Domain names registration and management standard

Final | July 2020 | v3.0.0 | OFFICIAL - PUBLIC |QGCDG

Introduction

Purpose

A Queensland Government Enterprise Architecture (QGEA) standard provides information for Queensland Government departments and agencies on the mandatory and recommended practices for a given topic area. They are intended to help departments and agencies understand the appropriate approach to address an issue or to undertake a task. Unlike a guideline, which is best practice advice, a QGEA standard is mandatory and is enforced by policy. This standard should be read in conjunction with the Domain names policy.

Agencies should review the applicability of the Digital services policy when registering domains.

Audience

This document is primarily intended for any of the following:

• agency CIOs
• agency ICT operational management and staff
• agency staff maintaining websites.

Scope

This standard relates to the domain T-4.2.1 Network name and address services within the technology layer of the QGEA.

The following are out of scope of the current standard:

• Email addressing
• .edu.au domain (except qld.edu.au)
• Information relating to website content management (refer to Digital services policy)

Note:

The .au Domain Administration Ltd (auDA) is the body with responsibility for the entire Australian domain space. auDA has delegated responsibility for .edu.au to the Australian Information and Communications Technology in Education Committee (AICTEC), a cross-sectoral, national committee responsible for providing advice to the Ministerial Council for Education, Early Childhood Development and Youth Affairs (MCEECDYA) on the economic and effective use of online technologies in Australian education and training. AICTEC has in turn delegated .edu.au policy authority to a subcommittee, the .edu.au Domain Administration Committee (eDAC).

Applicability

This standard applies to all Queensland Government departments and agencies.

This standard also applies to Queensland statutory authorities and local government entities for registering a name within the Queensland government domain. However, these entities are not required to register a government domain name if they register a name within a non-government domain.

Queensland Government domain delegate

In accordance with the governance framework of the .gov.au domain administrator, a single agency will be registered as the Queensland domain provider with the delegated authority to assess individual domain name applications for Queensland. See the Queensland domain provider page for contact details.

Agency procedures

Each agency must develop procedures in support of this standard. Agency procedures must nominate a single point, to be registered with the Queensland Government domain provider, who is responsible for domain names within the agency. See the Register Domain Name page (government employees only) for a list of agency domain name representatives.

Agency procedures must provide for proactive management of domain names including maintaining a full list of all domain names (e.g. qld.gov.au, .com.au etc) held by the agency and their expiry dates.

Agencies are also responsible for regularly reviewing the continued requirement for domain names on this list as per the Information security policy (IS18:2018) for protection of all information, application and technology assets

Agencies can extend this standard for use within their agency but must not at any time conflict with the specifications marked as must or required in this document.

Pre-registration considerations

Internal agency approvals

Before requesting a new website or domain name, you should consider if you can publish your content on an existing website. Use the checklist to assess your business requirements.

Applications for domain name registration must only be made once the relevant internal procedures for consultation and approval for such matters as primary agency domain name (e.g. for new agencies created as part of machinery-of-government changes), domain name for the IT service (in circumstances where a domain name is for systems or email use only), cross-jurisdictional projects or services, campaign titles, project names and slogans has been achieved. Advertising and sales collateral must not be ordered until the domain name has been secured.

Internal agency approvals for new domain names must also be in accordance with any relevant government policies regarding provision of online services and consolidation of websites; including, but not limited to, the Principles for the use of service delivery channels.

Choice of domains

In general, domain names registered by Queensland Government agencies should be in either the .qld.gov.au or .qld.edu.au domains, however there are reasons why names may also be registered in other domains.

Examples of reasons include:

• a compelling commercial business reason to do so, such as tourism sites (e.g. www.queenslandholidays.com.au) or other organisations that may not be readily recognised as government bodies
• the need to protect against the use of government 'brands' in other domain spaces (e.g. to stop someone else from using a high-profile government brand for commercial or political gain, this is known as cybersquatting.
  Note: this would only be necessary for high profile or commercially valuable brands and should not be done as a matter of course.

