Domain name registrars work as the accredited middle layer between domain owners and the registries that run each top-level domain. A registrar holds a contract with ICANN, connects to each registry’s systems over a standard protocol called EPP, and uses that connection to create, renew, update and transfer domain names on its customers’ instructions. Day to day, a registrar runs customer accounts, keeps registration data, processes transfers in and out, responds to abuse reports, and supports the resellers who sell domains under its accreditation. Understanding how domain name registrars work explains most of what happens to a domain, good and bad, over its life.
This article focuses on what a registrar actually does. For the wider picture of how registrars, registries, ICANN and registrants fit together, start with our overview of registrar vs. registry.
Accreditation: How a Company Becomes a Registrar
To register names in generic top-level domains (gTLDs, such as .com, .org or .shop), a company must be accredited by ICANN, the Internet Corporation for Assigned Names and Numbers. Accreditation is a contract, the Registrar Accreditation Agreement (RAA), which sets obligations for data accuracy, record keeping, customer notices, abuse handling, transfers and renewals. The registrar must also sign a separate registry-registrar agreement with each registry whose extension it wants to sell. Country-code TLDs (ccTLDs, such as .uk or .de) are accredited by their own national registries under local rules.
Accreditation carries ongoing costs. ICANN’s Registrar Fee Approval Request for Fiscal Year 2027 sets a transaction fee of USD 0.20 per transaction-year plus a variable shared fee of USD 3.8 million per year divided among all accredited registrars. Those fees fund ICANN’s oversight and are the reason some invoices show an “ICANN fee” line.
Accreditation matters to owners because it determines which rules apply. An ICANN-accredited registrar must follow ICANN’s Transfer Policy, its expiration and renewal policies, and its dispute procedures, and an owner can complain to ICANN Contractual Compliance when it does not. You can confirm a company’s status in ICANN’s list of accredited registrars.
EPP: How a Registrar Talks to the Registry
Registrars do not edit the registry’s database directly. They send commands over EPP (the Extensible Provisioning Protocol, the IETF standard registries use to accept instructions from registrars). Each command is a structured request: check whether a name is available, create a registration for a set number of years, renew it, update its nameservers or contacts, add or remove status codes, or request a transfer. The registry validates each request, applies it, and records which registrar made it.
Two parts of EPP matter most to owners. The first is the authorization code (auth code or EPP code), a secret attached to each domain that a gaining registrar must present to request a transfer. The second is the set of EPP status codes, such as clientTransferProhibited, that block specific actions. A registrar sets “client” codes on its own authority; “server” codes are set by the registry, which is how a registry lock (a registry-level hold that blocks changes until the registrar verifies the request out of band) works. Our guide to domain status codes explains each one.
Because the registry trusts the registrar’s EPP connection, the registrar’s own credentials are a high-value target. In the January 2019 attacks described by Packet Clearing House at the ICANN DNS Symposium, a registrar EPP credential “found in spoils of an attack against a third party” was used to change nameserver records in four one-hour windows, after which attackers obtained certificates and intercepted government email, according to Bill Woodcock’s briefing on the January 2019 DNS hijacks. The registry did exactly what an authenticated registrar told it to do.
Account Management: The Part Owners See
Most of what a registrar does for an owner happens in the customer account. The registrar keeps the registrant’s contact details, lets the owner set nameservers (the servers that answer DNS questions for the domain), hosts DNS records if the owner uses its DNS service, handles DNSSEC keys where supported, and runs billing and renewal. Every one of those settings ends up as an EPP command to the registry or a change to the registrar’s own systems.
Registration Data
The registrar collects and stores registrant data and publishes the non-redacted portions through RDAP (the Registration Data Access Protocol), which replaced WHOIS (the public registration record for a domain name) for gTLDs. ICANN’s 2023 notice on the RAA amendment lists 28 January 2025 as the WHOIS Services Sunset Date for registrar obligations. Most personal data is now redacted, and requests for it go to the registrar.
Renewals and Expiration
The registrar also carries the renewal obligations in ICANN’s Expired Registration Recovery Policy: sending expiration reminders before and after the expiration date, interrupting DNS before the name is deleted, and offering the 30-day Redemption Grace Period for deleted gTLD names. Those notices go to the email on the account, which is why an outdated account email is one of the most common reasons domains are lost.
