Held to domain ransom
By Steven Coochin — 2026-07-09
This article first appeared in the July 2026 CCBG Telegraph.
Plenty of business owners don't realise how little control they have over their domain name until they try to make a change. For example, they want to switch web hosts, repoint their email, or move to a new provider altogether, and they hit a wall. The provider who set them up (probably years ago) is sitting on the domain and won't budge or help. Most accept it, because nobody has ever explained what they're actually entitled to.
For an established business, that domain is the backbone of the whole operation. It's your virtual business address and arguably more important than the physical one. A domain has a big job; the website hangs off it, the email runs through it. If there's an online store, the orders and the payments are tied to it too. Years of customers know the address off by heart. It isn't one line on a list of assets; it's the thing the rest of the business is bolted to. Which is what makes it such a useful thing for someone else to sit on.
When the provider won't let go, it plays out as a quiet kind of ransom. No demand in writing, just a phone that stops getting answered, an invoice that has to be paid first, a login that never quite arrives. And in nearly every case, the arrangement doing the holding isn't simply unfair. It breaks the rules. To see why, you have to start with what a .com.au actually is.
Start with the ABN
Every .com.au and .net.au domain sits under one set of rules, written by the .au Domain Administration (auDA). To hold one, you need what they call an Australian Presence, and for an ordinary trading business that means you have an Australian Business Number (ABN).
This is the part that matters. You register the domain against your ABN, and the rules then require the name to relate to that entity, its legal name, business name or trade mark. The licence is issued to the business behind that ABN, recorded against that ABN, and meant to sit with it. In every sense that counts, the domain belongs to the ABN it was registered under, not to the web developer or domain seller who happened to fill in the registration form.
Whose name is on it
Which is exactly where it goes wrong. When a provider registers a client's domain under the provider's own ABN, the public record shows the provider as the holder. The business that paid for it, built its brand on it and runs every email through it doesn't appear anywhere.
The rules speak to this directly. Where someone applies as an agent for a client, the registrar must record and verify the client's details, not the agent's. A provider putting their own ABN on your domain is doing the exact opposite of what the rules intend, and they usually know it.
Nobody actually owns a domain, and that helps you
In every way that matters, the domain belongs to the business behind the ABN. But strictly speaking, nobody owns a .au domain outright. auDA's own rules spell it out: a person does not legally own a domain name. What you hold is a licence to use it, issued to whoever is on record as the registrant.
That sounds like it weakens your hand. It does the opposite.
Because the thing being held isn't property, a provider sitting on your domain isn't guarding an asset of theirs. They're holding a licence that, by every measure auDA cares about, should be in your name. A web developer is your agent and your supplier. They were never meant to be the registrant of your business's front door, and the rules don't let them keep it just because they typed the details in first.
auDA also bans holders of a .com.au domain from leasing, renting, or sublicensing it to someone else. That cosy "we'll hold it, you can use it" setup some providers lean on isn't a grey area you can argue both ways. It's the precise arrangement the rules were rewritten in 2021 to stamp out.
Moving on shouldn't cost you
You can move your domain to a new provider at any point during the licence period. That's your right, plain and simple, and it's worth knowing the part some providers hope you don't.
There is no fee to move a .au domain from one provider to another. None. auDA states this directly: there is no fee for transferring a .au domain name licence between registrars. The rules go further and say the provider you're leaving has no right to drag its feet or block the move. Stalling is not a service. It's a breach.
One honest distinction so nobody catches you out. Moving your domain to a new provider while you remain the owner is free.
Changing who the registrant is; say you're finally getting the domain out of the old developer's name and into your business's name, or you've bought a business, can carry a small change of registrant fee plus a new licence fee. That one is legitimate, because someone has to check both parties are eligible to hold the name. The fee to be suspicious of is the one charged simply for leaving. That fee isn't allowed.
The keys are yours, and auDA will hand them over
Every .au domain has an authorisation code, sometimes called a domain password. It's the key that authorises a transfer, not the login your provider gives you for their dashboard. It's yours, tied to the domain itself.
So if your provider goes quiet, you are not stuck waiting on them. You can retrieve the code yourself directly from auDA at pw.auda.org.au. A registrar is also required to give you that code when you ask for it. Holding onto it isn't them protecting you. It's them breaking the rules.
There's a catch, and it loops right back to where we started. That code is only ever sent to the registrant contact email listed in the registry record. If your old provider put their own details in that field instead of yours, the code lands in their inbox, not yours. Which is the whole reason the name and the contact details on the record need to be yours, not theirs.
And it isn't only about leaving. Pointing your domain to a new website or email host is a basic change you're entitled to have made. If your provider won't update your nameservers when you ask, or won't give you the access to do it yourself, take that as your signal. You can move the domain to a provider who will, and as we've covered, that move costs you nothing.
How to check in about five minutes
You can look all of this up yourself. Go to the auDA WHOIS tool, search your own domain, and read the registrant field. If the ABN listed isn't yours, that's the first thing to sort out. You're entitled to be the registrant, and you're entitled to move the domain to a registrar of your choosing. A provider can't lawfully refuse to release a domain that should have been in your name from the start.
If you hit a brick wall, you don't have to fight it out on your own. auDA runs a complaints process, starting with the registrar and escalating up to auDA, built for exactly this: registrants who can't get hold of what's already theirs.
I'll be honest about how often this comes up. When we take a business on from another provider, reminding the old one of these rules is close to routine. Most release the domain the moment you quote chapter and verse, because they know the position doesn't hold up. A few dig in. Those are the ones worth knowing the rules for.
Your domain is the front door to your business. Worth making sure the keys are in your name.
If you would like a hand checking who is actually on record as the holder of your domain, or moving it into your business's name, get in touch. It is what we do.