For advertising campaigns or programs of a short duration (6 to 12 months), a subdomain or directory under an existing agency domain name, or the use of the Queensland Government domain (i.e. www.qld.gov.au) must be used rather than requesting another domain name.

Where it is desired the campaign or program should have a website with its own domain name, the department should develop a transition plan, consult with Smart Service Queensland (SSQ) Queensland Online and then apply using the online form.

Agencies must only apply for registration of domain names outside of the .qld.gov.au or .qld.edu.au domains after registration of the .qld.gov.au equivalent has been completed.

In the cases where registration under non-government or education domains is for protection against cybersquatting, agencies should consider both of the following issues in deciding which domain names to register:

• Level of risk (i.e. likelihood and impact) from cybersquatting.
  Is the level of risk high enough to warrant protection? (Note: this should be assessed in accordance with the agency's risk management procedures.)
• Variations of the name to be registered.
  When determining what domain names to register, consider a name can be registered unless it is identical to one already registered. Therefore, consideration should be given to both of the following:
  • registering the name under several different subdomains (i.e. .com, .net, .org, .com.au, .net.au, .org.au.)
  • registering variations of the name, including common misspellings.

Trade marks

When seeking to register a domain name, consideration may be given to whether the chosen name should also be registered as a trade mark. A registered trade mark can offer greater protection against unauthorised use.

Further information on trade mark registration can be obtained from IP Australia and professional legal advice should be sought if a decision is taken to register a trade mark.

Government domains

Selecting government domain names

When selecting a domain name for .qld.gov.au registrations, agencies must ensure all the following:

• names adhere to the Australian Government Digital Transformation Agency (DTA) Eligibility and allocation policy and Choosing a domain name guideline.
• names in the form of acronyms are not also the name of a more broadly recognised international organisation or company (e.g. oecd.qld.gov.au), or could apply to multiple organisations (e.g. bpa.qld.gov.au for the Bundaberg Port Authority and the Beach Protection Authority)
• names preceding the states suffix do not contain the state suffix (e.g. ecommerceqld.qld.gov.au)
• domain names for local government authorities be consistent across Queensland, and ideally across Australia - the following examples show the accepted convention: sunshinecoast.qld.gov.au, scenicrim.qld.gov.au and brisbane.qld.gov.au.

Registration request procedure .qld.gov.au domain names

If the domain name is for a campaign or program website, approval should be sought from SSQ Queensland Online before submitting the domain name registration request online. SSQ Queensland Online inform the Domain Name Provider (qld.gov.au) when they have approved the request. Note if the domain name requested does not meet the policy requirements, the Domain Name Provider (qld.gov.au) has the right to decline a domain name registration request.

DTA is the delegated authority for Australian Government domain and name requests are lodged through DTA's domain name registration web site. DTA then automatically forwards an email to the Domain Name Provider (.qld.gov.au) at the Department of Housing and Public Works (DHPW), for assessment and approval.

The delegate nominated by the agency, will be used as the central contact when DHPW verifies authorisation has been obtained for the submission of a new domain name registration request.

Where the domain name is for a campaign or program website, if approval has not been received from SSQ Queensland Online, the Domain Name Provider (qld.gov.au) will decline the request.

A full description of why the domain name is required should be included in the Stated Purpose section of the domain name registration request form. A detailed explanation of all fields is provided on the electronic form itself, and further information can be accessed on auDAs help page.

The general process for applying for a .qld.gov.au domain name is outlined in figure 1 of this document.

Registrant and Technical contact Information provided in the DTA template will be publicly available on the internet once the registration request has been processed. The status of an existing domain name can be checked using WHOIS on the Government domain names website.

Agencies should ensure where the domain name request is for a cross-jurisdictional program, this information is included when submitting the domain name application.

Figure 1: General registration process - Click for larger image

Dispute resolution for .qld.gov.au domains

Under the government domain registration process, an applicant, in lodging the request for a name, asserts they have a right to the requested name. It is assumed the applicant has a legitimate right to a name and the process only assesses compliance with the policies of the .qld.gov.au and higher domains.

