Every brand protection conversation in the .au space eventually arrives at the same uncomfortable arithmetic: a lookalike domain costs an attacker — or simply an opportunist — the price of one registration, while it costs you confused customers, misdirected email, and potentially a formal dispute to claw back. The asymmetry is the whole problem, and it is why defensive registration, unglamorous as it is, remains the highest-value brand protection measure per dollar in the Australian namespace.
This guide covers the practical playbook: which names to register defensively, what the launch of .au direct changed — including the priority allocation system whose consequences are still being felt — and your options when the name you should have registered is already in someone else’s hands.
Key takeaways
- Defensive registration means holding domains you do not actively use, so nobody else can. In the .au space the core set is small and cheap: your exact name across .com.au and .au direct, plus your handful of highest-risk variants.
- The 2022 launch of .au direct forced every .com.au holder to decide whether to claim their matching .au — via the priority allocation process — or risk someone else holding it. Many sat it out; some are still paying for that.
- Contested priority applications could leave names in limbo for years; unclaimed names flowed to open availability from late 2022.
- If someone already holds a name targeting your brand, your escalation ladder runs: direct approach, auDA complaint (eligibility/allocation breaches), auDRP dispute (bad-faith registrations against your rights), and the courts — in roughly that order of cost.
- A trade mark is the backbone of every remedy; brand protection without one is fighting with one hand tied.
What defensive registration is — and is not
A defensive registration is a domain you hold purely so that others cannot: typically redirected to your main site or left dark, renewed year after year as insurance. It is not hoarding every conceivable string. The goal is to close off the names whose misuse would actually hurt — the ones a customer would plausibly believe are you.
One .au-specific note before the list: .au registrations come with eligibility and allocation rules. Your exact brand name, your trading names, and names connected to your products and services sit comfortably within them. Registering names connected to someone else’s brand does not — which, helpfully, is also what makes the rules a weapon in your favour when you are the one targeted.
The core defensive set
For most Australian businesses, in priority order:
- Your exact name in .com.au and .au direct. The matched pair. After the 2022 launch, holding one without the other is the single most common gap — and the most commonly exploited, because to a customer
yourbrand.auandyourbrand.com.auare interchangeable. If you take nothing else from this article: close this pair. (Deciding which one to use is a separate question — our .au direct vs .com.au guide and the .au Domain Chooser cover it.) - .net.au for established brands. Lower traffic, but the standard second choice for someone trying to free-ride on a name whose .com.au is taken.
- High-risk misspellings and variants — the hyphenated version of a two-word name, the obvious typo, the singular/plural twin. Be selective: two or three genuinely confusable variants, not twenty theoretical ones.
- Product and campaign names you promote heavily, for the duration you promote them.
At indicative market pricing — roughly $10–$30 per name per year — a solid defensive set for a small business runs to less than a decent office chair, annually. The discipline it requires is not financial; it is administrative. Defensive names expire too, and an expired defensive registration is worse than none, because it drops into the public drop list with your brand attached, advertised to every drop-catcher in the country. Hold defensive names in the same registrar account as your primary, auto-renewed, multi-year, on the same renewal calendar.
The .au direct launch: a forced test of brand vigilance
The arrival of .au direct in March 2022 was the largest single event in the namespace’s history, and it doubled the defensive surface of every Australian brand overnight. How auDA handled the transition is worth understanding — partly as history, partly because its mechanics still shape who holds what today.
The priority allocation period
auDA recognised the obvious risk: if yourbrand.au simply went on open sale, speculators would race existing yourbrand.com.au holders for it. So the launch included a Priority Allocation Period — roughly the six months from March to September 2022 — during which the matching .au direct name was reserved for holders of the equivalent name in the existing .au namespaces (.com.au, .net.au, .org.au and others).
Crucially, the reservation was not automatic. You had to apply for priority status — obtaining a priority token for each name through auDA’s priority tool and lodging the application via a registrar. No application, no claim: when the window closed, unclaimed names flowed to open, first-come-first-served availability from early October 2022.
Contention: when two holders wanted the same .au
The genuinely intricate part was contention. Because example.com.au and example.net.au could be held by different entities, both might apply for example.au. auDA resolved this with priority categories based on the age of the underlying registration — names created on or before a 2018 cut-off date ranked ahead of later ones. An older registration (Category 1) beat a newer one (Category 2); between two Category 2 applicants, the earlier registration won.
But two Category 1 applicants deadlocked: neither outranked the other, and the .au name sat on hold while both maintained their applications — renewable, year after year — until one withdrew or they reached agreement. Some contested names spent years in that limbo, and the contention process produced a quiet lesson in brand governance: companies discovered mid-application that their .net.au was registered to a long-forgotten subsidiary, or that an old defensive registration they had let lapse in 2019 would have won them the .au outright.
What the episode teaches
Three durable lessons, applicable well beyond 2022:
- Namespace changes punish inattention. The holders who lost their matching .au were overwhelmingly those who never engaged with the process — the same silence that loses domains to expiry.
