirm the registrant of every domain is your organisation, named correctly.
- Move registrar logins to a role account with strong MFA, and remove former staff and contractors.
- Turn on auto-renew, renew critical names for longer and align expiry dates.
- Ask your registrar about registry lock for your main domains.
- Check whether the direct .au version of your main name is registered and who holds it.
- Review DNS zones and delete records pointing to services you no longer use.
- Enable DNSSEC where your DNS host and registrar support it.
- Keep a domain register, add DNS clean-up to offboarding steps and review both twice a year.
If you would like a second pair of eyes on your domains, registrar access or DNS records, we are happy to help.