In the case of conflicting name requests between an applicant and an existing .gov.au domain name registration, in the first instance the parties concerned (applicant and existing registrant) should attempt to resolve the matter, and report to the Domain Name Provider (qld.gov.au) if the resolution includes a change of registration details.

Should a dispute not be able to be resolved between the parties, this should be reported to the relevant Domain Name Provider (qld.gov.au) for further consultation and mediation.

If the Domain Name Provider (qld.gov.au) declines to register a requested name and the requesting agency wishes to appeal, in the first instance this should be directed back to the Domain Name Provider (qld.gov.au).

If the appeal remains unresolved at this level and if further action is desired, then agencies should either:

• follow the QGEA exception process, if rejected on the basis of Queensland policy
• approach DTA as the administrator of the .gov.au domain if rejection is based on DTA policy.

Management of .qld.gov.au domains

Domain name administration for .qld.gov.au is managed centrally by DTA.

Requests for domain names are lodged online through DTA, the delegated authority for all .gov.au domain name requests. DTA then automatically forwards qld.gov.au requests to the Domain Name Provider (qld.gov.au) at CITEC for consideration and approval.

All .gov.au domain names are registered and automatically renewed for twelve (12) month periods. This means all Domain owners must review their requirements and request deletion of any domain which is no longer required prior to the renewal date in 12 months.

Fourth level domain management and associated decision making is the responsibility of individual agencies. This is referring to the management of domains such as transport.qld.gov.au or health.qld.gov.au and their subdomains. For more information contact the Domain Name Provider (qld.gov.au) by email: dna@qld.gov.au.

Other domains

Government equivalent names

Registration of domains outside of qld.gov.au and qld.edu.au must only be undertaken after the domain name has been registered in the .qld.gov.au domain.

Note: Statutory authorities and councils do not have to meet this requirement.

Selecting domain names

Availability of desired non-.qld.gov.au name

When seeking to register a proposed domain name, a search of the name on a number of domain name registration sites must be performed to determine whether the name is available for registration.

When conducting your search, the following tips may assist:

• Search a database from an accredited domain name registration service for registered names (including variations). Some options for this search are:
  • Domain Name Registrar (Australia)
  • VentraIP
  • MelbourneIT
  • NetRegistry
  • AustDomains.
• Conduct a general search using an internet search engine (e.g. Google, Yahoo).
• Conduct a search of the trade mark database at the Australian Trade Mark On-line Search System to ensure the domain name you wish to register does not conflict with a trade mark which has already been registered.

If a name is already registered in circumstances where it is likely to constitute cybersquatting, remedial action may be available as outlined below in 'If requested name in the chosen domain is already registered'. The fact that a name you wish to register as a domain name is already registered does not necessarily mean cybersquatting has taken place and care should be taken to determine whether its use is legitimate before taking remedial action.

Selecting other domain names

When selecting a domain name where the use of other domain name extensions has been approved by the nominated delegate, agencies must adhere to auDAs domain name eligibility and allocation policy rules for open second level domains (2LDs) or for generic top level domains refer to the Internet Corporation for Assigned Names and Numbers (ICANN).

If requested name in the chosen domain is already registered

A determination needs to first be made as to whether the registration constitutes cybersquatting. It will be an agency decision based upon the level of harm that has been caused or may be caused and the level of effort and resources it will take to combat the threat as to whether formal steps are taken to pursue the registered owner of the domain name. If you consider cybersquatting has occurred, seek legal advice with regard to the options below.

If you believe the domain name you wish to register is victim to cybersquatting, you should initially contact the owner to discuss the transfer or cancellation of registration. If that fails, the following provides several courses of action, one of which may be appropriate:

Reservation of domain names

It is possible to reserve a domain name, so registration of the domain name passes to you once the current registration expires. In circumstances where a domain name is already registered, reservation of the name should occur to ensure the state obtains the registration, regardless of the outcome of any negotiations or further action regarding the threat of cybersquatting.

Dispute resolution policy

Both the universal domain names resolution policy (UDRP) and the auDA domain name resolution policy (auDRP) are efficient and cost-saving means of addressing cybersquatting without resorting to court. The UDRPs jurisdiction is limited to .com, .net or .org domain names, while the auDRPs jurisdiction is limited to Australian subdomains (i.e. .com.au, .net.au or .asn.au etc).

