But it can be one of the most important technology assets your business owns.

Your website may use it.

Your email depends on it.

Microsoft 365 may depend on its DNS records.

Customers recognise it.

And if something goes wrong with the domain, several seemingly unrelated business systems can stop working at the same time.

Despite this, many businesses aren’t completely sure where their domain is registered, who controls it or even whose name it’s registered under.

That’s a risk worth fixing before it becomes an emergency.

What is a domain name?

A domain is the address people associate with your business online.

For example:

yourbusiness.com.au

It can be used for your website and email addresses such as:

name@yourbusiness.com.au

But the domain does much more behind the scenes.

DNS — the Domain Name System — contains records that tell computers where different services associated with the domain can be found.

That can include your website, Microsoft 365 email and other cloud services.

If those records are changed incorrectly, services can stop working even though there is nothing wrong with Microsoft 365 or your website itself.

Domain registration and website hosting aren’t the same thing

This causes a lot of confusion.

Your domain registrar is the organisation responsible for registering and renewing your domain.

Your DNS provider hosts the DNS records that direct traffic for the domain.

Your web hosting provider hosts your website.

Your email provider might be Microsoft 365.

These can all be different companies.

For example, a business could have its domain registered with one provider, DNS hosted somewhere else, its website on another hosting platform and email with Microsoft 365.

That’s completely normal.

The important thing is knowing who is responsible for each component.

Who actually owns the domain?

This is one of the first things every business should know.

Ideally, the domain should be registered to the appropriate business entity using accurate and current information.

Problems can occur when domains were originally registered by:

• A former employee
• A previous IT provider
• A web developer
• A marketing agency
• The business owner’s personal account
• Someone who is no longer associated with the business

Often this arrangement works perfectly well for years.

Then somebody needs to transfer the domain or make an important change and discovers that nobody has access to the account.

What should have been a five-minute task can suddenly become a much larger problem.

Australian domains have eligibility requirements

Australian domain names such as .com.au aren’t simply anonymous internet addresses.

Registrants need to meet the relevant eligibility requirements for the domain they hold.

That makes accurate registration information particularly important.

If company details change, businesses shouldn’t assume their domain registration will automatically update itself.

Domain information should be treated as a business record that needs to remain accurate.

What happens if a domain expires?

This is where domain management becomes particularly important.

Imagine your business has used:

yourbusiness.com.au

for ten years.

Employees have email addresses using that domain. Customers know the website. Business cards, invoices and marketing material all contain it.

Then the domain isn’t renewed.

Depending on the circumstances, the website may stop resolving and email delivery can be affected.

Suddenly, a relatively inexpensive annual renewal has created a potentially serious business interruption.

Businesses should therefore know:

Who receives the renewal notices?

Is automatic renewal enabled?

Is the payment method current?

Who is responsible for checking that renewal succeeded?

Those are simple questions, but they’re worth answering.

DNS changes can affect your email

DNS is particularly important for Microsoft 365.

When somebody sends an email to your company, DNS records help determine where that email should be delivered.

Other DNS records can also help receiving email systems determine whether messages claiming to come from your domain are legitimate.

This can involve technologies such as:

SPF — identifies systems authorised to send email for your domain.

DKIM — uses cryptographic signatures to help verify email.

DMARC — provides policies and reporting around email authentication.

Incorrect DNS changes can therefore affect both incoming and outgoing email.

That’s why DNS access should be controlled carefully.

Your web developer doesn’t necessarily need control of everything

A web developer may need to make DNS changes when launching a new website.

That doesn’t necessarily mean they need permanent control over the business’s domain registration or entire DNS environment.

Where possible, access should follow the same least privilege principle used elsewhere in cybersecurity.

Give people the access they need to perform their role without unnecessarily transferring control of unrelated services.

For example, changing where a website points shouldn’t require handing over ownership of the entire domain.

Protect domain accounts with MFA

A domain registrar account is an important security account.

If somebody gains access to it, they may potentially be able to change where your website or other services point.

