Web & Domains

Domain expired, transfer stuck or access lost? Confirm the status and protect the records.

A provider login, a domain licence, website hosting and competing rights are different issues. Establish the actual status, preserve evidence and choose the proper renewal, recovery or transfer process.

16 October 2026  •  8 min read

Cream folders and a closed burgundy laptop beside a blank-grid calendar above an open cobalt filing drawer

For domain holders and authorised representatives

The correct process depends on the domain extension, status and evidence. Use the actual registrar and applicable rules; technical access or a payment does not decide every right.

Step 1 of 9

In this guide
  1. 01Status, records and process
  2. 02Expiry, transfer and recovery
  3. 03Similar names, verification and help

Identify whether the issue is access, expiry or control

A failed login does not by itself mean the domain changed hands.

Record the exact domain and extension, current symptom and when it began. Are you unable to sign in to a provider, facing an expiry notice, trying to transfer between providers, or seeing evidence of a different registrant? Losing access to email, hosting or an old agency account does not by itself establish a change in registration.

Use the genuine registrar or reseller through a known website/contact channel. Preserve previous renewal notices, invoices, account references and approved transfer correspondence privately. Do not act from an unexpected payment link, send account codes to a stranger or assume that a parked page identifies who has rights to the name.

If a transfer, registrant change or recovery-method change was not authorised, contact the registrar’s security/recovery team immediately and preserve the time and evidence. Keep urgent incident response separate from routine renewal. A website that still loads does not prove domain account control is intact.

Identify the exact name and actual access/expiry/control symptom. Preserve records and escalate unauthorised changes promptly through the genuine provider.

Next: Confirm the registrar, registrant and domain status

Confirm the registrar, registrant and domain status

Registration, account access, hosting and DNS have separate responsibilities.

Find the registrar of record and, where relevant, the reseller, using existing records and the appropriate registry’s public lookup. Public data may be limited; missing personal details are not proof that someone took the domain. Ask the registrar to confirm the status and the evidence needed to establish your authority through its secure process.

For .au, registration is a domain name licence with eligibility requirements. The entity or person holding the licence can differ from the technical contact, bill payer or web designer. Do not assume that paying an invoice, buying a business or possessing website files automatically transfers the licence or settles competing rights.

Record the actual expiry/status, intended authorised registrant and access contacts. For other extensions, ask which registry/registrar rules apply rather than importing .au or generic-domain timings. ICANN’s lost-domain guidance explains several distinct scenarios. Keep identity and business evidence private and provide it only through the verified provider’s required channel.

Confirm the registrar of record, relevant holder and actual status using the applicable extension rules. A bill, hosting login or public lookup alone does not establish every right.

Next: Preserve service dependencies and choose the right process

Preserve service dependencies and choose the right process

Keep renewal, provider transfer, registrant change and dispute separate.

Before a planned change, preserve current DNS/delegation, website/mail service details and account/recovery arrangements through the approved process. Confirm who is authorised to approve work and how service continuity will be maintained. A registrar transfer is not automatically a website or mailbox migration, and changing nameservers can have separate consequences.

Choose the process matching the actual status: time-sensitive expiry/restoration, recovery of a provider account, an authorised transfer between providers, a change of registrant, or a dispute about another registration. Ask the responsible provider to state required evidence, restrictions, fees and expected next steps in writing. Do not cancel an existing service to force a handover.

Keep transfer authorisation codes and identity documents out of general enquiries, public screenshots and shared notes. Use only the verified secure mechanism intended for the authorised recipient. Do not unlock every domain, change registrant details or remove safeguards just because a transfer appears delayed.

Preserve service dependencies and distinguish the exact process before changes. Keep credentials and transfer authority secure, with a responsible owner and agreed next action.

More checks6 detailed checks

Act promptly on expiry with the genuine provider

The available option depends on the current stage and extension.

