How domain names work and how to register one

The DNS tree

A domain name is a label in the DNS, the naming system that turns a name people can read into an address a computer can reach. The system is a tree. At the top sits the root, written as a single dot. Below it are the top level domains, below them the names you register, and below those the subdomains you invent yourself:

. the root com a top level domain (TLD) example.com a second level domain, the one you register www.example.com a subdomain, made by you mail.example.com another subdomain, also yours

Read a name from right to left: www.example.com. ends at the root, then com, then example, then www. The dot at the end is the root and is usually left out. Labels are up to 63 characters, a full name up to 253, and they are case insensitive: Example.COM and example.com are the same name.

There are three kinds of TLD. Country code domains (de, ru, uk) belong to a country and follow its rules. Generic domains (com, net, org) belong to anyone. New generic domains (dev, shop, blog) are sold like the old ones. A country code domain may ask for a local address or a passport copy; a com asks for nothing but money and a working email address.

ICANN, registry, registrar

Three organisations stand between you and a name, and it helps to know which one to blame when something goes wrong.

• ICANN coordinates the whole system: it approves registrars, sets the rules they follow, and through IANA keeps the root zone that lists every TLD and its name servers. Its policies are public at icann.org.
• The registry runs one TLD. Verisign runs com and net, Nominet runs uk, the Coordination Center runs ru. The registry keeps the authoritative list of registered names in that TLD and the name servers each one points to. You cannot buy a name from a registry directly.
• The registrar is the shop: it is accredited by ICANN (or by a country registry) and sells names to the public. Some registrars sell through resellers, who may look like the seller but are not the registrar of record. When a reseller disappears, the registrar still holds your name.
• You are the registrant, the owner. The registrar records your name, address and email and passes the technical data to the registry.

The public record of a name used to be a plain text service called WHOIS, still reachable on TCP port 43. Since the privacy rules of 2018 most of the personal data in it is hidden, and a newer service called RDAP answers the same questions over HTTPS in JSON. Both are useful to check who owns a name and when it expires. Install the tools on Ubuntu:

sudo apt install whois dnsutils

whois asks the registry and then the registrar, and prints their answer. The output is long; the first lines are the ones you need:

whois example.com | head -n 20

Domain Name: EXAMPLE.COM Registry Domain ID: 2336799_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.iana.org Updated Date: 2026-08-14T08:01:43Z Creation Date: 1995-08-14T04:00:00Z Registry Expiry Date: 2027-08-13T04:00:00Z Registrar: RESERVED-Internet Assigned Numbers Authority Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

The output is shortened. example.com is a name reserved for documentation, so its registrar is IANA itself; a name you buy shows the registrar company, its abuse contact and your own data, redacted or not depending on the TLD. The same record over RDAP:

curl -sL https://rdap.org/domain/example.com | python3 -m json.tool | head -n 8

{ "objectClassName": "domain", "handle": "2336799_DOMAIN_COM-VRSN", "ldhName": "EXAMPLE.COM", "status": [ "client delete prohibited", "client transfer prohibited"

RDAP is easier to read from a script than WHOIS, and it is the service registrars are moving to as WHOIS is retired.

Check whether a name is free

Never trust a search box alone: it may show a name as free because the registrar wants to sell it to you, and a popular name can be registered by someone else while you read. Ask the registry itself:

whois example.com | grep -i -E "no match|not found|domain name"

Domain Name: EXAMPLE.COM

On a free name the registry answers with a line such as No match for "example.com". A taken name returns a full record as above. For a country code domain the wording differs, and some registries only answer through their website.

The DNS can tell you whether a name is alive even when WHOIS is hidden. A registered name almost always has name servers, even if it has no website yet:

dig +short NS example.com

elliott.ns.cloudflare.com. hera.ns.cloudflare.com.

An empty answer does not prove the name is free: it can be registered and parked without delegation. An answer with name servers proves it is taken. The reverse check is the useful one.

Register the name step by step

The order below is the same at every registrar. The names of the buttons differ, the decisions do not.

1. Choose the name. Short, easy to say on the phone, and not confused with a competitor. Avoid hyphens and digits where you can: they are read aloud badly and typed wrongly. Check that the name is free in the TLD you want, and check the same word in one or two other TLDs before you commit, so that nobody builds a copy next door.

2. Check that it is free at the registry, not only at the shop, with the whois command above. If the name is taken, the record shows the expiry date: a name that expires in a month may be worth waiting for, but do not count on it.

