A domain registrar is the company that sells you a domain name and manages the registration on your behalf. A domain registry is the organization that operates the extension itself, such as .com or .org, and keeps the master database of every name registered under it. The registrar is the shop you deal with; the registry is the authoritative record the shop writes to. Knowing which is which, and who sits between you and each of them, tells you who actually controls your domain name.
This guide is part of our domain name basics section. It explains the roles in plain terms, shows how a change moves from your account to the registry, and explains why the answer to “who controls my domain” is almost always “whoever controls the registrar account.”
ICANN sets the rules
At the top of the system is ICANN (the Internet Corporation for Assigned Names and Numbers), the nonprofit that coordinates the global domain name system. ICANN does not sell domain names. It signs contracts with the registries that operate generic top-level domains, or gTLDs (extensions such as .com, .net, .org and newer ones such as .shop), and it accredits the registrars allowed to sell names in them. Those contracts carry the policies every registrar must follow, including the Transfer Policy, the rules on expiration notices, and the requirement to publish registration data through RDAP (the Registration Data Access Protocol, the system that replaced WHOIS for looking up registration records).
ICANN is funded in part by the registrars it accredits. Its fiscal year 2027 fee request sets a registrar transaction fee of USD 0.20 per transaction-year, plus a shared registrar fee of USD 3.8 million per year divided among all accredited registrars, according to the ICANN Registrar Fee Approval Request for Fiscal Year 2027. That small fee is part of the price of every gTLD registration and renewal you pay.
What a domain registry does
A registry operates one or more top-level domains. It runs the authoritative database of registered names, publishes the zone file (the list of every name in the TLD and the nameservers each one delegates to), and operates the servers that answer the first step of every lookup for that extension. It also sets the wholesale price that registrars pay.
Verisign operates the registry for .com and .net. Those two extensions together held 173.5 million registrations at the end of 2025, 161.0 million of them in .com, according to the Verisign Domain Name Industry Brief for the fourth quarter of 2025. Other gTLD registries include Public Interest Registry for .org and Identity Digital for hundreds of newer extensions.
Country-code top-level domains, or ccTLDs (two-letter extensions assigned to countries and territories), are run by national operators such as Nominet for .uk, DENIC for .de and CIRA for .ca. The same Verisign brief counts 145.6 million ccTLD registrations. ccTLD operators are not bound by ICANN’s gTLD contracts and set their own rules on eligibility, transfers and disputes, which is why a recovery under .de or .uk follows a different path than one under .com.
Registries rarely deal with registrants directly. The registry knows which registrar sponsors each name, and it accepts changes only from that registrar.
What a domain registrar does
A registrar is the retail layer. It sells registrations and renewals, holds your account, records your contact details, and sends your changes to the registry. For gTLDs, a registrar must be accredited by ICANN; for ccTLDs, it must be accredited by the relevant national operator. GoDaddy, Namecheap, Tucows, Network Solutions and Cloudflare Registrar are familiar examples. Our post comparing the top domain name registrars covers the major options, and the background piece on how domain name registrars work explains their business in more depth.
The registrar is also where your security lives. Your login, your multi-factor authentication (MFA, a second proof of identity at sign-in), your registrar lock and your authorization code for transfers are all held at the registrar. The registry trusts the registrar to have verified that a change came from you.
How a change flows from registrar to registry
Registrars and registries talk to each other over EPP (the Extensible Provisioning Protocol, the standard machine-to-machine language for creating, updating, renewing and transferring domain names). Consider what happens when you change your nameservers.
First, you sign in to your registrar account and enter the new nameservers. The registrar then sends an EPP update command to the registry, identifying itself with its own credentials. The registry checks that this registrar sponsors the name and that no status code blocks the change. Once those checks pass, the registry updates its database and the TLD zone, and within minutes to hours resolvers around the world begin following the new nameservers.
A transfer works the same way, with one more party. You obtain the authorization code (also called an auth code or EPP code, a password unique to the domain) from the current registrar and give it to the new one. The new registrar sends an EPP transfer request with that code. The registry notifies the current registrar, which has five days to object before the transfer completes on its own.
Why control of the registrar account is control of the domain
The registry never sees you. It sees your registrar’s credentials. Any instruction that arrives from the sponsoring registrar, properly formatted, is treated as yours. So anyone who can sign in to your registrar account, or persuade the registrar’s support desk to give them access, can change your nameservers, read your auth code, change the registrant and move the name elsewhere.
That is the single most important fact in this guide, and it bears repeating: the registrar account is the domain. A strong, unique password, app-based MFA or a hardware security key, and a role-based contact email are the baseline described in our guide to registrar account security. For names that cannot be allowed to move, a registry lock adds a second gate at the registry itself. Under a registry lock, the registry refuses changes until the registrar confirms the request with the owner through a separate, out-of-band channel, so a compromised password alone is not enough.
Resellers and why they complicate recovery
Many domains are not bought from a registrar directly. They are bought from a reseller (a company that sells registrations under another registrar’s accreditation), such as a web host, a website builder, an IT provider or a marketing agency. The reseller presents its own brand, its own control panel and its own invoices. The accredited registrar behind it may never appear on your bill. Our overview of companies that sell domain names explains the range of sellers.
Resellers are common because the accreditation layer is concentrated. A 2021 ICANN-authored measurement found 4,136 registrars offering RDAP services but only 242 unique RDAP base URLs, a sign that many accredited registrars run on a small number of shared platforms, according to the IFIP TMA 2021 paper on RDAP performance. That measurement predates the 2025 WHOIS sunset, but the layering it reflects is still how much of the market works.
Layering matters when something goes wrong. If your domain is stolen, expires or is held by a former vendor, the parties who can act are the sponsoring registrar and the registry, not the reseller’s help desk. Many owners lose days asking the wrong company. The fix is to look up the domain in RDAP, which shows the sponsoring registrar’s name and IANA ID (the registrar’s unique accreditation number), along with its abuse contact. Our guide to RDAP vs. WHOIS explains how to run that lookup.
Mistakes that turn into recovery cases
In the cases we handle, three misunderstandings about registrars and registries come up again and again. The first is not knowing the true registrar: the owner knows the web host’s name but not the accredited registrar, and cannot escalate quickly when the name is taken. The second is a registrar account held by someone else, such as an agency or a developer, so the business has no login of its own and must ask a third party for permission to manage its own name. The third is treating the registrar account like any other low-value login, with a reused password and no MFA, even though that account carries the authority to move the domain.
How DNAccess helps
The registry holds the record, the registrar holds the keys, and whoever holds the registrar account controls the domain name. DNAccess identifies the sponsoring registrar for every name a business holds, consolidates scattered reseller and vendor accounts into accounts the business owns, and sets up the account security and locking each name warrants. Our domain name management service handles that work on an ongoing basis. To review where your names are registered today, contact us.