Recovering a .com.au Domain From an Uncooperative Agency

Key takeaways

• A .com.au domain transfer must be requested in writing, and once a valid authorisation code is supplied, the current registrar must complete the move within two calendar days
• The au Dispute Resolution Policy (auDRP) does not apply to a dispute with your own agency. It only covers third-party trademark and naming claims
• auDA’s Complaints Policy lists ownership disputes and unauthorised transfers as domain complaint categories it will investigate
• Registrants must report a change of registrant details within 14 calendar days, and a registrar must supply an authorisation code within two calendar days if contact details are accurate
• auDA can correct registrant details or reverse an unauthorised transfer, but it cannot fine anyone and has no power over a fee dispute
• The practical bottleneck is almost never the rule. It is finding a working contact for whoever is currently listed as registrant

If your former web developer or agency still shows up as the registrant on your .com.au domain, you are not stuck, but you are also not owed an instant fix. auDA, the body that administers .au domain names, has a written process for exactly this situation. It is faster than most people expect when the current registrant cooperates, and considerably slower when they do not.

This is not the same question as “who owns my website.” That is a broader ownership question covering code, content and hosting, and we have covered it separately. This post is narrower and more urgent: you need the domain itself, and you need to know which lever actually moves it.

What auDA’s Rules Actually Say

auDA’s .au Domain Administration Rules: Licensing sets out who counts as the registrant and how a licence changes hands. A registrant is the person or entity issued the licence, and the rules are specific that a registrar must not act as an agent for an applicant, and that the actual applicant, not the registrar or reseller managing the account, must be recorded as registrant. In practice this means that if your practice was always the intended holder of the domain, an agency listing itself as registrant sits awkwardly against the rule’s own intent, even if it is common practice.

Three clauses do the practical work of recovery:

• A registrant must report a change to their recorded details within 14 calendar days of becoming aware of the change.
• A transfer request must be in writing and supported by a valid authorisation code, and the current registrar must complete a transfer within two calendar days of receiving it.
• If a registrant enters a contract to transfer the licence, the transfer must be requested within 28 calendar days of that contract being entered into. The rules do provide for cancellation of the licence, but that consequence is tied to failing to complete the core transfer requirements, eligibility, a written request and the registrar’s own two-day window, not specifically to missing the 28-day request deadline on its own.

Separately, auDA’s Registrar Rules require a registrar to supply an authorisation code within two calendar days if the registrant’s contact details on file are accurate. If they are not, the registrar has to validate the requester’s identity first, which is the exact point where a stalled recovery usually sits: the registrant of record is a person who left the agency two years ago, or an email address nobody checks.

One thing the rules explicitly do not cover is a fee dispute. Nothing in the transfer clauses lets a registrant refuse a properly authorised transfer because of an unpaid invoice, and nothing in the Complaints Policy gives auDA power to adjudicate one either.

auDA’s Licensing Policy is the primary document for all of this, and the Registrar Rules govern what your registrar owes you directly.

Every one of those figures is a maximum, not an average. A cooperative registrar can and often does move faster. The 28 day window still matters even though it is a separate obligation from the clause that actually triggers cancellation: if a transfer was agreed by contract, for example as part of an offboarding agreement with an outgoing agency, and nobody requests the transfer inside that window, the registrant is out of compliance with auDA’s rules regardless of whether cancellation follows.

What This Means for the Build

Recovering a domain is mostly a sequencing problem, not a technical one.

1. Run a WHOIS lookup first. Confirm exactly who the registrant is and what contact details are listed. This tells you whether you are dealing with a live, responsive party or a stale record.
2. Request the authorisation code in writing, addressed to the current registrar (not the agency directly, unless the agency is also your registrar). Reference the transfer clauses above by name so the request cannot be read as informal.
3. Register a new domain licence application under your own practice entity, with a practice email as the registrant contact, ready to receive the code the moment it is released.
4. Keep a DNS record snapshot before you initiate anything. Export your current A, MX, TXT and CNAME records so a lapsed or contested domain does not also take down your email and booking widget while the dispute runs.
5. If the request stalls, lodge an auDA domain complaint citing the ownership dispute or unauthorised transfer category, and attach evidence that your practice is the beneficial user: invoices, hosting bills, or the original engagement contract.
6. Once you hold the domain, set auto-renewal to a card the practice controls and confirm the registrant contact is a role-based practice email, not a personal one that leaves with a staff member.

Which Path Applies to Your Situation

Not every uncooperative agency is the same problem, and the right first move depends on which one you are dealing with.

The row people most often get wrong is the last one. auDRP is designed for trademark and naming disputes with a party you have never worked with. It has nothing to say about your own former agency, which is precisely why it will not resolve a dispute with one.

Read the chart as a fit score from 0, does not apply, to 2, the mechanism directly addresses the scenario. The auDRP column stays at zero down every row, which is the point: it is a real auDA process, it is just not this one.

Two Worked Examples

Cosmetic clinic. A clinic ending a retainer with its marketing agency found the agency listed as registrant, with the agency’s own staff email as the contact. The practice sent a written transfer request citing the licensing clauses and the offboarding clause in its own contract. The agency did not respond inside two weeks, so the practice lodged an auDA domain complaint under the ownership dispute category, attaching the original engagement letter and twelve months of hosting invoices billed to the practice. The authorisation code was released not long after the complaint was acknowledged, most likely because the complaint itself, not any legal threat, was what moved a busy agency to act.