Registrar and DNS accounts should therefore use strong unique passwords and Multi-Factor Authentication wherever supported.

Administrative access should also be limited to people who genuinely need it.

This is another reason why domains shouldn’t remain indefinitely inside the personal account of a former employee or external contractor.

DNS providers can also provide security services

Modern DNS platforms can provide considerably more functionality than simply storing DNS records.

Depending on the provider and configuration, this can include security features, traffic management, website protection and improved visibility.

For business-critical domains, the DNS platform should be selected deliberately rather than simply using whatever service happened to be included when the domain was first purchased.

Document where everything is located

Businesses don’t necessarily need to understand DNS technically.

But somebody should maintain basic documentation.

At minimum, you should know:

• Where the domain is registered
• Who the registrant is
• When the domain expires
• Who has administrative access
• Where DNS is hosted
• Where the website is hosted
• Who manages Microsoft 365
• Who is responsible for renewals

If your current IT provider disappeared tomorrow, could somebody answer those questions?

If not, the environment needs better documentation.

Be careful when changing IT providers

Domain ownership becomes particularly important when a business changes IT providers, web developers or marketing companies.

Before ending the relationship, make sure the business has access to its domain and other important technology accounts.

A well-managed transition should include the transfer of appropriate credentials, documentation and administrative control.

The domain belongs with the business — it shouldn’t become leverage that makes changing providers unnecessarily difficult.

Domain management is business continuity

It’s easy to think of domains as a website issue.

They’re not.

For many businesses, the domain connects several critical systems together.

A problem with the domain or DNS can affect email, websites, cloud services and customer communication simultaneously.

That makes domain management part of the organisation’s broader business-continuity and cybersecurity strategy.

Managing domains with itX365

At itX365, we manage domains and DNS as part of the broader technology environments we support.

Our preference is to keep domain registration, DNS, Microsoft 365 and other critical services properly documented and under appropriate administrative control.

For DNS, we commonly use platforms such as Cloudflare, while Australian domain registration can be managed through Australian wholesale providers.

The specific provider matters less than making sure the business maintains control, renewals are managed and critical DNS records are protected.

Do you know who controls your business domain?

Try answering these four questions:

Where is your domain registered?

Whose name is it registered under?

Who controls its DNS?

When does it expire?

If you’re not sure about any of those answers, it’s worth finding out before you urgently need them.

Talk to itX365 if you’d like help reviewing your business domain, DNS or Microsoft 365 configuration.

Not that long ago, an internet outage was inconvenient.

Employees might lose access to websites and email for a while, but much of the business could continue operating locally.

That’s very different today.

For many small businesses, an internet connection provides access to Microsoft 365, cloud accounting, line-of-business applications, payment systems, remote workers, cloud backups and even the business phone system.

When the internet stops, a significant part of the business can stop with it.

That’s why businesses should start treating internet connectivity as critical infrastructure rather than simply another monthly service.

What actually stops working during an internet outage?

The answer depends on how your business operates.

A modern business might rely on its internet connection for:

• Microsoft 365 and cloud applications
• Email
• OneDrive and SharePoint
• Microsoft Teams
• Cloud accounting and CRM systems
• VoIP business phones
• Remote access
• Cloud-hosted servers
• Online ordering and payment systems
• Offsite backups
• Access to supplier and customer portals

If most of these services depend on one internet connection, that connection represents a significant single point of failure.

A fast internet connection isn’t necessarily a resilient one

When businesses compare internet services, speed usually receives most of the attention.

How many megabits per second do we get?

How quickly can we download files?

What’s the upload speed?

Those are important questions, but reliability is just as important.

A very fast connection provides little value while it’s offline.

Businesses that depend heavily on cloud services should therefore consider both performance and resilience when choosing their internet solution.

Why internet connections fail

Internet outages can happen for many reasons.

There might be a fault with the NBN network or another carrier. Construction work could damage a cable. Network equipment might fail. There could be a power issue, configuration problem or fault further upstream with the service provider.

Some outages last only a few minutes.

