RemoteWebsite and domain audit
Do you actually own your domain? Many businesses find out too late.
Your domain runs your website and your email. When it is registered to a former developer, renews on an expired card or sits behind one person's login, a small mistake takes the whole business offline. Here is what to check, the .au rules, and a 10-point audit you can run now.
.au rules from auDA, checked 30 October 2026.
- Ownership and access
- DNS and email records
- 10-point audit
Reviewed by Blake Bath, General Manager, on 30 October 2026.
What we find
Five domain and website problems we find.
Every one of these has taken a business offline.
Registered to someone else
The developer, an agency or a staff member who has since left.
- Transfer to the business
- ABN on record
- Shared login
Expired card on renewal
The domain lapses and email stops on a Monday morning.
- Auto-renew
- Notices to a shared inbox
- Multi-year term
Nobody knows the DNS
Records nobody can explain, at a host nobody can log in to.
- Record list
- Known host
- Change control
Forms that send as you
Website mail with no SPF or DKIM, landing in spam or easy to spoof.
- Authenticated sender
- SPF and DKIM
- DMARC reports
Outdated website software
Old plugins and admin logins without MFA.
- Updates
- Fewer plugins
- MFA on admin
Website and domain audit
Run a 10-point website and domain audit.
Tick what you can confirm today. If you are not sure, leave it unticked. You get the gaps in the order we would fix them.
Tick what you can confirm today.
Where you stand
0of 10 checks in place
10 gaps to close.
- The domain is registered to the businessWhoever is the registrant controls your website and email.
- We can log in to the registrar ourselvesLocked-out businesses lose days proving ownership.
- Auto-renew is on with a current cardAn expired domain takes your email down with it.
- We know where DNS is hostedUnknown DNS changes break email and websites.
- SPF, DKIM and DMARC are set upStops scammers sending as your domain.
- Website forms and apps send mail properlyUnlisted senders land in spam or get spoofed.
- HTTPS certificates renew automaticallyAn expired certificate scares visitors away.
- The website software is kept updatedOutdated plugins are a common way in.
- The website is backed up off the hostHost backups vanish with the host account.
- Former developers and staff have no accessOld access is the easiest door.
The layers
What a website and domain audit covers.
| Layer | Check | Why |
|---|---|---|
| Domain | Registrant, ABN, registrar login, renewal date, auto-renew | Control of your name |
| DNS | Host, every record and its purpose, who can change it | Website and email depend on it |
| Email records | MX, SPF, DKIM and DMARC for every sender | Delivery and spoofing |
| Hosting | Account owner, plan, PHP or platform version, backups | Availability and recovery |
| Certificates | HTTPS on the site and subdomains, auto-renewal | Trust and browser warnings |
| CMS | Core, theme and plugin updates, admin accounts, MFA | The most common way in |
| Access | Everyone with registrar, DNS, hosting, CMS and analytics access | Former staff and agencies |
Australian domains
What the .au rules mean for you.
- Australian presenceNeeded for any .au name. Businesses usually meet it with an ABN or ACN.
- Trade mark routeForeign entities can rely on an Australian trade mark, but the name must then exactly match it.
- Renew earlyUp to 90 days before expiry. The new period starts when the current one ends.
- Keep details currentRegistrant and contact details should match the business, so renewals and transfers go smoothly.
The current .au licensing rules started on 12 April 2021.
Our view
Get the keys back while everyone is friendly.
The hardest domain problems we fix are not technical. They are a domain registered to a developer who has moved on, or a registrar login nobody can reach. Fixing that takes a polite email today, or weeks of paperwork after something breaks.
Once the business owns its domain, DNS and hosting accounts, the rest is routine: records documented, renewals automatic, website updated and backed up, and access reviewed whenever someone leaves.
The order
Taking control of your website and domain in five steps.
- Step 1Find the accounts
Registrar, DNS, hosting, CMS and email.
- Step 2Bring them into the business
Registrant, logins and billing in the business name.
- Step 3Document DNS
Every record and what it does.
- Step 4Fix email and HTTPS
SPF, DKIM, DMARC and auto-renewing certificates.
- Step 5Maintain
Updates, backups and an access review each year.
Related guides
The domain is the start. Email and DNS are the rest.
Records, email and security.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about websites and domains.
Who should own our domain name?
The business itself, registered with its ABN or ACN, with login details held in a shared business account. Not a staff member, a former web developer or a marketing agency. For .com.au, auDA rules require an Australian presence, which businesses usually meet with an ABN or ACN.
Our web developer registered the domain. What do we do?
Ask them to transfer the registrant to the business and give you your own login at the registrar. Do it while the relationship is good. If they will not or cannot, your registrar and auDA have processes, but they take longer.
What happens if our domain expires?
Your website and email stop working, often on the same day. After a grace period the name can be lost. Turn on auto-renew, keep the card current and send renewal notices to a mailbox someone reads. .au names can be renewed up to 90 days early.
Why does our website contact form email go to spam?
Usually because the website sends as your domain without being listed in SPF or signing with DKIM. Send through an authenticated mail service and add it to your records. Microsoft is also turning off Basic authentication for SMTP by default at the end of December 2026, which breaks sites and devices that send with a mailbox password.
How often should we audit our website and domain?
Once a year, and whenever a developer, agency or staff member with access leaves.
Next step
Want to know who really controls your domain?
We find every account behind your website and email, bring them into the business, document DNS, and fix the records and renewals.
Keep reading
Reviewed by Blake Bath, General Manager, on 30 October 2026. .au rules from auDA. Email sending guidance from Microsoft and ASD. Checked 30 October 2026. auDA, .com.au and .net.au rule changes explained; ASD, Protecting against business email compromise; Microsoft Learn, Sending email from devices and applications