Follow one fictional Australian not-for-profit as uncertainty in the ten-question Baseline becomes evidence, governance interpretation, decisions, organisational records, accountable follow-up and recurring review.
This is a supporting example, not another assessment. It does not add a guide, score, benchmark, maturity model or assurance conclusion.
Southern Community Services is a fictional, medium-sized Australian not-for-profit headquartered in Melbourne. It provides community services across metropolitan Melbourne. Its website, staff email and fundraising campaigns are ordinary parts of service delivery and community engagement.
A small internal technology function works with Corporate Services, Fundraising, Communications and external suppliers. Domain responsibilities have accumulated across those relationships over time rather than being deliberately designed as one governance model.
The organisation is intentionally neither unusually mature nor unusually weak. Some important answers therefore exist in memory, supplier knowledge or assumptions rather than governed evidence. All domains below remain reserved example names.
The Head of Corporate Services is accountable for core organisational technology and the primary domain. The Technology Manager operates the registrar, DNS and Microsoft 365, while Fundraising and Communications retain relevant business ownership and external suppliers provide specialist delivery.
Recurring governance later sits in the existing Technology, Risk and Service Review rather than a new forum.
southerncommunity.example
Primary public identity, website and staff email.
southernservices.example
Defensive holding and redirect to the primary site.
winterappeal.example
Previous fundraising campaign domain awaiting a retain/retire decision.
appeal.southerncommunity.example
Current fundraising campaign and supporter-communication boundary.
These are fictional scenario relationships, not endorsements or claims about what is representative of Australian NFPs.
A public website refresh and fundraising-platform change reached the existing technology and risk process. Questions about control, dependencies, sending authority and recovery could be answered only partly from memory, supplier knowledge and assumptions.
The organisation does not discover that its domain environment is bad.
It discovers that several important facts exist as assumptions rather than governed evidence.
The team uses the canonical questions without turning the responses into a score, percentage, maturity level or assurance conclusion.
| # | Canonical question | Response | Reason |
|---|---|---|---|
| 1 | Which domains do we own, and why do we own them? | Partial |
The primary and defensive domains are known, but the
registrar export reveals winterappeal.example,
and the campaign subdomain is inconsistently recorded.
|
| 2 | Who is the accountable business owner for each domain? | Partial | The primary-domain owner is clear; campaign, defensive and legacy ownership is informal. |
| 3 | Who has registrar access, and how is that access controlled? | Not sure | Two internal administrators are expected, but historic digital-agency privilege cannot be confirmed in the meeting. |
| 4 | When do the domains renew, and who receives renewal notices? | Partial | Auto-renew is enabled, but notices and payment dependencies rely too heavily on individual mailboxes and knowledge. |
| 5 | Which providers host authoritative DNS? | In place | Cloudflare is known to host authoritative DNS and nameserver evidence agrees. |
| 6 | Which systems and suppliers rely on each domain? | Partial | Website and Microsoft 365 dependencies are known, but fundraising, redirects and supplier dependencies are not recorded together. |
| 7 | Which domains are authorised to send email? | Not sure | Microsoft 365 is approved, but fundraising and previous campaign sending paths need reconciliation. |
| 8 | Are SPF, DKIM and DMARC configured and reviewed? | Partial | Records exist, but expected state, review ownership and possible obsolete supplier authority are incompletely evidenced. |
| 9 | Are DNS changes logged, reviewed and recoverable? | Partial | Cloudflare has audit history, but agency changes do not consistently link approval, validation and rollback evidence. |
| 10 | What is the incident path if a domain, DNS record or email control fails? | Not in place | The general incident process exists, but domain-specific contacts, references, independent communications and recovery validation are not assembled into a usable path. |
The uncertainties cluster into the five existing practices. The guides provide a bounded route from questions to records and decisions rather than a new framework.
Establish a domain register.
Control registrar and DNS authority.
Govern email authority and public signals.
Establish domain incident readiness.
Run a recurring domain governance review.
winterappeal.example is registered but missing from
the internal list. The campaign subdomain and supplier
dependencies are not represented consistently. Renewal messages
depend too heavily on individuals.
winterappeal.example remains registered while its
explicit retain/retire decision is open. It is not automatically
retired.
Public observation tells the organisation what appears
possible.
The authorised-sender record tells it what is
approved.
Governance requires reconciling the two.
A passing public signal does not prove good governance. A missing signal does not prove negligence. Observation is not judgement.
appeal.southerncommunity.example. A previous
campaign path remains visible or configured.
Assume at 9:15 am tomorrow the organisation loses access to authoritative DNS.
The organisation can now demonstrate current organisational knowledge without claiming a perfect state.
Material domains, purposes, dependencies and accountable owners are recorded, with renewal responsibility moving towards an organisational mailbox.
Registrar and DNS authority, approved email authority, recovery roles and evidence locations are documented and traceable.
Domain-layer evidence, exceptions and actions have a recurring place in an existing quarterly forum.
The walkthrough does not end with ten In place answers. Material uncertainty stays explicit, owned and dated.
winterappeal.example still requires an explicit
retain/retire decision from the Fundraising and Communications
Managers.
One fundraising/supplier sending path remains temporarily approved until its migration-point expiry or reconsideration.
One provider-exit or recovery capability still requires a future controlled test.
Good governance is not achieving a score. It is knowing what is true, what remains uncertain, who owns it, what decision has been made and what happens next.
Your context will differ from this fictional example. Work through the Baseline privately, take away the review summary, and place evidence, decisions and actions into the organisational records and governance processes you already operate.