Get your website and domain logins back from a web designer

A web designer or agency that builds your site often buys the domain, sets up hosting and creates email accounts too. That’s convenient until the relationship ends and the domain turns out to be in their name, or the logins sit in an inbox you can’t reach.

This guide uses auDA’s published rules for .au domains to show how to find out who controls each piece and how to get control back. It is general information, not legal advice. Your contract with a designer, and who owns the site’s design and content, are questions for a lawyer.

The pieces, and who might hold each

A working website depends on several separate things: the domain name licence (held by a registrant, through a registrar or reseller), the registrar or reseller account, DNS (the name servers that point the domain at your site and email), hosting, email, and the website admin login. Getting the domain back doesn’t automatically give you the rest, so check each one.

Step 1: Look up who holds the domain

Use the official .au WHOIS. auDA’s guide to the tool says it lets you identify “the registrant of a .au domain name (the person or entity that holds the domain name licence)”. Enter just the domain, for example “auda.org.au”.

Read these fields:

Registrant. The legal name of the individual, company or other entity that registered the name. It should be your business.
Registrant ID. Often an ABN or ACN. Check it is yours, not your designer’s.
Registrant Contact Email. Where renewal and transfer messages go.
Registrar Name and Reseller Name. It may be a different brand from who you dealt with.
Name Server. The DNS service the domain uses. Registrants can change DNS provider at any time.

The WHOIS Policy says street addresses and phone numbers aren’t disclosed, and expiry dates are left out of public results.

If your domain ends in .com or another generic ending, auDA’s WHOIS won’t cover it. ICANN’s Transfer Policy gives the “Registered Name Holder” listed in the public WHOIS authority to approve a transfer. The policy is under review, so ask your registrar how the current rules apply.

Step 2: What auDA’s rules say about designers as registrants

Under the Licensing Rules, a person may use an agent to apply for a licence. The agent “must ensure that the Person on whose behalf they are applying is recorded as the Registrant in the Registry Data” (rule 2.2.6). The rules also say a person must not use a proxy or privacy service to apply for a licence (rule 2.2.3). That does not by itself mean a designer holding the name is a proxy service.

If your designer applied as your agent and is listed as the registrant, the rules expect you to be recorded instead (rule 2.2.6). On our reading, that suggests the record may be wrong. Your options:

A registration error. The rules let a registrant ask the registrar to correct the record where a licence was incorrectly registered in the name of the reseller or other agent who arranged it. That request “must be made within 14 calendar days of the Licence being recorded”, and it applies only to genuine errors made in good faith. On our reading, that window has closed for an older domain.
An agreed handover. The registrant asks their provider for a change of registrant to you. Under auDA’s transfer page, both parties must be eligible, and you enter a new licence agreement. This needs the designer’s cooperation.
A refusal. Use the complaint process in Step 4.

Step 3: Get the transfer code and fix the contact details

auDA calls the transfer code the “authorisation code”, and says it’s also known as a domain name password, authcode or EPP authInfo code. It isn’t your provider account password, and it is unique to each domain.

auDA’s transfer page says you can get it by:

contacting your current registrar, who will send it to the registrant contact email listed in the registry, or
using the password recovery tool.

auDA says the recovery email goes only to the registrant contact email and “cannot be redirected to another email address”. It also includes the expiry date and the registrar of record’s name.

If that email address is out of date, the Registrar Rules cover it. Where the registrant hasn’t kept accurate contact details, the registrar must validate the registrant’s identity and provide the code, to them or to a representative nominated in writing, within two calendar days (rule 2.10.12). A registrar must also tell the registrant to update their contact details before any transfer, and mustn’t transfer a licence if the registry contact information is incorrect or incomplete (rule 2.10.13). So update your details first.

To update them, contact your provider. auDA’s update page says you can contact the auDA team if your provider hasn’t helped.

Moving to a new registrar is free under auDA’s rules, and after approval it can take up to three days. It can’t go ahead while the licence is under a complaint to the Licence Review Panel, an internal review or an auDRP dispute. For moving a live site as well, see how to move your website to a new host without losing Google rankings.

Step 4: If the designer or provider won’t cooperate

auDA’s complaints page describes two paths:

Complaints about .au licence eligibility and about registrar or reseller conduct under the Licensing Rules.
Disputes under the auDRP, for legal rights such as intellectual property.

Under Part 3 of the Licensing Rules, a complaint goes first to the registrar of record, in the form that registrar requires. The registrar has 30 calendar days to resolve it unless it tells you it needs longer. If you’re unhappy with the decision, you can apply to auDA for a review, but only after exhausting the registrar’s process, and generally within 28 calendar days of the decision (five calendar days if the registrar decided to cancel the licence). Part 3 doesn’t stop you taking legal action, but starting legal proceedings about the same matter ends any Part 3 complaint (rule 3.9.2), so get legal advice before choosing.

On our reading, these processes cover the domain licence, not disputes over invoices, ownership of the site’s design or access to hosting. A current complaints process also blocks a transfer, so weigh that before lodging one.

To find every .au name registered under your business, use auDA’s registry search request form. It searches by name, ABN or ACN across all accredited registrars, needs proof of identity or authorisation, and auDA says it will respond within 14 calendar days.

Step 5: Check hosting, DNS and email before anything changes

We haven’t found an authoritative rulebook for hosting, so this is a practical order of work.

Ask for the hosting account, or a full backup. You need the files, database and admin login, in your name.
Note your DNS records first. Copy every record at the current DNS provider before you change name servers, so website and email keep working. auDA says website and email services stop while an expired .au licence is in its 30-day grace period, so don’t let the name lapse mid-handover.
Check where email lives. Confirm who administers your mailboxes and set up your own admin account. If a mailbox has already been taken over, see what to do in the first hour after a business email account is hacked.
Change every password afterwards. Turn on two-factor authentication, as in our guide for business accounts.

Checklist

Look up your domain on the .au WHOIS. Search at whois.auda.org.au and write down the registrant, registrant ID, registrant contact email, registrar and name servers.
Compare the registrant with your business. The registrant should be your business’s legal name with your ABN or ACN, not your designer or agency.
Request the transfer code. Use pw.auda.org.au, which emails the code and the expiry date to the registrant contact email, or ask your current registrar.
Update the registrant contact email. Ask your registrar or reseller to change it to an inbox the business controls, such as a role-based address, and do this before any transfer.
Ask the registrar for the code if the email is out of date. Under the Registrar Rules, they must verify your identity and send the code within two calendar days.
Run an auDA registry search. Submit the Registry Search Request Form with your ABN or ACN to find other .au names registered under your details.
Copy your DNS records and get hosting access. Export every DNS record and secure a backup of the site files and database before moving the domain or name servers.
Lodge a complaint with the registrar of record if it refuses. Put it in writing in the form the registrar requires, and diarise 30 calendar days for a response and 28 days after a decision (5 days if it cancelled the licence) to ask auDA for a review.
Change every password and turn on two-factor authentication. Do this for the registrar account, hosting, website admin and email once access is yours.