Registrars, registries and managing a domain
Who does what in the registration chain, transfers and locks, expiry and auto-renew, nameserver delegation, and how to choose a DNS provider.
Who actually controls what
| Role | Responsibility | You interact via |
|---|---|---|
| ICANN | Sets policy and accredits registrars | Not directly |
| Registry | Operates one TLD and its zone file | Not directly; the registrar acts for you |
| Registrar | Sells and manages registrations, relays delegation | Your account and its API |
| Registrar reseller | Sells on behalf of a registrar | The reseller, who may be less helpful |
| DNS provider | Hosts your zone and answers queries | A separate account, often a different company |
| Hosting provider | Serves the website | Its own console |
The registrar controls the delegation - which nameservers the registry publishes for your domain. The DNS provider controls the records inside the zone. Keeping them separate is normal and healthy; it also means an outage can come from either side, so know which one you are debugging before you raise a ticket.
# the registrar side: which nameservers does the registry publish?
dig NS example.com @a.gtld-servers.net +norecurse
# the DNS provider side: what does one of those servers actually answer?
dig A www.example.com @ns1.example.com +norecurse
# registration data, subject to redaction
whois example.com | head -20Transfers, locks and expiry
- Client transfer lock prevents an unauthorised transfer. Leave it on, and turn it off only for the hours you need.
- Transfer authorisation code is issued by the losing registrar and expires. Request it when you are ready, not weeks in advance.
- The five-day rule: after transfer, changes to the registrar lock can be restricted. A same-day transfer plus nameserver change is not always possible.
- Auto-renew should be on for every domain that matters, with a card that does not expire. Expiry is the most avoidable outage in this entire discipline.
- Registrar lock and registry lock are different things. Registry lock adds out-of-band confirmation for critical domains and is worth it for a primary brand.
| Event | Grace period | Consequence if missed |
|---|---|---|
| Registration expiry | Auto-renew grace, typically 0-45 days | Redemption fee, then deletion |
| Redemption period | Around 30 days | Domain is recoverable only at a high fee |
| Pending delete | 5 days | Released to the public; anyone can register it |
| Transfer out | 5-7 days when approved | Records continue working throughout |
| WHOIS data change | Immediate | May trigger a verification email; unverified domains can be suspended |
A sane domain policy
all domains on auto-renew, payment method with an expiry reminder
transfer lock on except during a planned move
the registrant email is a shared mailbox, not one person's address
renewal and expiry dates tracked in a calendar you actually read
registrar account secured with hardware-key two-factor authentication
one document naming who can approve a nameserver changeChoosing a DNS provider and a registrar
| Question to ask | Why it matters |
|---|---|
| Is there a real API? | Automation is the difference between a 10-minute change and a change nobody wants to make |
| What is the query quota? | A busy site can exceed a free tier during an incident |
| Is it anycast? | Single-site DNS turns one datacentre problem into a global outage |
| Does it support DNSSEC? | Required by some buyers and by good practice |
| What is the SLA, and what does it pay? | Usually a credit worth less than the outage cost |
| How do I export my zone? | Exit cost is the real lock-in measure |
| Is it a registrar too? | Combining them is convenient but concentrates risk |
⚠️
Two independent DNS providers is a stronger position than one premium provider. Register the domain with one company and host the zone with another, keep an exported copy of the zone in version control, and you can recover from an account lockout or an outage of either party in minutes.
FAQ
Should I use my registrar's DNS?
It is fine for small sites and bad as a default. Registrar DNS often has weaker APIs, fewer points of presence and no DNSSEC. Separating the two also means a registrar dispute does not take your site offline.
What happens to DNS during a transfer?
Nothing. A transfer changes the registrar of record, not the delegation. Keep the nameservers unchanged and the site keeps resolving the whole time.
Related
Migrating DNS providers without downtime The DNS hierarchy, zones and delegation
Last refreshed 2026-09-18.