When something happens to your domain — a transfer blocked, a price hike, a policy change — knowing which layer of the DNS hierarchy is responsible saves you from calling the wrong support line. Here’s the structure.
Layer 1: ICANN
Internet Corporation for Assigned Names and Numbers — a California nonprofit that coordinates global DNS.
What ICANN does:
- Decides which TLDs exist (the new gTLD program).
- Accredits registrars (you can’t sell domains without an ICANN agreement).
- Sets the rules for disputes (UDRP).
- Sets the rules for WHOIS (now: redacted).
- Collects a small per-domain fee that funds operations.
What ICANN doesn’t do:
- Run any actual DNS infrastructure.
- Sell domains directly.
- Resolve technical issues with your specific domain.
You almost never interact with ICANN directly. Their policies cascade down to the registries and registrars who do the actual work.
Layer 2: Registries
A registry operates a single TLD’s authoritative database. Verisign runs .com and .net. Public Interest Registry runs .org. Identity Digital runs .io plus a portfolio of new gTLDs. Google Registry runs .dev and .app. And so on.
What registries do:
- Maintain the master record of every domain in their TLD.
- Run the root nameservers for the TLD.
- Set TLD-specific policies (eligibility, pricing tiers, premium reservations).
- Handle the registry-side of transfers between registrars.
Registries are wholesale, not retail. You can’t register a domain directly at Verisign — you have to go through a registrar.
Registry policies override registrar policies. If Identity Digital’s .ai registry refuses a transfer pending a compliance review, no registrar can override that. Push for the registrar’s help, but understand the ceiling.
Layer 3: Registrars
A registrar is the customer-facing storefront. Cloudflare, Porkbun, Namecheap, GoDaddy, Hover. There are thousands of them — anyone with an ICANN accreditation + registry contracts.
What registrars do:
- Sell domain registrations to end-users.
- Manage your DNS (or let you point at someone else’s DNS).
- Process renewals, transfers, contact updates.
- Handle billing, support, and compliance with ICANN + registry rules.
This is where you have the most leverage. Bad customer service? Move registrars. Pricing creep? Move registrars. The transfer process is standardized exactly to make registrar competition possible.
Where each layer’s responsibility ends
Domain expired and is in redemption? Registrar can recover it (for a fee). Registry can’t help — they follow the policy ICANN set.
Registry hiked premium tier renewal prices? Registrar can’t override — they pass through what the registry charges them. Talk to the registry through whatever advocacy channel exists (often: a long uphill fight).
Trademark dispute filed against your domain? ICANN’s UDRP process plus the chosen arbitration provider (WIPO, Forum). Registrar implements the result; doesn’t decide it.
WHOIS shows wrong info? Update at your registrar. Changes propagate to the registry within hours.
The practical lesson
If something is wrong with your domain, ask first which layer the problem lives at. You’ll save yourself hours of polite-but-helpless conversation with the wrong support team.