If your registrar has had a data incident, secure your account and check your domain’s details first. Then decide calmly whether to stay or switch, judging registrars on security, consent and support rather than price alone. Moving a .au domain has no registry transfer fee, takes up to three days and, done in the right order, doesn’t interrupt your website or email.
Key takeaways
- Lock down your account first: new password, two-factor login and correct contact details.
- Expect more scam emails and fake renewal notices after any exposure of contact details.
- Choose a registrar on security features, clear consent, honest renewals and reachable support.
- Copy your DNS records before you move, and don’t change nameservers mid-transfer.
What happened in the 2026 .au WHOIS incident?
On 4 April 2026, auDA reported that Crazy Domains had registered free .online domains for existing customers without their prior acceptance. The privacy guard on those names was applied with a delay of 2 to 180 minutes. During that window, contact details, including postal addresses and phone numbers, were visible through WHOIS. auDA said about 95,000 of the people affected were .au registrants, and that the OAIC had been notified (auDA).
Incidents like this can happen at any provider. The useful questions are what was exposed, how the registrar responded and whether you still trust it with a name your business depends on.
What should I do first, whether or not I move?
- Secure the account. Change your registrar password and turn on two-factor login if it’s offered.
- Check who holds the domain. The registrant should be your business, not a staff member or designer. Our guide to who owns your domain shows how to check.
- Tidy your contact details. auDA suggests role-based contacts, a business address or PO Box and a business phone number, to limit the personal information linked to your domain. The .au WHOIS already hides street addresses and phone numbers, but it shows the registrant and contact names (auDA WHOIS Policy).
- Look for products you didn’t order. Remove or cancel anything you don’t want, and note the renewal dates.
- Treat unexpected emails with suspicion. Exposed contact details attract scams. The ACCC once had two companies ordered to pay $1.95 million after sending about 300,000 notices that looked like domain renewal invoices (ACCC).
Should I switch domain registrars?
Switching won’t undo an exposure that has already happened. It’s about who you trust from here. Staying can be reasonable if the registrar explained the problem clearly, contacted you and fixed the cause. Moving makes sense if you felt kept in the dark, found products you never agreed to, or simply can’t reach a person when something goes wrong.
Don’t move in a rush. A transfer started during a panic, with expiring names or missing DNS records, causes more trouble than the incident itself.
What should I look for in a new registrar?
| Check | Why it matters |
|---|---|
| Accredited by auDA, or resells an accredited registrar | Only accredited registrars can register .au names |
| Two-factor login | Stops a stolen password from becoming a stolen domain |
| Registrar lock and registry lock | Blocks unauthorised transfers and changes |
| Nothing added without your consent | You should approve every product and renewal |
| Clear renewal prices | The second-year price matters more than the first |
| Support you can reach | Australian hours, and a phone number for urgent problems |
Registry lock is the stronger of the two locks. It adds extra checks between the registrar and the .au registry before details can change. Not every registrar offers it, so ask. When it’s on, a WHOIS lookup shows statuses such as serverUpdateProhibited (Identity Digital).
How do I move my domain safely?
The order matters more than the speed:
- Check eligibility and expiry. For .au, you must still be eligible to hold the licence, and it can’t be under a complaint or dispute (auDA). Don’t leave a transfer until the week a name expires.
- Copy every DNS record. If your current registrar also hosts your DNS, screenshot or export the records for your website, email and verification services.
- Get the authorisation code. For .au names, it goes to the registrant’s email address on record. Our explainer on the domain auth code covers where to find it.
- Start the transfer with the new registrar. auDA charges no fee to move a licence between registrars, and the move can take up to three days once approved.
- Leave the nameservers alone until the transfer completes. Change one thing at a time, then check the website and email.
For .com and other generic names, a registrar may refuse a transfer within 60 days of registration or a previous transfer (ICANN). Our neutral guide to transfer a domain from GoDaddy, Crazy Domains or VentraIP has the screen-by-screen steps. If you hold a .com.au, see how to transfer a .com.au domain without downtime.
Will my website and email keep working?
They should, because a registrar transfer moves the licence, not your website or mailboxes. Problems come from DNS. If your old registrar hosted your DNS records and the account closes, your site and email can stop resolving. Recreate the records at the new provider before you switch nameservers.
If you’re also unhappy with your host, move one thing at a time. Do the domain first, check everything, then move the site. Our free website migration handles the website, database and email side, so you don’t have to coordinate the two moves yourself.
How we handle domains
You can transfer your domain to WMS and keep your business as the registrant. We’ll help you check your DNS before anything moves. New names are simple too: register your domain with WMS, with .com.au from $80 + GST for two years. You can call us on 1300 662 492, and our 24/7 emergency line is 0426 833 422.
Frequently asked questions
Does transferring a .au domain cost anything?
auDA charges no fee to move a .au licence between registrars. Your new registrar may charge for its own services or renewals, so check its price list. Changing the registrant, for example when a business is sold, is a different process and some providers charge for it.
How long does a domain transfer take?
auDA says a .au transfer can take up to three days to take effect once approved. Generic names such as .com often take longer because the old registrar has a window to respond. Plan around your expiry date and avoid starting during a busy sales period.
Will my details stay hidden after I move?
The .au WHOIS doesn’t show your street address or phone number, whichever registrar you use. It does show the registrant name and contact name. Using role-based contacts and a business email keeps personal details off the record.
Can I move just some of my domains?
Yes. Each domain transfers separately with its own authorisation code. Many businesses start with their main .com.au, check that everything works, then bring across the rest.
What if I can’t get the authorisation code?
For .au names, auDA’s password recovery tool sends the code to the registrant’s email address on record. If that address is old or belongs to someone else, update the registrant contact first, or ask the new registrar to help.
Sources
- Crazy Domains data incident, auDA, 4 April 2026 (updated 14 April 2026)
- Domain Name Corp and Domain Name Agency to pay $1.95 million in penalties, ACCC, 15 June 2018
- What is registry lock?, Identity Digital (.au registry operator)
- Transfer your .au domain name, auDA
- Transfer Policy, ICANN
- WHOIS Policy, auDA, June 2026