Domain names: renewals, and why it matters who controls yours

Domain names: renewals, and why it matters who controls yours

Your domain name — the yourbusiness.com.au part of your website and every staff email address — is one of the most valuable things your business owns, and one of the least understood. It is worth ten minutes to get right, because the failure modes are avoidable and the consequences are not small.

You rent a domain, you do not buy it

Nobody owns a domain outright. You hold the right to use it for a period, typically one or two years, and you renew that right before it lapses. The company you pay is a registrar — a business licensed to register domains on your behalf.

If the renewal is not paid, the domain stops working. Your website goes offline and, more importantly, your email stops. Not delayed — stops. Messages to your business bounce back to the sender, and you never see them.

After a period, a lapsed domain can be released for anyone to register. Recovering one at that point ranges from expensive to impossible, and "impossible" means changing every email address in your business, every business card, every invoice template, every listing and every sign on a vehicle.

Why renewals get missed

Almost never because anyone was careless. The usual causes:

  • The notice went to an old address. The domain was registered years ago by a web designer, a former staff member, or on someone's personal address. That mailbox no longer exists or nobody reads it, so the warnings arrive nowhere.
  • The card on file expired. Auto-renew was on, the credit card was replaced, and the failed payment notice went to the same unread address.
  • The relationship ended. The business parted ways with the web designer or provider who registered the domain, and nobody moved it.
  • The notice looked like spam. Renewal emails are dry and easily deleted, and there is a long-running scam industry of fake domain invoices which makes people distrust the genuine ones.

Whoever controls the registrar account controls your business

This is the part worth reading twice. The registrar account is the master switch. Whoever can log in can point your email anywhere, point your website anywhere, or transfer the domain away.

That is a great deal of power to leave with a third party by accident. It usually happens innocently — a designer set the site up in 2016 and registered the domain under their own account because it was easier at the time. It only becomes a problem when you want to change providers, when the relationship sours, or when that person becomes unreachable. We have seen businesses effectively locked out of their own email because the only person who could authorise a change had moved overseas.

How it should be set up

  • The registrar account is in the business's own name, with the business as the registrant. Not a staff member personally, not a supplier, not a contractor.
  • The contact address is a monitored business mailbox that is not on the domain itself. This matters more than it sounds: if renewal notices go to an address at the very domain that is expiring, you will not receive the warning that it is expiring. A separate address breaks that circle.
  • More than one person can get into the account. If only the director knows the login and they are on leave when something goes wrong, that is a single point of failure.
  • Auto-renew is on, with a current card, and the expiry date is also written in a calendar so it is not the only line of defence.
  • The login details are recorded somewhere proper — a password manager the business controls, not a sticky note or one person's memory.
  • For .com.au domains, the eligibility details are current. Australian domains are tied to an ABN or business name, and if those change, the domain record should follow.

Where we fit

We are happy to be the technical contact on your domain, to monitor expiry dates, and to make changes when you need them — without the domain being registered to us. That is deliberate. We do not think an IT provider should hold the keys to a client's identity, and you should be able to leave any supplier, including us, without asking permission to keep your own email working.

If you are not sure who currently controls your domain, ask us. We can look up the public record, tell you what it says, and if it turns out to be sitting with someone unexpected, help you move it into the business's own account properly.

Talk to us

To check who controls your domain, or to arrange expiry monitoring, email support@yougrowit.com.au or log a ticket at portal.yougrowit.com.au. For quotes or account changes, email admin@yougrowit.com.au.

If a domain has already lapsed and your email has stopped, treat it as urgent and call 03 9028 4358 — the recovery window matters.

Support hours are Monday to Friday, 8:30am to 5:30pm Melbourne time, excluding Victorian public holidays.

    • Related Articles

    • Changing website or email provider without losing your email

      Moving your website or your email to a new provider is routine work and usually goes without incident. When it does go wrong, it almost always goes wrong the same way, and it is worth knowing what that way is before you sign anything. The mistake ...
    • Your website is offline: how to tell what is wrong

      You type in your web address and nothing loads, or you get an error page. Before anyone panics, the first job is to find out whether the site is genuinely down for everybody or whether it is only down for you. Those are completely different problems ...
    • SPF, DKIM and DMARC in plain English

      If your emails are landing in customers' junk folders, or bouncing back with a message about authentication, someone has probably mentioned SPF, DKIM and DMARC. Here is what they actually are, without the jargon. All three are small settings ...
    • The security certificate on your website has expired

      A customer rings to say your website is showing a red warning, or you open it yourself and get a full-page message saying "Your connection is not private", "Not secure", or "This site's security certificate is not trusted". Usually this means the ...