Others can last hours or, in more serious cases, considerably longer.

The important question isn’t whether an outage will ever happen.

It’s:

What happens to your business when it does?

What is internet failover?

Internet failover provides an alternative connection that can be used when the primary service becomes unavailable.

For many small businesses, this might be a 4G or 5G mobile connection.

The business normally operates over its primary NBN or fibre connection. If that connection fails, appropriately configured network equipment can switch internet traffic to the secondary service.

When the primary service becomes available again, traffic can return to it.

Ideally, much of this happens automatically.

Does every business need a backup internet connection?

Not necessarily.

Just like backups and cybersecurity, the appropriate solution depends on the consequences of failure.

Consider a two-person business where employees can temporarily use mobile hotspots. An automated secondary internet service might not be necessary.

Now consider an office with 20 employees where the phones, email, Microsoft 365 and primary business application all depend on internet connectivity.

An hour without internet could potentially cost much more than maintaining a backup connection.

The decision should therefore be based on business impact rather than business size alone.

4G and 5G can provide practical backup connectivity

Mobile networks have made internet redundancy much more accessible to small businesses.

A dedicated 4G or 5G connection can provide sufficient connectivity to keep important cloud services operating during many fixed-line outages.

However, mobile connectivity has its own limitations.

Performance can depend on signal strength, network congestion, building construction and mobile coverage.

A backup service should therefore be tested rather than simply installed and forgotten.

Two internet connections don’t always mean true redundancy

This is an important consideration.

A business might purchase two internet services and assume it now has redundancy.

But if both services ultimately depend on the same physical infrastructure, the same network path or the same equipment, a single failure could potentially affect both.

True redundancy requires understanding where the possible points of failure are.

For some businesses, using different technologies — such as NBN plus 5G — can provide better diversity than two services relying on similar infrastructure.

Your firewall or router matters too

Having a second connection doesn’t automatically create failover.

The business network needs equipment capable of managing multiple internet connections and detecting when the primary service has failed.

A properly configured firewall or router can manage this process and determine how traffic should behave during an outage.

This is another reason why business network equipment should be selected based on requirements rather than simply using whichever router came with the internet service.

What about business phones?

Internet outages can have an unexpected impact on modern phone systems.

Many businesses now use VoIP or cloud-hosted phone services.

These systems provide significant flexibility, but office handsets still require internet connectivity to reach the cloud phone platform.

If the primary internet service fails and there is no alternative connection, employees may lose both their internet access and their desk phones at the same time.

A properly designed failover solution can help keep both services operating.

Don’t forget about power

Internet redundancy doesn’t help if the networking equipment turns off during a power interruption.

Routers, firewalls, network switches, wireless access points and other critical network equipment can potentially be protected using an appropriate UPS.

How much backup power a business needs depends on the equipment and how long it needs to operate.

For businesses where connectivity is particularly important, internet resilience and power resilience should be considered together.

Test your failover before you need it

There’s a simple way to find out whether your backup internet works:

Disconnect the primary connection.

A planned test can reveal issues that aren’t obvious during normal operation.

Do computers remain online?

Can employees still access Microsoft 365?

Do the phones continue working?

Does the network automatically return to the primary connection when it becomes available?

Finding these problems during a planned test is much better than discovering them during a real outage.

Start with the cost of downtime

Businesses sometimes look at redundancy as an unnecessary additional expense.

A better way to evaluate it is to consider the cost of being offline.

If ten employees can’t work effectively for three hours, what does that cost the business?

What happens if customers can’t telephone the office?

What happens if employees can’t access the primary business application?

Once you understand the potential impact of an outage, it’s much easier to decide how much redundancy is appropriate.

Building resilient business connectivity

At itX365, we help Perth businesses design internet and network solutions around how they actually operate.

That can include business internet services, managed network equipment, firewalls, Wi-Fi, 4G/5G failover, business phone systems and monitoring.

The objective isn’t to promise that an internet service will never fail.

It’s to make sure that when something does fail, one fault doesn’t unnecessarily bring the whole business to a stop.

