Who controls your domain, DNS and admin accounts? An ownership checklist for SA small businesses and councils

Ask a small business, not-for-profit or council who controls its domain name and it is surprisingly common to hear “the web developer set that up”, “it is on someone’s personal card” or “we are not sure”. The domain, the DNS records behind it and the administrator accounts for Microsoft 365, the website and the cloud are the keys to everything else. If a domain lapses, email and the website stop. If a former supplier or staff member holds the only login, a simple change can turn into weeks of chasing. If an attacker takes over the registrar account, they can redirect your email and website. This checklist explains, in plain words, how South Australian organisations can find out who holds each key, put them in the organisation’s name and keep them safe. It is general guidance, not legal advice.

The accounts that matter most

These are the accounts we check first, because losing any one of them can stop the business or let someone impersonate it:

Account	Why it matters
Domain registration (the registrar account)	Controls renewal, transfer and which DNS servers your domain uses. Whoever controls it can point your email and website anywhere.
DNS hosting	Holds the records for your website, email delivery, SPF, DKIM and DMARC, and verification for services such as Microsoft 365 and Google Search Console. It is often with a different company from the registrar.
Microsoft 365 or Google Workspace	The administrator accounts control every mailbox, file and user. These are the most valuable accounts most organisations have.
Website hosting and CMS	The hosting account, the content management system administrator and any plugins or themes with paid licences.
Cloud accounts	AWS, Azure or other cloud accounts, including the root or billing owner, which can close the account or change who has access.
Code and app stores	Source code repositories and Apple or Google developer accounts for any app you have paid for.
Search and listings	Google Search Console, Google Business Profile, analytics properties and Bing Webmaster Tools. These shape how people find you and what search results say about you.
Forms, payments and booking tools	Online form, payment and booking services that collect information or money in your name.

How .au domain names work

A .au domain name is not bought outright. It is a licence held by a registrant, issued through an accredited registrar (sometimes via a reseller such as your web host), under rules set by .au Domain Administration (auDA). A few points matter for ownership:

• The registrant should be your organisation. Anyone holding a .au name must meet the Australian Presence requirement, most commonly through an ABN or ACN. For a business, the registrant should be the legal entity that runs it, not a staff member personally and not the web developer.
• com.au and net.au names have extra rules. The name generally needs a close connection to the registrant, such as a match or acronym of its business name or trade mark. Your registrar can confirm eligibility for a particular name.
• Licences run for one to five years. Choosing a longer licence period and turning on automatic renewal removes most of the risk of an accidental lapse.
• Government names are different. Domains ending in .gov.au, including those used by SA Government agencies and councils, have their own eligibility rules and administration process. Your ICT team or the relevant government domain administrator manages those, but the same account security principles apply.

A public .au lookup shows the registrant name and the registrar for any domain, which is a quick first check of who holds yours.

Secure the registrar account

The Australian Signals Directorate’s guidance on DNS security for domain owners and the small business guidance on cyber.gov.au point to the same basics:

• Turn on multi-factor authentication. Prefer an authenticator app, passkey or security key over SMS or email codes.
• Use a strong, unique password kept in the organisation’s password manager, not one person’s browser.
• Use an organisational contact. Registrar notices should go to a shared mailbox that more than one person reads, so renewal and change alerts are not lost when someone leaves.
• Renew early and keep old names. Turn on auto-renewal and keep the payment card current. Keep renewing domains you no longer use, such as old business names after a rebrand, so nobody else can register them and send email that looks like yours.
• Lock the domain. A registrar or transfer lock stops unsolicited transfers. For a domain the organisation cannot do without, ask your registrar whether a registry lock is available, which adds identity checks before key changes.
• Review access. Check who can log in to the registrar account at least twice a year, and read account change alerts when they arrive.