Dental practice. A dental practice’s domain had been registered a decade earlier by a sole trader developer under his own name, as an informal favour rather than through any agency. The developer retired and stopped answering email entirely. There was no fraud and no dispute in the ordinary sense, just an empty mailbox holding the licence. The practice’s registrar could not release an authorisation code to an unverified requester, so the practice lodged a domain complaint and separately asked its own registrar to begin identity validation directly, since the registrant contact itself was the dead end.

What to Check on Your Own Site

1. Run a WHOIS lookup today. Note the registrant name and the listed contact email.
2. If the contact email is not one your practice controls, assume it will not receive the authorisation code when you need it.
3. Locate your original engagement contract and check whether it says anything about domain ownership on exit.
4. Confirm your domain’s auto-renewal is billed to a card your practice controls, not an agency card that might lapse.
5. If you are mid-transition from one agency to another right now, put the transfer request in writing this week, not after the relationship has already gone quiet.

The Enforcement Mechanism

auDA’s Complaints Policy is the real mechanism here, and it has teeth of a limited kind. Domain complaints covering ownership disputes and unauthorised transfers are explicitly within scope, and auDA’s stated resolution actions include correcting registrant details and reversing an unauthorised transfer.

What auDA does not do is publish a public register of individual complaint outcomes. Other regulators in adjacent spaces publish more granular enforcement data as a matter of course. auDA has not published an equivalent register of domain ownership complaints with dates and outcomes, so there is no specific named case to point to here. That is a genuine gap, not an oversight in the research for this post, and it is worth saying plainly rather than inventing a determination that would read well but does not exist.

Where This Gets Hard

The fee dispute scenario is the one with no clean answer. auDA’s transfer rules do not recognise an unpaid invoice as grounds to block a transfer, and its Complaints Policy exists to police the domain system, not to referee a commercial contract. In practice this means the transfer request and the invoice argument have to run on separate tracks: you can pursue the domain through auDA’s process while the money is argued about elsewhere, and the two rarely resolve on the same timeline.

The other hard case is a long relationship with nothing in writing at all, which can happen with any domain that has sat under the same registrant for years without anyone revisiting the paperwork. There is no contract clause to cite, no clear paper trail proving beneficial use, and the complaint process works better with evidence than without it. auDA says a registrant is the recorded holder of the licence; the build consequence is that a domain complaint moves fastest when you can show invoices, hosting bills or correspondence proving your practice was always the intended user. Whether your specific paper trail is strong enough to succeed, and whether any separate legal remedy is worth pursuing alongside it, is a question for your lawyer rather than for auDA’s published rules.

Status

In force. auDA’s Licensing Policy, Registrar Rules and Complaints Policy are all current and operative as at 28 September 2026, and none is subject to a pending review that would change the recovery mechanism described here.

Frequently Asked Questions

Can I get my .com.au domain back if my old agency is listed as the registrant?

Usually yes, if the agency cooperates. auDA’s Licensing Policy requires a transfer to proceed once you supply a valid authorisation code and the transfer request is in writing, and the current registrar must complete the transfer within two calendar days. The harder cases are an agency that will not respond at all, or one that has ceased trading.

What is an authorisation code and how do I get one?

It is the code, sometimes called an EPP code, that a registrar must issue to move a domain to a new registrar or a new registrant. Under auDA’s Registrar Rules, the current registrar must supply it within two calendar days if your contact details on file are accurate. If the listed contact details point to your agency rather than your practice, the registrar first has to validate your identity before releasing it, which is where recovery usually slows down.

Does the au Dispute Resolution Policy help me recover a domain from my own agency?

No. The auDRP exists for disputes between a registrant and a third party with a competing trademark or naming claim, the classic cybersquatting scenario. It is not the mechanism for a contractual dispute between a practice and the agency it hired. The relevant process is auDA’s Complaints Policy, specifically the domain complaint category covering ownership disputes and unauthorised transfers.

What can auDA actually do if my agency will not release the domain?

auDA can investigate a domain complaint, request a correction to registrant details, or reverse an unauthorised transfer. It cannot impose a fine, because auDA is not a government agency, and it has no jurisdiction over a fee dispute between you and your agency. That combination is why most recoveries end up resolved through a mix of the complaints process and ordinary commercial pressure, not a single decisive ruling.

Can an agency legally withhold my domain over an unpaid invoice?

auDA’s transfer rules do not recognise an unpaid invoice as a reason to block a properly requested transfer. Whether the agency has a separate contractual or common law right to withhold the asset until payment is a different question, and one auDA’s process was never built to answer.

That ranking is a build-effort estimate based on how many parties and process steps are typically involved in each scenario, not a measured statistic. The pattern it encodes is the reliable part: the moment money or a contested handover enters the picture, the process stops being a two day formality and starts being a negotiation.

If You Need This Sorted This Week

If your domain is genuinely stuck right now, mid-dispute, mid-transition, or sitting under a registrant contact you cannot reach, talk to us directly and we will tell you within one business day whether you are looking at a straightforward authorisation code request or a formal auDA complaint, and walk you through whichever one applies.

Sources

1. auDA, .au Domain Administration Rules: Licensing, Policy No. 2019-01. Checked 28 September 2026.
2. auDA, .au Domain Administration Rules: Registrar, Policy No. 2020-02. Checked 28 September 2026.
3. auDA, Complaints Policy, Policy No. 2015-01. Checked 28 September 2026.
4. auDA, .au Dispute Resolution Policy (auDRP), Policy No. 2016-01. Checked 28 September 2026.

Last reviewed: 28 September 2026.