How dependent is your business on one internet connection?

If losing your internet connection would also mean losing your phones, Microsoft 365 and access to critical business applications, it may be worth reviewing your current connectivity.

Talk to itX365 about business internet and connectivity options for your Perth business.

Microsoft 365 has transformed how small businesses store and access information.

Email is stored in Exchange Online, documents are kept in OneDrive and SharePoint, and employees can access company information from almost anywhere.

Because this information is stored in Microsoft’s cloud, it’s easy to assume that everything is automatically backed up and can always be recovered.

The reality is more complicated.

Microsoft operates highly resilient infrastructure and provides a range of retention and recovery capabilities. But businesses are still responsible for protecting their information against many everyday risks.

That’s why understanding the difference between cloud availability, retention and backup is important.

Isn’t Microsoft 365 already protected by Microsoft?

Yes — but that protection shouldn’t automatically be considered the same thing as an independent backup.

Microsoft is responsible for operating the Microsoft 365 platform and protecting the infrastructure that delivers services such as Exchange Online, OneDrive and SharePoint.

Microsoft builds substantial redundancy into these services.

But infrastructure resilience solves a different problem from backup.

If Microsoft experiences a hardware failure, its infrastructure is designed to keep the service operating.

If an employee deletes important information, a user account is compromised, or information is changed or removed intentionally, that’s a different type of problem.

This is where independent backup can become valuable.

What can cause Microsoft 365 data loss?

Data doesn’t need to disappear because Microsoft’s servers have failed.

Some of the most common risks happen at the user or organisation level.

Accidental deletion

People make mistakes.

An employee might delete an email, overwrite a document or remove an entire folder without realising that other employees still need it.

Often the mistake isn’t discovered immediately.

By the time somebody notices, the available recovery options may be more limited.

A departing employee

Employee departures can create complicated data-management situations.

Their mailbox, OneDrive files and access to SharePoint may contain important business information.

Simply deleting the user’s account without considering what information needs to be retained can create unnecessary risk.

This is why offboarding should be a managed process rather than simply removing a Microsoft 365 licence.

Cybersecurity incidents

A compromised user account can potentially give an attacker access to business information.

Depending on the circumstances, an attacker could delete or alter information in addition to stealing it.

Ransomware and other malicious activity can also affect files synchronised between computers and cloud storage.

Backups provide another recovery option when preventative security controls fail.

Malicious deletion

Not every data-loss incident is accidental.

A disgruntled employee or somebody with excessive permissions could intentionally delete or alter business information.

Good access controls reduce this risk, but independent backups provide another layer of protection.

What about Microsoft’s recycle bins and retention?

Microsoft 365 includes useful recovery and retention capabilities.

For example, deleted files may remain recoverable for a period of time, and administrators can configure retention policies for certain types of information.

These features are extremely useful.

However, retention and backup aren’t exactly the same thing.

Retention primarily helps organisations preserve information within Microsoft 365 according to configured policies.

An independent backup creates another copy of the information outside the primary Microsoft 365 environment.

That separation can be valuable when something goes seriously wrong.

What should a Microsoft 365 backup protect?

The exact requirements depend on the business, but organisations commonly consider protecting:

Exchange Online — employee and shared mailboxes, including email, calendars and contacts.

OneDrive — individual users’ business files.

SharePoint — shared company documents and information.

Microsoft Teams — depending on the backup platform and the information the organisation needs to retain.

The important thing is to understand exactly what your backup service protects rather than assuming that “Microsoft 365 backup” means everything is covered.

Backup retention matters

Having a backup is only part of the equation.

How long is the information retained?

Imagine an important document was deleted four months ago but nobody noticed until today.

If the backup system only retains information for 30 days, the backup may not help.

Different organisations have different retention requirements based on operational, legal and compliance considerations.

This is something businesses should understand before they need to recover information.

A backup is only useful if you can restore from it

This principle applies to almost every backup system:

A successful backup isn’t the same thing as a successful recovery.

