Domain name services are the separate services that attach to a registered domain and make it useful: the registration itself, DNS hosting, email, privacy protection, SSL/TLS certificates, and forwarding, along with security settings such as locks and DNSSEC. Each service can come from a different provider. A registrar may sell all of them in one account, or a business may register its domain at one company, host DNS at a second, run email at a third and buy certificates from a fourth. This guide explains what each domain name service does, who typically provides it, and why knowing who provides each one matters more than which company is cheapest.
Domain Name Services at a Glance
The table below lists the core services attached to a domain, what each one does, and where it usually comes from. The right-hand column is the one most owners never write down.
| Service | What it does | Typically provided by | What fails if it lapses or is lost |
|---|---|---|---|
| Registration | Holds the right to use the name and records its nameservers at the registry | A registrar or a reseller of one | Everything below it |
| DNS hosting | Publishes the records that point the name at web and mail servers | The registrar, the web host, or a dedicated DNS provider | Website, email and any service that relies on DNS records |
| Hosts the mailboxes for addresses on the domain | Google Workspace, Microsoft 365, Zoho Mail, a web host, or a registrar bundle | Inbound and outbound mail, password resets sent to those addresses | |
| Privacy or proxy | Keeps the registrant’s personal contact details out of public lookups | The registrar or an affiliated proxy service | Contact data may become visible; notices may route through the proxy |
| SSL/TLS certificate | Lets browsers confirm the site’s identity and encrypt the connection | A certificate authority, often through the web host or registrar | Browser security warnings; broken checkout and login pages |
| Forwarding | Redirects web visitors or email from the domain to another address | The registrar, DNS provider or web host | Redirected traffic stops arriving |
| Security settings | Locks, multi-factor login and DNSSEC that block unauthorized changes | The registrar and the registry | The domain becomes easier to hijack or misconfigure |
Registration: The Service Everything Else Depends On
Registration is the base layer. A registrar (an ICANN-accredited company that sells domain names) records the registration with the registry (the operator that keeps the master database for a top-level domain such as .com). The registration holds the term, the registrant details, the status locks, and the list of nameservers that the rest of the internet will use to find the domain’s DNS. Every other domain name service depends on it, because a domain that expires or is moved away takes its DNS, its email and its certificates with it.
Many businesses buy registration through a reseller, such as a web designer, a hosting company or a website builder, rather than directly from the registrar. That works until the business needs to recover an account or prove ownership, at which point it discovers a second company standing between it and its own domain. Our guide to the difference between a registrar and a registry explains how the layers fit together and why resellers complicate recovery.
DNS Hosting: Where the Records Live
DNS hosting is the service that publishes a domain’s records, such as the A record that points the name at a web server and the MX record that names its mail servers. The registration says which nameservers are authoritative; the DNS host operates those nameservers. Most registrars include basic DNS hosting at no added cost. Web hosts often supply their own nameservers. Dedicated DNS providers, such as Cloudflare, Amazon Route 53 and others, offer faster global networks, change logs and finer access controls.
The mistake we see most often is not knowing which provider is live. A business changes its nameservers to a new host, forgets that the old records still sit at the registrar, and later edits the wrong set. A related risk is the delegation that outlives its provider. ICANN’s Security and Stability Advisory Committee found that registrar nameserver renaming practices had exposed over 500,000 gTLD domains to resolution hijacking risk as of September 2020, according to SAC125, the SSAC Report on Registrar Nameserver Management. Our guide to nameservers and DNS records explains each record type and how to change DNS without an outage.
Email: The Service With the Most at Stake
Email on a custom domain is provided by a mail host, not by the domain itself. The domain’s MX records tell other servers where to deliver mail, and three more DNS records, SPF, DKIM and DMARC, tell receiving servers how to check that mail claiming to come from the domain is genuine. The mail host can be Google Workspace, Microsoft 365, Zoho Mail, a web hosting plan or a basic mailbox bundled by the registrar.
Large companies have largely adopted the authentication layer, though not every other control. CSC’s 2024 review of Forbes Global 2000 companies found DMARC adoption at 71%, up from 39% in its earlier measurement, according to the CSC 2024 Domain Security Report. Smaller businesses often have none of these records, which makes their domain easy to impersonate. Email matters for a second reason as well: registrar password resets and transfer approvals are sent by email, so the mailbox tied to a registration is a key to the domain itself. Our guide to how email domains work covers the records and the setup in detail.
