Summary

  • auDA's 2023 request for tender tests a change in the composition or control of a bidding registry operator only between bid submission and execution of the Registry Services Agreement, and even then only by letting auDA permit a substitution on a jointly written request.
  • auDA's own pages name the contracted operator as Identity Digital Australia Pty Ltd, formerly Afilias Australia Pty Ltd, with the current term beginning 1 July 2024. The executed agreement that would carry any post-signature consent is not public, so the public record stops exactly where the contract starts.

Every .au domain name resolves because a contract says it should. That contract is not published. What is published is a procurement rulebook, and inside it sits a sentence that tells you how far Australia's domain authority intends to look at the corporate identity of the company running its national registry: from bid to signature, then no further.

That sentence matters to anyone whose certificates, mail and routing hang off .au. It also explains the position of Cloud Registry Pty Ltd, the Sydney registry-platform company that appears in BTW's directory as an Australian registry and that has argued, in public and for years, for open competition in a role awarded behind a closed door (directory record Only for Strategic Circle).

What auDA's record says about who runs .au

auDA, the .au Domain Administration, states plainly that its registry is operated by Identity Digital Australia, which it describes as the .au registry operator and as a third party contracted by auDA to deliver registry services — appointed after a global tender in 2017 and reappointed after a further global tender in 2023 (auDA on the .au registry).

The 2023 tender page supplies the calendar: the successful tenderer was announced on 27 August 2023, and the term of the new registry services agreement begins on 1 July 2024 (2023 registry tender project). The same page, and auDA's own announcement, name the counterparty as Identity Digital Australia Pty Ltd (formerly Afilias Australia Pty Ltd) (auDA reappointment statement).

Two names, one continuous legal person as far as auDA's public pages are concerned. Take that line as a fact about naming and nothing more: the corporate events behind the rename are not established by these sources, and no ownership transaction should be read into them.

The control test, in its own words

Clause 7.2(a) of the 2023 Registry Operator Procurement deserves to be read whole rather than summarised:

"If during the period following the submission of the Tender and prior to the execution of a resultant Registry Services Agreement with the successful Tenderer, an event occurs that has the effect of substantially altering the: (i) composition or control of the Tenderer; or (ii) business of the Tenderer, auDA may allow substitution of the Tenderer with another legal entity following receipt of a jointly written request from or on behalf of the Tenderer and the other legal entity." (Registry Operator Procurement 2023)

In plainer words: a tender is a formal competitive procurement, and the clause watches a change in who owns or directs the company that won it — its composition or control. It watches only between handing in the bid and signing the contract. Even inside that window auDA "may allow" a substitution, so the power is discretionary, not automatic. And the trigger is a written request made jointly by the entity on the way out and the entity on the way in. Nobody is obliged to volunteer anything auDA has not been asked about.

Then the contract is executed and the published clause stops applying. The same document says auDA intends to contract with a single legal entity, which is the right instinct at signature and no guide at all for year three.

Why a pre-execution window is the wrong shape for a registry term

Registry terms are long by design. The events that reshape a registry operator rarely fall into the weeks between bid and award. They arrive after an integration, after an acquisition, after a parent company reorganises its holdings somewhere else in the world.

A change of name is the gentle case, and the one we can see. Take the harder one: nothing about the Australian entity's own registration moves, but the entity that controls it does. Under the published rulebook, that event has no procedural home — no published consent threshold, no published notification duty, no published auDA power to require a substitution mid-term.

That silence is not proof of a hole in the executed agreement. The Registry Services Agreement is not among the documents reviewed for this briefing, and nothing here says what it provides about a later change in the operator's ownership or control. It may be strict. It may say nothing. The problem is that registrars, registrants and researchers cannot tell which.

The outsider's ledger: Cloud Registry Pty Ltd

Cloud Registry Pty Ltd is the useful control case because it has never been inside. BTW's directory records it as a registry in AU with the alias cloudregistry.net, a confidence score of 0.85, and an unusually explicit evidence boundary: two domain references, one public website and three supporting public references, with data gaps logged as no ASNs and no contacts (directory record Only for Strategic Circle). Those gaps describe what the record holds. They are not a finding that the company announces no network resources or publishes no contacts.

No document reviewed here shows Cloud Registry Pty Ltd bidding in either the 2017 or the 2023 procurement. What the record does support is narrower and more pointed: a domestic registry-platform company exists, the .au contract sits with a different and internationally consolidated operator, and the published test for who controls that operator has already run out.

What the record does not answer

Three questions stay open, and they are the ones a registrar's risk committee would actually ask. Does the executed agreement require auDA's consent to a change of control in the operator? If it does, at what threshold and with what remedy? And if it does not, by what mechanism could a national domain's operating entity change hands without a public decision?

The presence of a pre-execution substitution clause in a tender does not establish that no post-execution control provision exists somewhere else. Stating that boundary once, precisely, is the honest way to finish the sentence.

The clock: 1 July 2024 and the next decision

The current term began on 1 July 2024. The next procurement is when this rulebook gets rewritten, and clause 7.2(a) is among the cheapest things in it to fix. Extend the control test across the whole term. Make notification mandatory rather than request-driven. Publish the executed agreement, or at minimum the clause that governs who may own the counterparty.

That is a small edit to a document that already exists. Until someone makes it, the only published answer to "who controls the .au registry" is a name — and a name is not a control test.