Keep DNS tidy

• Know where DNS is hosted. The registrar record shows which name servers your domain uses. Make sure your organisation has its own login to that DNS service.
• Keep a copy of your records. Export the zone or keep a simple list of each record, what it is for and who asked for it, so you can rebuild it quickly if a provider changes.
• Remove records you no longer use. A record pointing at a cloud service, website or tool you have cancelled can sometimes be claimed by someone else, who can then publish content on your subdomain.
• Protect email. SPF, DKIM and DMARC records make it harder for criminals to send email as you. Our SPF, DKIM and DMARC guide explains how to set them up without losing legitimate mail.
• Consider DNSSEC and CAA records. DNSSEC helps protect people looking up your domain from forged answers, and a CAA record limits which certificate authorities can issue HTTPS certificates for it. Ask your DNS provider whether it supports both.
• Change DNS with care. Agree who can make changes, note each change and the reason, and avoid making changes late on a Friday.

Administrator accounts for Microsoft 365 and the cloud

• At least two named administrators from your organisation, so access never depends on one person.
• Separate admin accounts from everyday accounts, protected with phishing-resistant multi-factor authentication. Our guide to Zero Trust and Conditional Access explains the identity basics.
• An emergency access account for Microsoft 365, sometimes called break-glass, that is held by your organisation, stored securely, monitored and tested, for when normal sign-in fails.
• Supplier access through delegation. Your IT provider should sign in with its own named accounts, for example through Microsoft’s granular delegated admin privileges for partners, rather than a shared global administrator password. That way you can see what it does and remove its access cleanly.
• Cloud root and billing accounts registered to an organisational contact, protected with multi-factor authentication and not used for day-to-day work.

Websites, code and search listings

• Hold the hosting account, CMS administrator access, paid plugin licences and the code repository in your organisation’s name, with your supplier added as a user.
• Make your organisation the owner of Google Search Console, Google Business Profile and your analytics property, and give the supplier user access. That way your listings and search data stay with you if you change supplier.
• Keep your business details, such as address, phone and opening hours, consistent everywhere they appear, because search engines and AI summaries draw on all of them.
• If you are briefing a new website or app, write ownership into the contract from day one. Our guide to briefing a software or website project covers what else to include.

Keep a simple ownership register

A one-page register, kept somewhere more than one person can reach, saves a great deal of stress. For each account, record:

1. The service and what it is used for.
2. The account holder, which should be the organisation.
3. The named administrators, and whether each uses multi-factor authentication.
4. The renewal date and how it is paid.
5. Which suppliers have access and through what kind of account.
6. Where the recovery details are kept, without writing passwords in the register itself.

Review it every six months and whenever a staff member or supplier changes. Our staff onboarding and offboarding IT checklist includes the steps for moving accounts away from people who leave.

Getting control back

The easiest time to move an account into your name is while the relationship with the person or supplier who holds it is still good. Ask for the transfer in writing, change the registrant or account owner to your organisation, then change the passwords and multi-factor methods and remove access you no longer need. For a .au domain, the new registrant must meet the eligibility rules, and the change is made through the registrar. If a former supplier will not respond, your registrar can explain the options and what evidence it needs, and auDA publishes its complaints process for .au names. When choosing a new provider, our managed IT provider checklist and our guide to service provider due diligence and exit planning explain how to write ownership and a clean exit into the agreement.

Questions to ask your IT or web provider

1. Who is the registrant of our domain names, and can you show us the registrar record?
2. Do we have our own administrator login to the registrar, DNS, hosting and code repository?
3. When does each domain expire, and is auto-renewal on?
4. Which of your staff can administer our Microsoft 365 or Google Workspace, and through what kind of account?
5. Do we own our Google Search Console, Google Business Profile and analytics, with you as a user?
6. If we change provider, what will you hand over, and how quickly?

This article reflects common practice and published guidance as at late 2026. auDA rules, registrar features and cloud platform settings change, so check current details with your registrar and provider before making changes.

Once ownership is sorted, keep it that way with a yearly review of renewal dates and admin users; our website care and maintenance guide includes it in a simple schedule.

Talk to an Adelaide team

If you are not sure who holds your domain, DNS or admin accounts, talk to us about an ownership and access review or call 0402 401 584. We can quote a short review that maps every key account, checks multi-factor authentication and renewals, and gives you a register and a plan to move anything held elsewhere into your organisation’s name. You can also read about our managed IT and cyber security, website design and DevOps and cloud engineering services, or the identity and single sign-on reference architecture in our Learn section.