Guidance for using .gov.uk domains
What is a .gov.uk domain?
If you are a local authority, such as a parish, community, town or city council, you should consider using a gov.uk domain name for your website and email services to instil confidence in your users and provide authenticity to your messaging and with those who you communicate.
Similar to other domains, such as .com and .co.uk, it’s an internet domain suffix that can be used for websites, emails and other communication services on the internet. The difference is a that .gov.uk domain can only used by those authorised.
An example being a domain such as ‘yourtownname-tc.gov.uk’ or ‘yourvillagenameparishcouncil.gov.uk’. There are a limited number of permutations available to register:
For town councils the .gov.uk domain can be either ‘yourtownname-tc.gov.uk’ or ‘yourtownnametowncouncil.gov.uk’.
The same principle applies to parish councils, e.g. ‘yourvillagename-pc.gov.uk’ or ‘yourvillagenameparishcouncil.gov.uk’. You will not be able to register just a place name, such as ‘yourvillagename.gov.uk’. There are historical registrations that follow this naming method but the current application process requires you to adhere to either of the two options shown.
Anyone can register a .com or .co.uk domain but only a strict list of government organisations and public bodies, that include parish & town councils, can apply for and use a .gov.uk domain and it must be through a JISC & Cabinet Digital Data Office (CDDO) authorised registrar, such as Aubergine.
Why use a .gov.uk domain?
There are a great number of benefits for a council to operate from a .gov.uk domain – it improves the authenticity and trust of a council’s communications in addition to getting access to cyber security tools and services that are available to help harden the security of a council’s IT services. In addition, when operating from a .gov.uk domain, the site and its services are also more regularly monitored for security vulnerabilities, the council’s emails are more likely cleared through spam & security filtering software as well as the council’s website will also appear higher up in search results.
Overall, whether a small parish council or a large town or city, as a local government authority it is your responsibility to secure your IT infrastructure against cyber threats and operating from a .gov.uk domain is a major move towards achieving that.
If you are a parish or town council and are operating from or wanting to move over to using a .gov.uk domain for your website and email service, the CDDO have an up to date set of guidelines you must follow. These guidelines are provided at the point of registering through JISC and your registrar, the registry as well as on the main CDDO website.
Aubergine have been authorised by JISC & the CDDO to register and maintain .gov.uk domains since 2006 and we provide full domain registering services as well as maintaining the records in support of our WCAG 2.1AA compliant website services for councils to meet their publishing requirements.
Does a parish or town council legally need to have a .gov.uk domain?
No, not yet. Town councils are very much urged to operate from a .gov.uk domain as they have a greater responsibility and reach but there is nothing in legislation currently that requires it. However, the CDDO, NALC, SLCC and a handful of professional sector advisors, such as Aubergine, are discussing the concept of how councils of all sizes could migrate over to using the .gov.uk domain framework.
Of course, the main reasons for doing so are the benefits it brings, both in terms of security and authenticity of message, particularly in these heightened times of cyber threat.
How to get started with a .gov.uk domain
Here are the top 8 tips provided by the CDDO & Aubergine when operating from or considering using a .gov.uk domain:
- Benefits of getting a .gov.uk domain. This page aims to help councils & organisations who are having trouble getting buy-in from councillors and decision makers to make the move to a .gov.uk domain. This is a key tool for council clerks, staff and administrators who are seeking the improvement to the authenticity of the council’s messaging and overall cyber security.
- Keeping your domain name secure – From setting up services for your domain to using the National Cyber Security Centre’s (NCSC) free tools.
- Identify a domain name administrator – This page explains how each council must have a domain name administrator – it’s not a technical role but one of being the first point of contact and the guardian of the registration information in partnership with your registrar, such as Aubergine.
- Choose a good supplier for your .gov.uk domain – We get a lot of questions about which registrars to choose – Aubergine have been JISC & Cabinet Office registered since 2006 and manage many .gov.uk domains on behalf of councils of all sizes.
- How you are accountable for protecting your .gov.uk domain name – This page explains to registrants (a council) understand what a domain is, why you must protect it and how you are accountable. The CDDO explain that the day-to-day management of your domain can be done by a registrar, such as Aubergine if they wish.
- Creating a managing subdomains – For larger organisations, this page aims to provide guidance to help councils and their technical support keep track of subdomains.
- What to do if your domain name is compromised – The registrar (Aubergine) is usually the first port of call but other organisations such as NCSC and CDDO can also help, particular if there is a serious cyber incident.
- Get started with your .gov.uk domain – This page explains to councils what the next steps are once you have obtained your new .gov.uk domain. In all new domain registration cases, Aubergine will provide a guidance list of what you must do and how we support you in meeting the requirements of operating from a .gov.uk domain.
Here is a full explanation to all aspects relating to registering and managing a .gov.uk domain.
FAQs
How much does it cost?
Aubergine charge £100 + VAT for the first year which includes the application process and registration fee. Thereafter, it is £100 + VAT per year for domain registration and DNS management.
How long does it take to apply for a .gov.uk domain?
As a general rule, around one week from the initial application.
Who can apply?
Any parish, town or city council not already operating from a .gov.uk domain. You will need to do this through an approved registrar, such as Aubergine.
What are the requirements once we have a domain?
There are a range of requirements a council must meet when operating from a .gov.uk domain. These include making sure your website meets the WCAG 2.1AA accessibility standards, using domain-based email and ensuring you know what you must do as a registrant in the event of a cyber attack or breach (see item 7). Currently, parish and town councils only require the official registrant of the domain (usually the clerk to the council) to use domain-based email (e.g [email protected]) and this is the address used by the Cabinet Office as well as the NCSC to correspond with you. Many councils also have staff and elected officials use domain-based email addresses but at present, this is not a requirement and optional.
Does it come with a website & email?
No. Email and website services are not provided with the domain – this is something you will need to commission from your provider, such as Aubergine.
What is domain locking?
Domain Locking is a free service provided by the Cabinet Office that adds an extra layer of verification to your domain name that prevents unauthorised changes to the DNS settings and registrant details. We fully encourage all councils that operate from a .gov.uk domain to sign up for and more information about domain locking here.
Will it prevent my website getting hacked?
No. However, by virtue of you using a .gov.uk domain means that you will be choosing or using a website service provider who has a greater knowledge and experience of best practice cyber security. No website is 100% hack-proof but you can mitigate, through improved processes and attitude, as well as an improvement to your infrastructure, to reduce the likelihood and what to do if a breach happens.
Can my IT people look after it for us?
If your IT providers are JISC authorised, then they can be your registrar and maintain your domain and the DNS records. If they are not authorised, the domain can still be managed by your IT providers but they may need to request any changes to the domain’s settings with the registrar.
Where do I get help
If you need help in registering a new .gov.uk domain or are looking for a new service provider, contact us in the first instance. We are JISC authorised and experience in managing .gov.uk domains. If you need to speak to someone urgently about a cyber security breach with your .gov.uk domain, contact the service provider in the first instance after which you may need to contact the Cabinet Office for urgent help.
If you have any questions about registering a .gov.uk domain for your council and would like the process explained, please contact us on 01525 373020 or email [email protected].