Privacy and Proxy Services
A privacy or proxy service replaces the registrant’s name, address and phone number in public registration lookups with the details of a forwarding service. Since data protection laws led registrars to redact most personal data by default, privacy is less of a necessity than it once was, but it remains common. In 2024, 58.2% of gTLD domain records sampled were proxy-protected and 31.0% were redacted, according to the Interisle gTLD Registration Contact Data Study.
The difference between privacy and proxy registration matters. With privacy, you remain the registrant and only the public display changes. With a proxy, the proxy company may be listed as the registrant of record, which can complicate a later ownership dispute. Read the service terms before enabling it, and keep the underlying registrant details accurate either way. Our article on whether private registration for domain names is necessary weighs the trade-offs.
SSL/TLS Certificates
An SSL/TLS certificate (a digital certificate that lets a browser verify a site’s identity and encrypt the connection, still widely called SSL) is issued by a certificate authority, not by the registrar or the registry. Registrars and web hosts often resell certificates or install free ones automatically, and Let’s Encrypt issues free certificates through an automated protocol called ACME. Before issuing, the certificate authority checks that the requester controls the domain, usually by asking for a DNS record or a file on the web server.
That check is where domain control and certificates meet. Anyone who controls a domain’s DNS can obtain a valid certificate for it, which is why a hijacked domain can serve a phishing site with a working padlock. A CAA record (Certification Authority Authorization, a DNS record that names which certificate authorities may issue for the domain) narrows that risk. Only 10% of Forbes Global 2000 companies used CAA records in 2024, according to the same CSC report. Maximum certificate lifetimes are also being shortened in stages under industry rules, so certificates that renew automatically are now the practical default.
Domain and Email Forwarding
Forwarding sends visitors from one address to another. Web forwarding redirects requests for a domain to a different URL, usually with a permanent 301 redirect, which also tells search engines that the content has moved. Masked forwarding shows the destination site under the original domain inside a frame, which tends to cause problems with search engines and secure connections and is best avoided. Email forwarding passes mail sent to an address on the domain to another mailbox without hosting a mailbox at all.
Forwarding is often supplied free by the registrar, which makes it easy to forget. When a business consolidates several brand domains onto one main site, those forwards become part of its marketing. If the registrar account lapses or the forwarding service is changed during a migration, the redirected traffic simply stops.
Security Settings Attached to the Domain
The final group of domain name services protects the others. Multi-factor authentication on the registrar account blocks the most common takeover method. A registrar transfer lock (the clientTransferProhibited status) stops the domain from being moved to another registrar until it is turned off. A registry lock (a registry-level hold that blocks changes until the registrar verifies the request out of band) goes further, so a stolen password alone cannot change the nameservers or move the name. DNSSEC (DNS Security Extensions) signs the domain’s records so resolvers can detect tampering.
Adoption of the stronger options is still low, even at large companies. CSC found that 24% of Forbes Global 2000 companies used registry lock and 9% used DNSSEC in 2024, according to its 2024 Domain Security Report. Our guide to registrar account security sets out which settings to enable first.
Bundled or Separate: Choosing Who Provides Each Service
There is no single right arrangement. Bundling registration, DNS, email and certificates at one company is simpler and leaves fewer accounts to secure. Separating them, for example registering at one registrar while running DNS at a dedicated provider, adds resilience and lets each service be chosen on its merits. Either way, the business should own every account in its own name, protect each with multi-factor authentication, and keep a short written record of which company provides which domain name service.
In the cases we handle, the problem is rarely the choice of provider. It is that nobody at the business knows who provides what. A renewal fails on an old card, a former agency holds the DNS login, or the registration email points to a mailbox on the very domain that has just expired. Each of those gaps is easy to close in advance and slow to close after something has gone wrong.
How DNAccess Helps
Our domain name management service maps every service attached to a client’s domains, from registration and DNS hosting to email, certificates and forwarding, confirms that each account is owned by the business, and sets the locks and renewals so that one lapsed service cannot take the others down with it.
This article is part of the DNAccess Domain Name Basics guides, which explain how domain names, registrars and DNS work in plain English.