Account Security
The registrar decides how customers log in, how multi-factor authentication works, how many users an account can have, and how it verifies someone who claims to have lost access. Those choices are not standardized across the industry, and they are where most domain thefts we investigate begin. Our guide to registrar account security lists the settings to check.
Transfers: Moving a Domain Between Registrars
A registrar transfer moves a domain’s sponsorship from one registrar to another. Under ICANN’s Transfer Policy, the owner obtains the auth code from the current (losing) registrar, removes any transfer lock, and submits the code to the new (gaining) registrar. The gaining registrar sends a transfer request to the registry over EPP. The losing registrar then has five days to approve or reject the transfer on limited grounds, after which the registry completes it automatically. Newly registered and newly transferred domains are generally locked against another registrar transfer for 60 days.
When a transfer goes wrong, registrars have defined channels. Each registrar must maintain a Transfer Emergency Action Contact (TEAC), and ICANN’s Transfer Policy requires a human response from the gaining registrar “within 4 hours, although final resolution of the incident may take longer,” as summarized in the ICANN Transfer Policy Review working group’s TEAC and TDRP slides. If registrars cannot agree, the Transfer Dispute Resolution Policy lets a registrar, not the owner, file a dispute “no later than twelve (12) months after the alleged violation,” according to ICANN’s TDRP text. That is why an owner whose domain was stolen through an unauthorized transfer must move quickly and must work through a registrar. Our guide to domain transfers walks through the full sequence.
Abuse Handling
Registrars are required to publish an abuse contact, receive reports of illegal or abusive use of the domains they sponsor, and investigate and respond. ICANN’s 2024 amendments to the RAA strengthened that obligation for DNS abuse, which covers malware, botnets, phishing, pharming and spam used to deliver those threats. In practice, a registrar can suspend a domain, place it on clientHold so it stops resolving, or contact the registrant to correct the problem.
Registrars are not courts. They do not decide trademark disputes, and they generally will not take a domain from one customer and give it to another on the strength of a complaint alone. That is the role of the UDRP (Uniform Domain-Name Dispute-Resolution Policy) and the courts. When a registrar does not meet its contractual obligations, owners and the public can file with ICANN. In May 2024 alone, ICANN Contractual Compliance received 1,576 new complaints, 1,530 of them against registrars, according to its Contractual Compliance Monthly Report for May 2024.
Resellers: Registrars Behind the Registrar
Many companies that sell domains are not registrars at all. Web hosts, website builders, agencies and IT providers often sell domains as resellers, using a wholesale registrar’s accreditation and systems. The reseller owns the customer relationship, sets the price and runs the dashboard. The registrar of record, the accredited company whose name appears in RDAP, remains responsible to ICANN and the registry.
That split matters when something goes wrong. Your account and login are with the reseller, but transfer disputes, compliance complaints and registry actions run through the registrar of record. If the reseller goes out of business, changes platforms, or controls the account on your behalf, you may have to work with both. In the recovery cases we handle, many “my registrar won’t help” situations turn out to be reseller accounts held by a former web developer or agency.
Common Mistakes That Become Recovery Cases
Three patterns appear again and again. The first is an account email that nobody monitors, so renewal notices and transfer alerts never reach a person. The second is an account without multi-factor authentication, or with a recovery process that relies only on email, which lets an attacker who controls the inbox take over the domain. The third is a domain registered in someone else’s account, often a developer’s, so the business is not the registrant of record and cannot act when it needs to. Each one exploits how registrars work: the registrar acts on instructions from whoever controls the account.
Choosing a registrar with strong account controls reduces those risks. Our comparison of the top domain name registrars looks at registry lock, MFA, privacy and transfer handling side by side.
How DNAccess Helps
When a domain has been transferred without authorization, moved by a compromised account, or held by a developer who will not release it, the registrar processes described above are the path to getting it back. Our stolen domain name recovery service works through registrar escalation channels, the TEAC and TDRP processes, ICANN compliance and, where needed, legal action. More introductory guides are in our Domain Name Basics section.