When you buy a domain, you’re interacting with a chain of organizations whose roles are easy to confuse. Knowing which layer handles what saves time when transfers stall, prices change, or a dispute arises. This is the short version.
The three layers
Three groups sit between you and your domain name.
Registrars are the companies you buy domains from — GoDaddy, Namecheap, Cloudflare Registrar, Porkbun, and hundreds of smaller resellers. A registrar’s job is to sell you domains, manage your DNS, bill you, and act as your interface to the registries above them.
Registries sit one level up. Each top-level domain (.com, .net, .io, .xyz) has exactly one registry that operates its database. Verisign operates .com and .net. Identity Digital operates dozens of newer TLDs. Afilias runs .info. The registry is the authoritative source of truth for which domain names exist under its TLD and who currently holds them.
ICANN (the Internet Corporation for Assigned Names and Numbers) is the non-profit at the top. It doesn’t run any specific TLD — it sets the rules, accredits registrars, delegates TLDs to registries, and handles disputes. When people say “ICANN charges $0.18 per domain,” they mean ICANN collects a small fee from registries and registrars that ultimately lands in your annual renewal cost.
What actually happens when you buy a domain
The transaction looks like this:
- You register
example.comat Namecheap. - Namecheap (a registrar) forwards the request to Verisign (the .com registry).
- Verisign writes you into the .com zone database.
- Namecheap writes you into their customer database as the holder.
- ICANN oversees the rules both parties operated under.
The domain is yours but it lives in three databases simultaneously: ICANN’s accreditation records, Verisign’s zone file, and Namecheap’s customer records.
Why this matters in practice
A few real-world consequences:
Transferring your domain moves it between registrars, not between registries. Moving example.com from GoDaddy to Porkbun changes the registrar of record but the domain stays in Verisign’s .com zone. This is why transfers are fast and cheap — nothing fundamental changes, only the billing relationship.
Losing access to your registrar does not lose the domain. If your Namecheap account is compromised, the domain still exists at Verisign. You can work with Namecheap’s support (or escalate to ICANN if needed) to regain control. This is your safety net.
Pricing floors are set at the registry. Verisign sets the wholesale price of .com; registrars add their margin. When Verisign raises wholesale .com prices, every registrar’s retail price rises too. Shopping between registrars optimizes the margin, not the underlying cost.
TLD-specific quirks come from the registry. Some TLDs have premium pricing tiers (a dictionary-word .xyz can cost $500/year). Some have trademark-based restrictions. Some require a physical address in a specific country. These rules are set by the registry, not the registrar.
When things go wrong, escalate up the chain
Small issues — renewal billing, DNS not propagating, support unresponsiveness — are registrar problems. Start there.
Medium issues — transfer disputes, ownership challenges, bad-faith registrations — can escalate to the registry or to ICANN’s accredited-registrar rules. ICANN has a formal dispute process (UDRP) for trademark-based claims.
Extreme issues — TLD going under, court-ordered seizures, national-level takedowns — involve ICANN and sometimes governments. You will likely never deal with these unless you hold a domain in a legally contested space.
Practical takeaways
- Know your registrar. They’re your primary contact for everything routine.
- Keep registrar contact and payment info current. Nearly all avoidable domain losses come from missed renewal emails.
- Enable two-factor auth and registrar lock. The registrar controls access to the domain; the registry trusts whatever the registrar tells it.
- When buying a domain on the aftermarket, the transfer happens between registrars. If the seller uses a registrar you don’t, either the seller can push it there or you’ll wait for a full transfer. Escrow services handle the timing either way.
The three-layer system looks complicated on paper but is mostly invisible in daily use. You interact with your registrar, your registrar interacts with everything else. When something breaks, knowing which layer owns the problem tells you where to send the support ticket.