Contact the verified provider immediately to confirm whether the domain is expired, renewable, in a restoration stage, released or registered by someone else. Ask for the actual deadline, required eligibility, fees and restoration conditions. Do not wait for a website to disappear or assume auto-renewal succeeded because a payment method was saved.

auDA’s current renewal guidance describes a 30-calendar-day post-expiry grace period for .au licences, during which website/email use stops. That is an extension-specific rule, not a reason to delay or a guarantee for every other domain. Confirm the actual status and eligible renewal route with the provider.

If the name has been released, re-registration is not guaranteed; if another party now holds it, ordinary renewal may no longer be available. Do not assume a payment, broker or drop-catching service guarantees recovery. After any authorised renewal/restoration, verify both registration status and the affected web/mail services; payment receipt alone is not complete service acceptance.

Confirm the current stage and act on the genuine provider’s deadline. Distinguish renewal from restoration or re-registration and verify service recovery separately.

Next: Verify domain control, renewal and service continuity

Review the specific transfer restriction

A registrar move and a change of registrant are different operations.

For a planned transfer, use the preservation and authority checks first. Ask the current and intended new providers for the exact status/rejection and applicable process. Confirm the correct domain, authorised holder, required contact access and any pending transfer, dispute, expiry or restriction. Do not repeatedly start transfers or make unrelated contact changes while the cause is unclear.

auDA distinguishes provider and registrant transfers. A .au provider transfer uses a domain-specific authorisation code distinct from the provider account password; eligibility and certain dispute restrictions matter. A change of registrant involves its own requirements. Do not apply generic-domain lock periods to .au automatically.

For applicable generic domains, ICANN’s transfer FAQ describes restrictions associated with registration, previous transfer or registrant changes. Ask the registrar which current rule applies to this domain. Keep any justified unlocking and authorisation narrowly scoped to the agreed transfer; do not share account passwords, bypass locks or cancel DNS/hosting as a shortcut.

Identify the precise applicable restriction and approved provider process. Keep provider transfer, registrant change and service migration separate, with secure narrow authorisation.

Next: Verify domain control, renewal and service continuity

Recover access and escalate unauthorised changes

Use provider recovery rather than inventing a new registration history.

Distinguish a lost account login or inaccessible contact mailbox from an actual unauthorised transfer or registrant change. Use the verified registrar’s account/security process and provide only the required identity/business evidence through its secure channel. Ask about an alternative verified contact route if the domain’s own email is unavailable. Do not create false documents or impersonate an old holder.

For suspected unauthorised changes, preserve original notices, known account references and the timeline, then ask the registrar to investigate urgently and explain the escalation route. Relevant registry/ICANN complaint mechanisms depend on the extension and circumstances; they are not automatic reversal or emergency recovery guarantees.

If a former employee, agency, seller or another entity is the recorded holder, gather the actual agreements and authority for the registrar and, where needed, an appropriately qualified legal adviser. Technical possession, payment and similar business names do not settle the issue. Do not publish accusations, demand passwords from the other party or attempt to take over their account.

Use verified account/security recovery and preserve evidence of actual changes. A registrar investigation or complaint is not a guaranteed reversal or determination of competing rights.

Next: Verify domain control, renewal and service continuity

Preserve evidence for a similar-name dispute

Similarity alone does not decide whether a registration is improper.

Record the exact domain, extension, relevant publicly visible use and dates without visiting suspicious links or entering credentials. Preserve examples of actual confusion, impersonation or misuse privately. Distinguish a name that resembles yours from a site actively collecting information, sending deceptive mail or otherwise causing a current security incident.

The .au dispute process considers defined criteria involving rights, legitimate interests and bad faith. A competitor’s similar name, a business-name registration or an earlier website alone does not establish the outcome. Ask the appropriate dispute provider or qualified adviser to assess the evidence and available route.

