Domain Name Registration

Registry, registrar, reseller: three different companies

The registry operates a top-level domain and holds the authoritative database for it — Verisign for .com and .net, Public Interest Registry for .org. You cannot buy from a registry and will never speak to one.

The registrar is accredited by ICANN, holds a contract with the registry, sells to the public, and is the party ICANN holds responsible for your domain.

The reseller sells under somebody else's accreditation. Most web hosts and nearly every design company offering to "handle the domain" are resellers. Your registrar of record is the accreditation holder behind them, not the company that took your money — invisible as a distinction until the reseller stops answering email, and then it decides who you escalate to.

Three further things are independent and get conflated constantly: who the name is registered with, whose nameservers answer for it, and whose server hosts the site. Knowing they are separable is what lets you change one without disturbing the others.

A registration is a lease, not a purchase

You do not buy a domain name. You hold an exclusive right to use it for a term of one to ten years, renewable indefinitely. That structure is why lapsing is far more damaging than people expect.

The cost floor is public, which is a useful check on any quote. The registry charges every registrar the same published wholesale rate for a .com, and Verisign has announced an increase effective 1 November 2026. On top sits a fixed ICANN transaction fee, raised on 1 July 2025 for the first time in over a decade. Everything above that floor is service, support and margin — legitimate to charge for, but a heavily discounted first year is subsidised by something, usually the renewal. Which is why we are wary of the free domain bundled with hosting: some hosts charge to release it, and some leave the ownership question murky.

The registrant is the owner, and that is why your designer must not be one

ICANN recognizes the Registered Name Holder — the registrant — as the party entitled to control a domain. Not the payer. Not the administrative contact. Not the business whose name appears inside the domain. ICANN's Transfer Policy states that the Administrative Contact and the Registered Name Holder are the only parties with authority to approve or deny a transfer request, and that where they disagree, the Registered Name Holder prevails. Paying the invoice did not make you the registrant. Being in the registrant field did.

That fact is the mechanism of every hostage situation, and they follow one script. The designer registers the domain during onboarding "to save you the hassle," in their own account, on their own email, with their own card. The hosting, the DNS, the Google Business Profile and often the social accounts accumulate in the same place, so the client's leverage is simultaneously zero. Then comes a billing dispute or simply the client hiring somebody else — and the site becomes a "paused for non-payment" notice, or the DNS is repointed, or the email is switched off. Often there is no malice: the designer moved on, shut down, or died, and the domain lapses with nobody able to renew it.

What the panels and the courts have held

In Alaska Health Fair, Inc. v. Chris Jacobson (NAF Claim No. 1500868, 25 June 2013), a developer parked a nonprofit's domain behind a page reading "This website is paused for non-pay on overdue invoices." Panelist Charles A. Kuechenmeister ordered it transferred back, holding that retaining the domain as a financial lien exceeded acceptable use and was bad faith. In DSPT International, Inc. v. Nahum, 624 F.3d 1213 (9th Cir., 27 October 2010), a contractor held a client's registration in his own name and, after a commissions dispute, disabled the company's site, never offering to sell the domain back; the Ninth Circuit held that holding a domain for leverage in a business dispute can itself be the bad-faith intent to profit the Anticybersquatting Consumer Protection Act requires, and the damages award was six figures. Our position, published elsewhere under Bill Hartzer's name, is blunt: a contract can create a debt; it cannot manufacture a right to hold property you are not otherwise entitled to hold.

The honest limits

• The Transfer Dispute Resolution Policy is not available to you. Its text defines a complainant as a losing or a gaining registrar. Only registrars may file.
• The UDRP is a trademark instrument. You must prove all three of: the domain is confusingly similar to a mark you hold rights in; the holder has no legitimate interest in it; and it was registered and is being used in bad faith. For an unregistered mark, WIPO's guidance requires showing the name has become a distinctive identifier consumers associate with your business, and a young business trading under a descriptive or geographic name may not clear that bar.
• The only remedies are cancellation or transfer. No money, no design files, no hosting account — you can win the domain and still have no website, and the filing fee alone runs into four figures before any lawyer.

What to insist on, in writing, before the site is built

Six items. Every one is free, and any one of them prevents the entire scenario above.