- Old registrations carry hidden value. Registration age decided contention. The boring, long-held defensive name turned out to be the trump card.
- Audit your holdings against your entities. Much of the 2022 pain was self-inflicted by domains held in the wrong subsidiary, a founder’s personal name, or a lapsed ABN. An annual reconciliation of domains-to-entities would have prevented nearly all of it.
If your brand missed the window and your matching .au is now held by someone else, you are in remedy territory — read on.
When someone already holds “your” name
The escalation ladder, cheapest first:
1. Look before you leap
Establish the facts from the auDA WHOIS (whois.auda.org.au): who holds it, since when, with what eligibility. An unrelated business legitimately named Harbour Plumbing in another state holding harbourplumbing.au is not an infringer — .au allocation is first-come among eligible registrants, and sharing a name is not a wrong. Your remedies target bad faith and rule breaches, not disappointment.
2. The direct approach
Often the cheapest fix is a conversation. A parked name held by someone with no particular plan may be transferable for a modest negotiated sum — unquestionably galling, and frequently still the rational choice measured against the cost and uncertainty of proceedings. Use a registrant transfer done properly through the registrars (the buyer must satisfy eligibility in their own right).
3. auDA complaints: the rules themselves
Because every .au registration carries eligibility and allocation conditions, a registration that breaches them — no qualifying Australian presence, no legitimate connection to the name, details that are simply false — can be the subject of a complaint to auDA, which can investigate and ultimately cancel a non-compliant licence. This route costs little and exists precisely because .au is a policed namespace; it is the first formal lever to consider when the facts suggest a rule breach rather than a mere grievance.
4. The auDRP: bad faith against your rights
The .au Dispute Resolution Policy (auDRP) is the .au adaptation of the international UDRP system: an administrative proceeding, decided by an independent panel, in which you must establish that the domain is identical or confusingly similar to a name or mark you have rights in, that the holder has no rights or legitimate interests in it, and that it was registered or used in bad faith. Classic winning fact patterns: the name is your registered trade mark, and it resolves to a copycat page, a competitor redirect, or an offer to sell it to you at a strong-arm price.
The auDRP is faster and far cheaper than court, but it is a real proceeding with filing fees and evidentiary standards — and it is where a registered Australian trade mark earns its keep. Without one, establishing “rights” rests on harder-to-prove reputation evidence. If your brand matters enough to defend, the trade mark application should predate the crisis, not respond to it. (It also, as a bonus, provides a .au eligibility basis of its own.)
5. Courts and the ACCC
Beyond the auDRP lie Australian Consumer Law actions for misleading and deceptive conduct, trade mark infringement proceedings, and — for scams rather than squatters — reports to the ACCC and to the registrar’s abuse channel. These are lawyer territory and out of scope here, beyond one observation: by the time you are briefing counsel over a domain, the defensive registration you skipped has been repriced from “office chair” to “litigation budget”.
What about the scam problem?
One more category deserves a mention, because it is the one where speed matters most: outright impersonation. A lookalike domain used for phishing — fake invoices to your customers, a cloned login page, emails “from” your accounts team — is not a squatting dispute, and the auDRP’s weeks-long timetable is the wrong tool while money is moving. The immediate playbook: report the domain to its registrar’s abuse contact (the registrar is identifiable via the auDA WHOIS), report the scam to the ACCC and, where customers are being defrauded, to police via ReportCyber; warn your customers through every channel you have; and preserve evidence — screenshots, headers, dates — for the formal processes that follow. Registrars and auDA can and do act against domains used for abuse, and the earlier the report, the shorter the damage window.
Defensive registration earns its keep here too, in a quieter way: every confusable name you already hold is one a scammer cannot use, and the SPF, DKIM, and DMARC records you publish — including on parked defensive names — make your real mail verifiable and spoofed mail rejectable. Email authentication on domains that send nothing is a strangely effective brand protection: a DMARC reject policy on a parked name tells the world’s mail servers that nothing legitimate ever comes from it.
A brand protection routine that takes one hour a year
- Hold the core set — exact name in .com.au and .au direct, plus your short list of high-risk variants — auto-renewed, multi-year, in one secured registrar account.
- Reconcile annually: every domain against the correct legal entity, a live registrant email, and a current ABN. (Eligibility is a continuing condition, not a sign-up formality.)
- Watch the namespace. Once a year, search your brand and obvious variants across .au; set a cheap alert if your sector attracts impersonation.
- Keep the trade mark current — it is the backbone of every formal remedy.
- When auDA announces structural changes to the namespace, engage immediately. The 2022 priority process rewarded the holders who read the announcement and acted inside the window. There is no reason to expect the next change — whatever it is — to be kinder to the inattentive.
Brand protection in the .au space is, in the end, a small recurring act of imagination: picturing what the worst plausible holder would do with each name adjacent to yours, and deciding whether that picture is worth a renewal fee to prevent. Usually, it is.
Policy details, including priority allocation rules and the auDRP, are published by auDA — verify current versions at auda.org.au before acting.