How does domain name registration work?

DNS
Published by

Registering a domain name is a bit like adding a book to a global library. You pick a title (the domain name), have it listed in the central catalogue (the DNS registry), and from that point on anyone in the world can find it. Except you don't own the book: you lease its shelf space, year after year. Stop paying and someone else can take your spot.

The four players in the system

Four distinct actors are involved in every domain registration:

The registrant is you. The person or company that wants to use a domain name, whether for a personal blog, an online store or a corporate portal.

The registrar is the company through which you lease your domain. Namecheap, GoDaddy, Cloudflare Registrar, Porkbun, Squarespace (formerly Google Domains) are all registrars. They give you the interface to search for an available name, reserve it, pay for it and manage its DNS configuration. Registrars must be accredited by ICANN, a process requiring a solid business plan, financial solvency, secure network architecture and commitments to customer service.

The registry is the organisation that runs the central database for a domain extension. Verisign operates .com and .net. Nominet runs .uk. Public Interest Registry manages .org. Each extension has a single registry, and it is the registry that knows at all times which domain is assigned to whom. You never interact with a registry directly; your registrar acts as the go-between.

ICANN (Internet Corporation for Assigned Names and Numbers) oversees the whole thing. This non-profit, based in California, was created in 1998 by the US government and transitioned in 2017 to a global multi-stakeholder governance model. ICANN supervises registries, accredits registrars, manages the DNS root zone and ensures the system remains stable while promoting competition.

Domain extensions: gTLDs, ccTLDs and the rest

The entire DNS flows downward from the root zone "." into top-level domains (TLDs). They fall into two main categories:

gTLDs (Generic Top-Level Domains) are thematic extensions such as .com, .org, .net, .edu, .info, plus the hundreds of newer ones launched since 2012 like .app, .dev, .io and .shop. Anyone can register one with no geographic restriction.

ccTLDs (Country Code Top-Level Domains) are tied to a country or territory: .uk for the United Kingdom, .de for Germany, .jp for Japan, .au for Australia. There are over 300 of them. Some ccTLDs require the registrant to have ties to the country. Others are open to all and have been repurposed because their name is catchy: .io (British Indian Ocean Territory, adopted by tech startups since IO stands for Input/Output), .fm (Federated States of Micronesia, popular with radio stations and podcasts), or .co (Colombia, used as a .com alternative).

What happens when you register a domain

The process feels instant to you, but several steps unfold behind the scenes:

You choose a registrar. Any accredited registrar works, but not all of them support every extension. Some ccTLDs and newer gTLDs only work with a limited number of registrars.

You search for an available name. The registrar queries the registry's database for your chosen extension in real time via EPP (Extensible Provisioning Protocol). If the name is free, it is offered to you. If taken, you will need to pick another or try buying it on the secondary market.

You create or select a DNS zone. Before the domain works, a DNS zone must exist somewhere with at least an SOA record (containing the admin email and primary server) and at least two NS records pointing to authoritative DNS servers for the domain. Your registrar can set this up automatically, or you can host it elsewhere (Cloudflare, Amazon Route 53, your own servers). Some registrars validate the zone before publishing NS records in the registry, preventing misconfigurations that could flag your domain as a potential spam source.

You pay and confirm. The domain is leased for at least one year. Pricing ranges from a few dollars for a basic .com to several hundred for premium extensions. At this stage you also supply your contact details, known as WHOIS information: name, address, email. ICANN requires this data for every domain, but your registrar will hide it to protect your privacy (under GDPR in Europe, or through a WHOIS privacy service elsewhere).

The registrar submits to the registry. Your registrar sends the NS records for your domain to the extension's registry via EPP. The registry inserts them into its database and propagates them across its infrastructure. The domain then becomes resolvable across the entire internet. This propagation takes anywhere from 20 minutes to a few hours depending on the registry and registrar.

You lease a domain, you don't buy it

Many people do not realise this: nobody owns a domain name. You are the registrant, holding an exclusive right of use for as long as you renew the lease and follow the terms of service. Stop paying and the domain moves through several phases:

  • Expiration: the domain stops working. Depending on the registrar you have 0 to 45 days to renew at no extra cost
  • Redemption Period: roughly 30 days during which you can still recover the domain, but with hefty restoration fees (typically $80 to $150)
  • Pending Delete: 5 days while the registry prepares permanent deletion. Nothing more can be done
  • Release: the domain becomes available for anyone to register

Specialised services like SnapNames and DropCatch monitor dying domains to capture them the instant they drop. If your domain had traffic or a solid SEO profile, it will be grabbed within seconds. Enable auto-renewal and keep your payment details current to avoid this.

Making DNS changes after registration

Once the domain is registered, two types of DNS changes exist, and they work differently:

Changes inside the zone (adding an A record, updating an MX, creating a subdomain) are made directly in your DNS zone without involving the registrar. You can do them at any time from your DNS host's interface.

Changes to the zone's NS records (switching DNS provider, for instance moving from your registrar to Cloudflare) must be communicated to the registrar, which passes them on to the registry. This kind of change is delicate: if the new NS servers are not fully configured before the switch, you risk a lame delegation where the domain points to servers that do not respond. Best practice is to set up the complete zone on the new servers first, verify they answer correctly, and only then update the NS records at the registrar.

Transferring a domain

ICANN guarantees the right to transfer a domain between registrars and to change a domain's registrant. For a registrar transfer the standard process is:

  • Unlock the domain at your current registrar (disable "registrar lock")
  • Obtain the authorisation code (auth code or EPP code)
  • Initiate the transfer at the new registrar using that code
  • Confirm by email (both parties must validate)

Transfers typically take 5 to 7 days. A domain less than 60 days old cannot be transferred, to prevent abuse. Transfers usually cost one year of renewal, and remaining time carries over.

Protecting your domain from hijacking

Domain hijacking is a real threat. An attacker who gains control of your domain can redirect your traffic, intercept your email and destroy customer trust. Several measures reduce the risk:

  • Strong, unique password on your registrar account. Never reuse a password from another service
  • Multi-factor authentication (MFA) enabled on the account. Prefer a TOTP app or hardware key over SMS, which is vulnerable to interception
  • Domain locking (registrar lock) enabled at all times. Unlock only for a legitimate transfer, then relock immediately
  • Auto-renewal enabled with up-to-date payment details. A domain that expires by accident is a domain lost
A domain name is not bought, it is leased. And that lease rests on a chain of trust between you, your registrar, the registry and ICANN. Keeping control of that chain (account access, MFA, locking, renewal) matters as much as the content you publish on it. Companies have lost their domains because a web agency registered it under its own account, or because an expired credit card prevented auto-renewal.