Domains & Ownership
Your web agency should never
Agencies can manage your DNS, but the domain itself belongs to your business, and the login belongs to a director.
Your web agency should never own your domain name
Another business went offline this week because the agency that registered its domain did not renew it. Website, email and Google Ads, all gone at once. Here is who should own your domain, who should get access, and the ten-minute check to make sure it never happens to you.
Created: September 9, 2026 | Updated: 09/09/2026 | Reading Time: 7 mins
Another one today. A business rang us because their website had disappeared, their email had stopped and their Google Ads had been paused. Nothing had been hacked. Nobody had touched the site. The domain name had simply expired, because the agency that registered it years ago had not renewed it. The renewal reminders went to an inbox at that agency that nobody reads anymore, and the whole business went dark on a Wednesday morning.
We see this more often than we would like, and it is nearly always the same story. So this is our position on it, written down once so we can point people to it.
Our stance: your domain name belongs to your business, full stop. A web agency or IT company can manage your DNS, but it should never own the domain, and the registrar login should sit with a founder, director or CEO. Everyone else gets sub access.
Why a lapsed domain takes everything down with it
People think of a domain as the website address. It is much more than that. Your domain is the thing every other service hangs off. Your website resolves through it. Your email is delivered through its MX records. Google Workspace or Microsoft 365 verify you own it. Your SSL certificate is issued against it. Your booking system, your CRM, your invoicing software and your Google Ads landing pages all point at it.
When the domain expires, all of that stops at once. The website returns a parking page or nothing at all. Email bounces, so the customers trying to tell you the site is down cannot reach you either. Google Ads notices the landing page is dead, disapproves the ads and stops serving them, and getting them re-approved once the domain is back is not instant. If the domain sits expired long enough it goes through a redemption period and then gets released, at which point anyone can register it, and some people make a living out of doing exactly that.
For an Australian business there is an extra layer. A .com.au domain must be registered to an entity with a valid ABN, and we wrote about how a lapsed ABN can quietly cost you your domain earlier this year. If your agency put themselves down as the registrant, the domain may not even be validly held in the first place.
How domains end up in the wrong hands
Nobody sets out to lose their domain. It happens because at some point it was convenient for someone else to register it. A web designer needed a domain to launch the site, so they bought it in their own registrar account. An IT company set up the email, so they registered the domain under their reseller login. A staff member bought it on their personal card in 2017 and left in 2019.
Then time passes. The agency closes, gets bought or just stops answering. The card on file expires. The renewal emails go to an address nobody monitors. The person who knew the login is gone. And one day the domain quietly lapses and the business finds out when the phone starts ringing.
The frustrating part from our side is that we often cannot tell who actually holds the domain. Public WHOIS details are limited these days, the registrant listed is a trading name from three owners ago, and the technical contact is a Gmail address that bounces. We have spent whole days chasing down a registrar login so we can point a domain at a new server, and every one of those days is a day the client is offline. It is a real pain, and it is entirely avoidable.
Owning the domain and managing the DNS are two different things
This is the distinction that matters, so it is worth being precise. The domain is registered at a registrar. That registrar account is ownership. Whoever controls it can renew the domain, transfer it, change the nameservers or let it expire. DNS is the set of records that tells the internet where your website and email live. DNS can be delegated to someone else, and it is completely normal for your web agency to run it.
We manage DNS for most of our hosting clients. That is how we migrate sites, set up email records, add verification records and keep everything running without bothering you. But we do not want to own your domain, and we do not want the registrar login. If DeCODE disappeared tomorrow, you should be able to log into your registrar, point the nameservers somewhere else and be back online in an hour. That is what ownership gives you. If we held the domain, you would be stuck waiting on us, or worse, waiting on whoever ends up with our accounts.
Who should hold what
Here is the access model we recommend to every client, and the one we follow ourselves.
The business owns the domain
The registrant is your legal entity, with your ABN. The registrar account is in the company name, on a company email address that will still exist in ten years (hello@ or accounts@, not someone’s personal Gmail), and the renewal is paid on a company card. The login is held by a founder, director or CEO. Not because they will ever touch it, but because they are the person least likely to leave and most motivated to keep it alive.
Technical people get sub access
Most registrars let you add additional users to an account. That is how your in-house tech person, your office manager or your marketing lead should get in: a seat of their own, with enough permission to change DNS records, and no permission to transfer the domain or close the account. When they leave, you remove the seat and nothing else changes.
Agencies get delegated DNS, nothing more
Your web or IT agency gets to manage DNS, either through a sub user on the registrar or, better, by pointing the nameservers at a DNS provider like Cloudflare where the agency runs the zone. They can do everything they need to do for your website and email from there. They never need the registrar login, and you should be wary of any agency that insists on it. The one exception is when a business has a dedicated internal IT team, in which case the team can reasonably hold the registrar seat and the agency works through them.
Ten minutes that could save your business
If you are not completely sure who holds your domain right now, do this today.
1 · FIND IT
Look up your domain in a WHOIS tool. For .au domains the auDA WHOIS shows the registrar, the registrant and the expiry date.
2 · CHECK THE REGISTRANT
It should be your legal entity and your ABN. If it says the name of an agency, an old trading name or a person, that needs fixing.
3 · GET THE LOGIN
Ask whoever holds the registrar account to transfer the domain into an account you own. Any reputable agency will do this without fuss.
4 · FIX THE CONTACTS
Put a company inbox on the account, turn on two-factor authentication, and make sure the renewal notices land somewhere a human reads.
5 · RENEW LONG
Turn on auto renew with a company card and renew for the longest term the registrar allows. Five years of .com.au costs less than one hour of downtime.
6 · WRITE IT DOWN
Record the registrar, the account owner, the expiry date and who has sub access in your company password manager. Add a calendar reminder 60 days before expiry.
What we do at DeCODE
We host and look after a couple of hundred websites, and we do not hold a single client domain. When we onboard a new client, the first thing we ask is where the domain lives and who has the login. If the answer is “I think our old web guy has it”, we help chase it down and get it moved into an account the business owns before we do anything else. It is not the glamorous part of a website project, but it is the part that means the site is still there in five years.
If you have read this far and felt a small flicker of doubt about your own domain, act on it. Go and look it up. And if the answer is messy, or you cannot get a straight answer from whoever holds it, get in touch. We have untangled plenty of these and we are happy to help with yours.
On this page
We’re here to help you DeCODE the Digital World
DeCODE builds breathtaking websites that drive sales for your business without a price that would take your breath away.
We understand that Companies don’t need websites. Companies need a regular stream of high-quality leads. Customers eager, educated, and ready to purchase their products or share their vision. This is the core of a DeCODE build.
In 2026 websites are no longer set and forget, winning an online race is now a marathon, not a sprint. Visually stunning sites with limited back end functionality and no ability to perform in search are redundant.
At DeCODE we build sites that perform.
Ilana is a Web Designer & Development Consultant with 15+ years building websites that actually perform: ecommerce stores, membership platforms, training portals, and SEO rebuilds that turn slow, dated sites into properties that rank and convert.