The only remedies available to a complainant from either the UDRP or auDRP are either the cancellation of the domain name or transfer of the domain name to the complainant. A court order is required should the complainant seek damages or any other remedial order.

The protection afforded by the UDRP and auDRP can extend to personal names, despite not being registered trade marks. However, this is in limited circumstances (particularly under the auDRP) and usually only successful for non-business celebrities such as actors and professional sports people, whose names can be said to be used in trade or commerce. Further information is available from the Uniform Domain-Name Dispute-Resolution Policy and the .au Dispute Resolution Policy (auDRP).

Court proceedings

Alternate remedies may exist either under common law or legislation, such as Competition and Consumer Act 2010 (Cth) and Trade Marks Act 1995 (Cth), to stop or prevent cybersquatting. Agencies should obtain legal advice if cybersquatting is encountered and an agency wishes to instigate legal proceedings.

Registration procedure for names in domains other than .qld.gov.au and .qld.edu.au

Registration of names in domains other than .qld.gov.au or .qld.edu.au is undertaken directly by the agency with commercial domain name registrars using their normal purchasing process. Agencies must ensure appropriate approval processes, adhering to the requirements in this standard, surround the decision to obtain a domain name in a domain other than .qld.gov.au or .qld.edu.au.

Once a domain name is registered, it must be included in the list of agency-owned domain names maintained by the agency's nominated domain name delegate.

Management of domains other than .qld.gov.au and .qld.edu.au

Unless agencies can demonstrate a compelling need, they should adhere to the .qld.gov.au or .qld.edu.au domain names and refrain from establishing non-government domain names.

Registration outside .qld.gov.au should only occur when one or more of the following apply:

• redirecting customers to the correct .qld.gov.au site
• a communication strategy aims to target an international audience
• a commercial imperative exists for the site to use other domain extensions
• a collaborative web project exists outside of government.

Agencies should consider transferring all names in domains other than .qld.gov.au or .qld.edu.au to one of those domains if the purpose of the site is not within the scope of the above definitions.

Maintaining domain name registrations

As part of the campaign or program initiation, agencies should develop a content transition plan to guide the steps needed during decommission. This could include content, domain names, DNS, certificates, emails, redirects.

Domain names are automatically renewed every 12 months. no invoices or reminders are sent to domain owners.

A decision must be made prior to the expiry date as to whether the domain name registration should be renewed. Consideration should be given to whether the system, project or slogan is still current, what level of goodwill is held in the domain name, and the level of perceived risk in relinquishing the domain name.

Domain names ownership and contact details

If agencies contract or deal with third parties, contracts must stipulate that ownership of domain names that arise out of, or that may be registered in relation to such dealings, is retained by the State. The agency should always be listed as the owner, with the account contact being from the agency. Registrant and Technical contact details can be a third party.

A registered domain name can carry significant value and this arrangement should clearly be reflected in the relevant contract or agreement between the parties. Professional legal advice should be sought in this respect.

Agencies must put in place procedures to ensure domain name registries are updated with the contact details of new responsible account holders when they change.

Transferring domain names

There may be circumstances where it will be necessary to transfer a registered domain name to another party. For example, a machinery-of-government change may transfer an area of responsibility, from one department which owns a related domain, to another. Where this applies, the new owning agency of the domain name should submit the Change of contact details form which is available on the DTA Domain name website or send an email to dna@qld.gov.au.

When this occurs, all contact and ownership details must be updated in the relevant databases and registries.

Deleting domains

Agencies must review all existing domains on an annual basis and make an assessment as to whether these domains are still required. Agencies are individually responsible for organising any period of remapping or redirection from old domain names which may be necessary prior to the deletion of the name in question. Where a domain name is no longer needed, the domain zone file should be deleted from the DNS by the service provider who hosts the zone file prior to the online domain name deletion request form being submitted.

A deletion request can be made by either sending an email to dna@qld.gov.au or by submitting the DTA domain deletion request form.