Seeing a green “backup successful” status is reassuring, but ultimately the purpose of a backup is to restore information.

Businesses should know how information can be recovered and who is responsible for performing the recovery.

For important systems, recovery should also be tested periodically.

What about data stored on business servers?

Microsoft 365 isn’t necessarily the only information a business needs to protect.

Some organisations still operate servers, NAS devices, databases or industry-specific applications.

Those systems may require completely different backup strategies.

A sensible backup plan starts by asking:

What information would seriously affect the business if we lost it tomorrow?

Once that information has been identified, you can determine where it lives and how it should be protected.

Backup is part of a broader disaster-recovery strategy

Backup and disaster recovery are related, but they’re not the same thing.

Backup is about preserving information.

Disaster recovery asks a larger question:

How do we get the business operating again?

If a server fails, having its data backed up is important. But the business may also need replacement infrastructure, applications, configuration information and a plan for restoring services.

Likewise, if internet connectivity fails, having perfect backups doesn’t help employees access cloud applications.

A good business-continuity strategy considers these dependencies together.

Does every business need third-party Microsoft 365 backup?

There isn’t one answer that applies to every organisation.

Microsoft provides useful native recovery and retention capabilities, and businesses should understand those capabilities before purchasing additional products.

However, organisations that rely heavily on Microsoft 365 may decide that an independent backup provides worthwhile additional protection.

The decision should be based on the value of the information, the organisation’s recovery requirements and the consequences of losing access to that information.

The important thing is to make the decision deliberately rather than simply assuming:

“It’s in Microsoft 365, so it must be backed up.”

Protecting business data with itX365

At itX365, we help Perth businesses understand where their important information is stored and how it is protected.

This can include Microsoft 365 backup, server backup, offsite backup, monitoring and disaster-recovery planning as part of a broader managed IT strategy.

Our approach is to start with the business requirement rather than the product.

What information matters?

How long should it be retained?

How quickly would it need to be recovered?

And who is responsible for making sure that recovery actually works?

Those questions are far more important than simply having a box somewhere that says “Backup Enabled.”

Is your business data actually protected?

If you’re unsure what happens to your Microsoft 365 data when something is accidentally deleted, compromised or lost, it may be worth reviewing your current backup and recovery strategy.

Talk to itX365 about reviewing your Microsoft 365 and business backup requirements.

Unfortunately, a password on its own is no longer enough to adequately protect important business information.

Employees use Microsoft 365, cloud accounting systems, online banking, CRM platforms and dozens of other online services. If an attacker obtains the password to one of these accounts, they may be able to access sensitive business information without ever touching the employee’s computer.

That’s why Multi-Factor Authentication (MFA) has become one of the most important basic cybersecurity controls for businesses.

What is Multi-Factor Authentication?

Multi-Factor Authentication adds another verification step when someone signs into an account.

Instead of relying only on something you know — your password — the system asks for another form of verification.

This might include:

• An authentication app on your phone
• A security key
• A biometric such as a fingerprint
• A passkey
• A temporary verification code

The important difference is that stealing the password alone may no longer be enough to access the account.

Why aren’t passwords enough anymore?

The problem isn’t necessarily that employees choose terrible passwords.

Even a strong password can be compromised.

Passwords can be exposed through phishing attacks, malware, compromised websites and other data breaches.

An employee might also be presented with a convincing fake Microsoft 365 login page and unknowingly provide their credentials directly to an attacker.

Without additional protection, those credentials could potentially be used to access the employee’s account.

MFA creates another obstacle.

What happens when a Microsoft 365 account is compromised?

A compromised Microsoft 365 account can be much more serious than somebody simply reading a few emails.

Depending on the user’s permissions and the organisation’s configuration, an attacker may gain access to email, OneDrive files, SharePoint information and other company resources.

Email accounts are particularly valuable because attackers can use them to impersonate employees.

For example, an attacker could monitor an email conversation involving an invoice and then attempt to substitute different banking details.

Because the message appears to come from a legitimate company account, these attacks can be extremely convincing.

