Registry, registrar and registrant: who arranges what?

Module 1: What is DNS? · Reading time: 7 minutes

Learning objective: After this lesson you can explain who arranges what around a domain name and where to look it up.

Key terms: ICANN, IANA, registry (such as SIDN, DENIC, Verisign), registrar, registrant, whois and RDAP, transfer code

Three layers

Three parties play a role around every domain name, plus you as the registrant. It helps to keep them apart, because each arranges something different.

1. IANA and ICANN: the root

At the top is the root of the DNS (lesson 1.2). Which top-level domains exist and who manages them is tracked by IANA (Internet Assigned Numbers Authority). IANA is part of ICANN, an international non-profit organisation. ICANN also makes the rules for generic TLDs such as .com and .org. For country codes such as .nl, each country largely makes its own rules.

2. The registry: the manager of one TLD

Every TLD has one manager: the registry. It keeps the register of all domain names under that TLD, including, for each name, the registrant and the nameservers. Examples:

The registry also runs the nameservers of the TLD itself. If a computer anywhere in the world asks about example.nl, the nameservers of .nl tell it which nameservers to ask next. We call this the delegation (lessons 1.4 and 2.1).

3. The registrar: where you register

As an individual or a business, you usually don't register directly with the registry, but with a registrar: a company that registers, renews and changes domain names on your behalf. Your hosting provider is often your registrar too, but that's not required. At SIDN, registrars used to officially be called "deelnemers" (participants); you may still come across that word.

Through your registrar you arrange, among other things:

• registering, renewing and cancelling;
• the nameservers of your domain;
• the details of the registrant and the contact persons;
• the transfer code (also called auth code, EPP code or token), which you use to transfer your domain to another registrar;
• with DNSSEC: passing on the key data (the DS record) to the registry (lesson 8.1).

Important: the registrar is not automatically the party that manages your DNS records. That's the party that runs the nameservers. Often this is the same party, but it can also be a different one, for example if you use Cloudflare (lessons 2.1 and 7.5).

4. The registrant: that's you

The registrant (in Dutch "houder") is the owner of the domain name: the person or organisation that decides about it. If you have a web developer arrange your domain, make sure that you (or your business) are registered as the registrant, not the web developer. Otherwise it can be difficult to transfer later.

Besides the registrant, there are often contact persons, such as an administrative and a technical contact. These may belong to another party. When transferring to a new registrar, they're often updated automatically along with it.

Looking up data: whois and RDAP

Want to know which registrar a domain has, which nameservers are set, and when it was registered? Then you use whois or its successor RDAP (Registration Data Access Protocol). Every registry offers a lookup function, for example the whois of SIDN for .nl. There are also general whois sites.

A whois response looks roughly like this (shortened):

Domain name: example.nl
Status:      active
Registrar:   Example Registrar B.V.
DNSSEC:      yes
Domain nameservers:
   ns1.examplehost.nl
   ns2.examplehost.nl
Creation Date: 1998-05-12

Due to privacy rules (GDPR), you usually no longer see personal data of individuals. You do see the registrar, the status and the nameservers.

Note the difference:

• whois/RDAP tells you what's recorded at the registry (which nameservers are set);
• a DNS query tells you what the nameservers answer.

If these two don't match, that's a sign something is wrong. For example, if you've changed your nameservers at the registrar but the new party hasn't got the zone ready yet (lesson 2.3).

Why this division matters

With this knowledge you can place many problems more quickly:

• "My domain has expired." That's a matter for the registrar and the registry, not the DNS. After expiry, a domain can enter quarantine; then the DNS stops working.
• "I want to change my records." You do that with the party that runs the nameservers, not necessarily the registrar.
• "I want to transfer." For a new registrar you need the transfer code. For a different DNS provider you don't need to transfer: you just change the nameservers.
• "I get an email from ICANN or the registry." This can be genuine (for example a request to confirm your email address), but it can also be phishing. Always check via your own registrar.

Summary

• IANA (part of ICANN) keeps track of which TLDs exist and who manages them.
• Every TLD has one registry, for example SIDN for .nl and Verisign for .com.
• You register through a registrar; there you arrange nameservers, registrant details and the transfer code, among other things.
• The registrant is the owner of the domain; make sure that's you.
• With whois/RDAP you see what's recorded at the registry, with a DNS query what the nameservers answer.

Quiz

Exercise

Exercise Z1.3: Nameservers of internet.nl. Use a whois or RDAP query (or a DNS query for the NS record) to find out which nameservers internet.nl has. Fill them in.

Further reading

These articles describe the situation at WebOké. Other registrars work in a similar way.

• What is SIDN and where are .nl domains registered?
• What is a domain holder?
• WebOké manual 2.1: Finding and choosing a domain name
• WebOké manual 5.12: Moving a domain away: transfer code (EPP) and transfer lock