Services

Domain Governance Review

We do not know what we own. We do not know who controls what. Some of these domains may have already lapsed.

The Domain Governance Review helps organisations understand their full domain estate — what they own, what they have forgotten, who controls what, and what the exposure looks like from the outside.

The strongest differentiated offer in the practice

Domain governance is the area where most organisations are furthest behind — and where the consequences of that gap are least visible until something goes wrong. Domains expire and get picked up by others. Registrar accounts are held by former staff. DNS delegations point to platforms the organisation no longer uses. Orphaned subdomains are forgotten and never secured.

The Domain Governance Review surfaces these gaps. It is not a technical scan. It is a governance and ownership review that happens to require technical signal collection to do properly. The output is designed to help organisations understand what they have, who is accountable for it, and what decisions need to be made.

Best for

Organisations with inherited, fragmented, or unclear domain estates. This commonly includes organisations that have merged, rebranded, grown quickly, or accumulated domains across multiple teams, campaigns, projects, or historical periods without ever taking stock of the full picture.

What the review covers

Typical areas of assessment

  • Domain inventory and ownership identification
  • Registrar account control and exposure
  • DNS provider identification and delegation mapping
  • Expiry and renewal risk across the estate
  • Orphaned, legacy, or forgotten domains
  • Subdomain delegation and exposure
  • Public-facing domain hygiene
  • Governance model and ownership accountability
  • Risk and control observations

Not in scope

  • Active exploitation or penetration testing
  • Domain registration or transfer execution
  • DNS configuration changes or remediation delivery
  • Email authentication assessment (see Email Trust Review)
  • Formal compliance audit or legal opinion

Scope is agreed upfront based on a preliminary domain count and estate description. For organisations where email authentication is the primary concern, see Email Trust Review.

Outputs

  • Domain governance register — inventory, ownership, registrar, DNS provider, and expiry data for assessed domains
  • Risk and ownership observations — where control is unclear, missing, or fragmented
  • Remediation priorities — what to address first and why
  • Governance model recommendations — how ownership and accountability should be structured going forward
  • Executive summary with plain-language interpretation of key risks
  • Readout session to walk through findings and confirm next steps

Three steps to a governed domain estate

Step 01 Scope

Confirm the expected domain estate size, any known registrars or DNS providers, and any existing documentation. Capture known concerns around expiry, ownership, or specific domains.

Step 02 Assess

Collect observable signals across the domain estate — registration data, DNS delegation, expiry indicators, subdomain mapping, and control evidence. Identify gaps and classify findings by risk.

Step 03 Deliver

Provide the domain governance register, risk observations, and governance recommendations in a structured format ready for internal action and executive review.

Duration depends on domain estate size and complexity. A preliminary scoping conversation will confirm the expected timeline before the engagement begins.

Fixed fee, scoped to the estate

Scope is agreed upfront. No hourly billing.

From AUD $5,500 + GST · fixed fee · scope confirmed before engagement begins

Pricing assumes a defined domain portfolio and a bounded review of ownership, registrar control, DNS provider exposure, renewal risk, legacy and orphaned domains, and governance recommendations. Larger portfolios, multi-entity environments, or remediation support are scoped separately.

What findings look like

De-identified and simplified example.

Domain governance findings extract De-identified
Three domains expiring within 60 days — no renewal evidence
Two domains registered under a former staff member's personal registrar account. Organisational access cannot be confirmed. One domain has no internal owner identified.
High
DNS delegation to a decommissioned platform
A subdomain is delegated to a DNS provider associated with a platform no longer in use. The delegation is unresolved. The subdomain appears externally but is not actively managed.
Medium
No domain governance register exists
The organisation has no central record of owned domains, registrar accounts, DNS providers, or renewal responsibilities. Ownership is fragmented across three teams with no single accountable owner.
Governance gap

Ready to understand your domain estate?

A preliminary conversation confirms scope, domain count, and cost before any commitment.