Registry, registrar, and DNS host

Four different organizations can be involved in one domain. People mix them up all the time, and then they change the wrong setting in the wrong dashboard. Let’s name them.

The four roles

The registry operates a top-level domain. Verisign runs .com. You never deal with the registry directly.

The registrar sells you the registration. It’s where you pay the yearly fee, and it records which nameservers are responsible for your domain. Namecheap, Cloudflare Registrar, and Porkbun are registrars.

The DNS host runs the authoritative nameservers for your zone. It gives you the dashboard where you add A, MX, and TXT records.

The web host serves your site after DNS has sent the visitor to it. Netlify, a VPS, Cloudflare Pages.

One company can wear several hats. Cloudflare is the DNS host for this site, and Cloudflare also sells registrations. If you use both, registrar and DNS host live in the same account. They’re still different jobs. Keep them separate in your head.

Pick the change from the failing layer

Once you know the roles, the right dashboard is obvious:

• Moving a website means changing A, AAAA, or CNAME records at the DNS host.
• Moving DNS hosting means recreating the zone at the new host, then changing the nameservers at the registrar.
• Moving registration means transferring the domain to another registrar. By itself this changes nothing about the site or the zone.
• Renewing the domain happens at the registrar. Paying your web host or DNS host doesn’t renew anything.

That last point has caught many people. The site goes dark because the domain expired, while every other invoice was paid.

See the delegation yourself

You don’t need any dashboard to see which nameservers a domain uses:

dig NS flaviocopes.com +short
dig +trace flaviocopes.com NS

The first shows what your resolver knows. The second shows where the parent zone sends the lookup.

Registration data lives elsewhere. The registry’s RDAP service tells you who registered the domain, when it expires, and which nameservers are on file. Privacy protection can hide the contact details, but the status and nameservers stay visible.

Protect the registrar account

The registrar account is the most valuable login you have for a domain. Change the nameservers there and you redirect the website, email, and every verification record at once.

Use a strong password and two-factor authentication. Turn on the registrar lock. Set renewal alerts, and write down how you’d recover access if you lost your phone.

Try this with one of your domains: write down the registry, registrar, DNS host, and web host. Then imagine moving the website. Which dashboard changes? The other three should stay untouched.