MFA significantly improves account security

With MFA enabled, knowing the username and password may no longer be sufficient.

The attacker also needs to satisfy the additional authentication requirement.

This makes many common account-compromise attacks considerably more difficult.

However, it’s important to understand that not all MFA methods provide the same level of protection.

SMS vs authenticator apps

One of the earliest widely adopted MFA methods was sending a verification code via SMS.

SMS verification is generally better than protecting an account with only a password, but stronger authentication methods are now available.

Authenticator applications such as Microsoft Authenticator can provide a better authentication experience and support more modern security capabilities.

Instead of receiving a text message containing a code, the employee verifies the authentication request using an application registered to their account.

For businesses using Microsoft 365, moving away from reliance on SMS authentication is a sensible part of improving account security.

MFA isn’t completely phishing-proof

This is an important point.

Simply enabling MFA doesn’t mean an account can never be compromised.

Attackers have developed techniques designed to trick users into approving fraudulent authentication requests or providing authentication information through sophisticated phishing websites.

That’s why MFA should be considered one layer of security rather than the entire security strategy.

Modern identity security can go further by considering factors such as the user, device, location and risk associated with a login attempt.

Microsoft 365 Business Premium, for example, provides additional identity and device-management capabilities that can be used to build stronger access policies.

Related: Microsoft 365 Business Standard vs Business Premium: Which Does Your Business Need?

Be careful with unexpected authentication requests

One simple rule can prevent a lot of trouble:

If you aren’t trying to sign in, don’t approve an authentication request.

If an unexpected Microsoft Authenticator notification appears on your phone, somebody may be attempting to access your account.

Don’t simply approve the request to make the notification disappear.

If you’re unsure why you’re receiving authentication requests, contact your IT provider.

MFA should also protect administrator accounts

Administrator accounts deserve particular attention.

These accounts can potentially make significant changes to a company’s systems and security configuration.

An administrator account compromised by an attacker can therefore create considerably more risk than an ordinary user account.

Businesses should minimise unnecessary administrator access and ensure privileged accounts are appropriately protected.

The principle is straightforward:

Users should only have the access they actually need to perform their job.

What about shared accounts?

Businesses sometimes create a single username and password and give it to several employees.

This creates security and accountability problems.

Where possible, employees should have their own identities and permissions rather than sharing login credentials.

This makes it easier to control access when somebody joins or leaves the organisation and provides better visibility into who has access to company information.

MFA is only one layer of cybersecurity

MFA is extremely important, but businesses shouldn’t stop there.

A sensible cybersecurity strategy can include:

• Multi-Factor Authentication
• Endpoint protection
• Email security
• Managed firewalls
• DNS and web filtering
• Security updates
• Device management
• Access controls
• Backups
• Security monitoring

No individual security product can eliminate every risk.

The objective is to create multiple layers so that the failure of one control doesn’t automatically result in a serious security incident.

Who should have MFA enabled?

For most businesses, the answer is simple:

Everyone.

If an account provides access to business information, it should generally have appropriate authentication protection.

This is particularly important for Microsoft 365 because email, OneDrive, SharePoint and Teams can contain a significant amount of sensitive company information.

Don’t wait for an account compromise

Cybersecurity improvements are much easier to implement before an incident occurs.

If your business is still relying primarily on usernames and passwords, MFA is one of the most important security improvements you can make.

But enabling MFA is only the beginning.

Businesses should also consider how authentication, device security, Microsoft 365, backups and network security work together as part of their overall cybersecurity strategy.

Protecting Microsoft 365 with itX365

At itX365, we help Perth businesses manage and secure their Microsoft 365 environments as part of our managed IT services.

This includes helping businesses implement appropriate authentication, Microsoft 365 security, device protection and other cybersecurity controls based on their requirements.

Technology security doesn’t need to become complicated for employees.

The goal is to make the secure way of working the normal way of working.

Concerned about the security of your Microsoft 365 environment?

Talk to itX365 about reviewing your current Microsoft 365 security configuration.