3. Pick a registrar. Compare the price of the second year, not only the first: a cheap first year with an expensive renewal is the usual trap. Check that the registrar supports the TLD, gives you the name servers you need, offers a transfer lock and two-factor login, and answers support in a language you read. A registrar accredited by ICANN is listed in its public list at icann.org/en/accredited-registrars. For a country code domain, check the registry list instead: for ru it is cctld.ru.

4. Fill in the owner data. The registrant is a person or a company, with a real postal address, email and phone. This data is the legal proof of ownership: a registrar will ask for it if you lose the password, and a court will ask for it in a dispute. Use an email mailbox you control and will still control in five years, not the address of a former employer. If the site belongs to a company, register it to the company, not to the developer who built the site.

5. Confirm the email. ICANN rules for generic domains require the registrar to verify the registrant email within 15 days. Until you click the link in that message, the registrar may suspend the name: the site and the mail stop, and the name does not resolve. Check the spam folder the same day.

6. Choose the term and auto-renew. One year is enough to start; up to ten are allowed for most TLDs. Switch auto-renew on and keep a payment method that does not expire, then put the renewal date in your calendar anyway. Auto-renew fails silently when a card expires, and the reminder emails go to the address you no longer read.

7. Decide about WHOIS privacy. Most registrars hide personal data behind a proxy contact or redact it by default. Take the free option. It does not hide the fact that you own the name from the registry or from a legal request; it only keeps your home address out of public view. For a company, publishing a business address is normal and can help customers trust the site.

8. Set the name servers. This is the step that connects the name to a hosting. You can leave the registrar defaults for now and change them in the next lesson. If the registrar asks during the order, the hosting panel shows which name servers to use.

Name servers

The registry does not keep your website address. It keeps a delegation: the names of the servers that answer for your domain. Those servers hold the zone, the file with all records of the domain. To see the delegation and then follow it down from the root:

dig +trace example.com | head -n 20

. 518400 IN NS a.root-servers.net. . 518400 IN NS b.root-servers.net. ;; Received 239 bytes from 192.168.1.1#53(192.168.1.1) in 12 ms com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. ;; Received 1170 bytes from 198.41.0.4#53(a.root-servers.net) in 24 ms example.com. 172800 IN NS elliott.ns.cloudflare.com. example.com. 172800 IN NS hera.ns.cloudflare.com. ;; Received 754 bytes from 192.5.6.30#53(a.gtld-servers.net) in 31 ms

Three steps, three answers: the root sends you to the com servers, the com registry sends you to the name servers you chose at the registrar, and those servers finally answer with the address of the site. The output is shortened, and the last address is your own resolver, which differs.

A domain needs at least two name servers on different networks, so that one failure does not take the name offline. The hosting usually provides them. If the registrar offers its own DNS service, you may keep the name servers of the registrar and point records to the hosting instead; the next lesson compares the two ways.

Expiry, grace and redemption

A domain is rented, not bought. The dates in the WHOIS record explain everything, and the days after the expiry date have names:

The exact lengths depend on the TLD and the registrar: a country code domain can drop much faster, and some registries delete a name the day it expires. The practical rule is simple: renew at least a month before the date, and never let a name that carries your mail expire.

A released name is dangerous, not only sad. Whoever registers it receives the email addressed to your old mailbox, can reset passwords on services that still use that address, and can publish a site that looks like yours. If a name you need has just dropped, a backorder service can try to catch it, but the honest way is to renew on time.

Transfer and the registrar lock

A transfer moves a name from one registrar to another. It needs an authorisation code, also called the EPP code or the transfer secret, which the current registrar shows in its panel. The new registrar asks for it, the old one confirms by email, and the move takes about five days for a generic domain.

• A transfer usually adds one year to the registration and is often cheaper than a plain renewal.
• A name cannot be transferred within 60 days of registration or of a previous transfer.
• A transfer does not change the name servers, the owner data or the website.
• The owner email must be reachable: a confirmation sent to a dead address stops the move.

The registrar lock is the brake on all of this. Most registrars set the status clientTransferProhibited right after registration, and it blocks any transfer until you switch it off in the panel. Keep it on. A stolen domain is almost always a stolen registrar account, so protect the account itself: a long unique password in a password manager, and two-factor authentication on the login and on the email address behind it. Both are covered in lesson 8.

The current status is visible in WHOIS. Look for clientTransferProhibited and for clientHold: the second one means the registrar has suspended the name, usually because of an unpaid bill or an unverified email.

whois example.com | grep -i status

Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

One more setting is worth the five minutes it takes: DNSSEC. It signs your zone so that a forged answer cannot be believed, and it is switched on at the registrar with one click when the DNS provider supports it. Switch it off before you change name servers, and on again after, or the name stops resolving.

Quiz

Article author: Arthur Isaev