1. "Client is and shall remain the Registered Name Holder of the domain." In the client's legal entity name, in a registrar account the client owns, with a client-controlled email and payment method. The vendor receives delegated access, not ownership.
2. A written assignment of copyright in all deliverables, effective on final payment. This matters more than owners expect: a website is not one of the nine categories of commissioned work that can be "made for hire" under United States law, so absent a signed assignment an independent designer generally owns the copyright in the design and code even after the invoice is paid.
3. An exit clause with named deliverables: a full archive of files and database, the authorization code with locks removed, an export of DNS records, and transfer of accounts opened on the client's behalf. "Cooperate in good faith" is not a deliverable.
4. An accounts schedule — registrar, host, DNS, Google Business Profile, analytics, Search Console, email, social — naming who owns each and who merely has delegated access.
5. A no-lien clause: the vendor shall not disable, redirect, withhold or encumber the domain, the site or any client account as a remedy for non-payment. A vendor who refuses to sign this has told you something important.
6. Registrar hygiene: two-factor authentication, registrar lock on, auto-renew on with a card that will not expire, and an account email that is a role address surviving staff changes.

One test cuts through all of it. Can you log in to your registrar right now, from your own phone, without calling anybody? If not, that is the most urgent item on the project.

Transfers: the lock, the code, and what a registrar may not do

Moving a domain between registrars is governed by ICANN's Transfer Policy, binding on every accredited registrar.

The locks. A domain cannot be transferred within 60 days of its initial registration, or within 60 days of a previous inter-registrar transfer. Registrars also apply a 60-day lock following a Change of Registrant, which the holder may opt out of in advance. Hence the rule: transfer first, change contact details afterward. ICANN's GNSO Council approved a rewrite in March 2025 shortening the lock to 720 hours and abolishing the Change of Registrant lock, but as of August 2026 the effective date is unconfirmed and ICANN's own policy page still shows the older version.

The code. The AuthInfo code (or EPP code — the per-domain secret proving to the gaining registrar that whoever holds it may move the name) must be unique to each domain. The losing registrar must supply it and remove transfer locks within five calendar days of the registrant's request, may not make obtaining it harder than changing a nameserver or contact record, and may not withhold it to collect money. Note what those protections bind: the registrar, not your web designer, who is not one. Under the approved rewrite the code becomes the Transfer Authorization Code, generated only on request, valid 336 hours, and cancellable.

What a transfer moves is the registration and nothing else — not the website, the DNS records or the email. One exception: if the losing registrar also provided your DNS, the zone can disappear when the registration leaves, which does take the site and mail down. Export the zone first.

Expiration, status codes, and the end of WHOIS

When a domain stops working, the fastest diagnosis is its EPP status codes, which are public and precise; ICANN publishes the full list.

• redemptionPeriod — the registrar asked the registry to delete it, and it is held for 30 days. Only the original registrant can restore it, at a fee typically several times a routine renewal.
• pendingDelete — the 30 days elapsed. After several more days the name is purged and released, which is where drop-catchers take it. A name with any history rarely reaches the open market.
• clientTransferProhibited — a registrar transfer lock. Normal and good; you remove it for a legitimate transfer.
• clientHold — much worse. The registry stops publishing the domain, so website and email both go dark. On your own domain this is an emergency.

Letting a domain lapse does not mean buying it again cheaply. Auto-renew on a card that will not expire, at a registrar you can log into yourself, prevents all of it.

RDAP replaced WHOIS

ICANN sunset legacy WHOIS on 28 January 2025, and the Registration Data Access Protocol is now definitive. Most registrant contact fields are redacted by default whether or not you pay for privacy, so check your own RDAP record first. What is never hidden is the part that matters in a dispute: the registrar of record and the status codes.

When you do not need to register anything else

We register domains, so treat the following as costing us money to write.

You almost certainly do not need a defensive portfolio. Buying the .net, the .org, the misspellings and every nearby town's name buys nothing except a bill that recurs forever. Two honest exceptions: a spelling customers demonstrably mistype, verified in your server logs, and a variant a competitor could use to intercept traffic.

You do not need an exact-match keyword domain for rankings. It is not the lever it was in 2005 and it is usually worse for your brand. Nor do you need a ten-year registration for ranking purposes: length is not a ranking signal, and auto-renew with a valid card does the same job for free.

You do not need to move your domain to your web host, including to us. A site can be hosted anywhere while the name stays at whatever registrar you already log into. A host that insists on holding your registration has told you how it plans to keep you.

You do not need the monitoring and protection add-ons offered at checkout. They are usually auto-renew and registrar lock repackaged, both free and already on.