Other extensions may have different applicable mechanisms, including ICANN’s UDRP framework for relevant disputes. Fees, evidence and consequences need assessment before filing or negotiating. Do not threaten public action, pay an unverified seller or assume that a registrar, IT provider or complaint will transfer the name to you. Handle active impersonation through the genuine security/abuse channels as well.

Preserve specific evidence and use the applicable rights/dispute assessment. Similarity is not an automatic violation or a promise of transfer; active abuse needs its own response.

Next: Verify domain control, renewal and service continuity

Verify domain control, renewal and service continuity

A completed ticket and a working web page answer different questions.

After the provider completes the approved action, confirm the intended registrar/holder details and current status through its supported records. Check authorised account access and recovery/contact arrangements privately. For unresolved disputes or investigations, record the current stage, deadline and next owner instead of treating a submitted request as recovery.

Confirm the agreed renewal position and a responsible reminder/auto-renewal plan. Check whether renewal actually completed and what date/status is now recorded; an enabled setting is not proof of payment or future success. Review access after staff or supplier changes without removing the only working recovery route.

Verify the affected website and mail paths with the responsible owners using normal harmless checks and agreed participants. Preserve original data and old services according to the handover plan. Record what was checked, remaining dependencies and follow-up. Do not initiate real purchases, leads or ownership transfers as a test, and do not call the whole matter resolved from one lookup.

Cream document folders beside a closed burgundy laptop and blank-grid calendar on a pale timber desk

Confirm the approved registration/access result, renewal evidence and relevant services separately. Record unresolved investigations, deadlines and dependencies without claiming guaranteed future renewal.

Back to the symptom checker

Get help with the domain record and next step

Bring the exact name, provider response and factual evidence.

Use the registrar/reseller for account, renewal and transfer handling and the relevant registry/dispute provider for its defined escalation process. A qualified adviser may be needed for competing rights, contracts or a proposed purchase. Provide the exact domain, status, timeline and relevant non-secret provider response; keep credentials, codes and identity documents in verified secure channels.

Our domain name management service can start a discussion about technical records, access coordination and continuity within an agreed scope. It does not promise legal ownership, trademark decisions or recovery of a name now held by someone else. Agree authority, responsibilities and the specific next action before changes.

For a domain that is correctly registered but not resolving, use the DNS and email guide. Keep provider renewal, account security, rights disputes and service repair on their appropriate paths. Preserve evidence and avoid repeated changes while an investigation or restriction remains unresolved.

Agree the next responsible registrar, technical or dispute action from factual evidence. Keep recovery limits and legal-rights questions clear, with service continuity tracked separately.

Frequently asked questions

Can an expired domain always be recovered?

No. Options depend on its extension and current stage, including whether another party has registered it. Contact the genuine registrar promptly for the actual renewal/restoration route, deadlines and fees. Do not assume a payment or re-registration service guarantees recovery.

Does moving a domain to another registrar move my website and email?

Not automatically. Registration, DNS, hosting, mailboxes and historical data are separate dependencies. Preserve the current setup, confirm what the provider transfer changes and verify the relevant services through an agreed handover plan.

Is a transfer code the same as my provider account password?

No. For a .au provider transfer, the domain-specific authorisation code is distinct from the account login. Treat it as sensitive authority and provide it only through the verified process for the agreed transfer. Never publish it or send a whole account password as a shortcut.

Does a competitor’s similar domain mean I can have it transferred to me?

Similarity alone does not determine the outcome. The applicable dispute process considers defined criteria and evidence; rights, legitimate interests and bad faith can matter. Preserve factual evidence and obtain the appropriate assessment rather than assume ownership or a guaranteed remedy.

Does losing my hosting login mean I lost the domain?

Not necessarily. The registrar account, recorded domain holder, DNS host and website provider can be different. Confirm the actual domain status and responsible provider, then use its verified recovery process. Escalate evidence of unauthorised changes promptly.

More practical IT guides

View all guides

Share this guide