A domain registrar is a company that sells domain names to the public and manages them on its customers' behalf, passing each registration to the registry that runs the relevant top-level domain (TLD), such as .com or .shop. The arrangement exists because the operator of a domain's master database and the business that deals with the person buying the name were deliberately separated in 1999, so that many retailers could compete to sell names drawn from a single authoritative list. For generic TLDs, a registrar must hold accreditation from the Internet Corporation for Assigned Names and Numbers (ICANN). Almost every advertiser and publisher depends on one, usually unnoticed until a domain lapses, is stolen or is copied.

Three parties, one record

Three roles are involved. The registry operates the TLD, keeping the authoritative database of names and publishing the zone file that says which name servers answer for each domain. Verisign, for example, runs .com. The registrar is the retail and account layer. The registrant is the person or company that holds the right to use the name for a fixed term, typically one to ten years.

When a marketer buys a name, the registrar checks availability, collects payment and contact details, and sends a create command to the registry over the Extensible Provisioning Protocol (EPP), an Extensible Markup Language (XML) protocol first published by the Internet Engineering Task Force (IETF) in March 2004 as RFC 3730, written by Scott Hollenbeck of VeriSign and later revised as RFC 5730 in 2009. Its status codes, such as clientTransferProhibited set by the registrar and serverTransferProhibited set by the registry, are what "locked" means.

Money flows upward: the registrar pays the registry a wholesale fee per domain-year and ICANN a transaction fee on each registration, renewal or transfer. Accreditation itself costs a non-refundable US$3,500 application fee and US$4,000 a year, plus a variable fee shared among all registrars, according to ICANN. For .com, the wholesale price has been US$10.26 since 2024 and rises 7% to US$10.97 on November 1, 2026, according to Domain Name Wire. Verisign's agreement with ICANN allows increases of up to 7% in four of every six years, according to webhosting.today. Premium names carry registry-set prices far above standard rates, a point raised when Cloudflare opened its registrar to premium domain transfers in December 2024.

ICANN consensus policies govern the lifecycle. Under the Expired Registration Recovery Policy, registrars send renewal reminders roughly a month and a week before expiry, may interrupt a lapsed domain's DNS for up to eight days, and registries must then offer a 30-day Redemption Grace Period during which the former holder can restore it, according to ICANN. Transfers between registrars require an authorisation code and are blocked for 60 days after a new registration. Registrars also bind customers to the Uniform Domain-Name Dispute-Resolution Policy (UDRP), the arbitration route trademark owners use against bad-faith registrations.

The market in numbers

There were 401.6 million registered domain names across all TLDs at the end of June 2026, up 8.1% in a year, including 166.6 million .com names, according to Verisign's Domain Name Industry Brief published on July 23, 2026. Retail is concentrated. GoDaddy held 52.5 million .com names at the end of October 2025, more than four times the 12.3 million at second-placed Namecheap, according to Domain Name Wire.

Counting registrars is harder. IANA's list showed 3,321 accreditations on September 27, 2026, but 1,501 of them, or 45.2%, carried the DropCatch name, according to webhosting.today. Registries cap connections per registrar, so firms racing to grab names the instant they are deleted collect accreditations to multiply their chances.

From monopoly to competition

For most of the 1990s, one company was both registry and registrar. Network Solutions, Inc. (NSI) ran .com, .net and .org under a cooperative agreement with the US National Science Foundation. Registration was free until midnight on September 14, 1995, when NSI began charging US$100 for two years and US$50 a year to renew, according to TidBITS.

Pressure to open the market led the US Department of Commerce to amend NSI's agreement in October 1998, creating a Shared Registry System in which NSI's registry would accept registrations from competing registrars, and to recognise ICANN, then newly formed, as the body that would accredit them, according to ICANN. On April 21, 1999, ICANN named five testbed registrars, America Online, CORE, France Telecom/Oléane, Melbourne IT and register.com, alongside 29 others to follow. "Today's announcement marks a major milestone in the joint efforts of the public and private sectors," Esther Dyson, ICANN's interim chairman, said at the time. The UDRP was adopted on August 26, 1999 and took its first complaints on December 1 that year.

Separation did not last. VeriSign agreed on March 7, 2000 to buy NSI for US$21 billion in stock, according to CNN, reuniting registry and largest registrar until it sold the registrar to Pivotal Private Equity on October 17, 2003 for about US$100 million, keeping 15%, according to Pinsent Masons. ICANN's 2012 new generic TLD round widened what registrars sell, and its 2026 round drew 1,615 applications, published on Reveal Day, October 7, 2026, according to ICANN.

Why marketers depend on registrars

A brand's domain anchors its tracking, email authentication and ad destinations, so one compromised registrar login can take a marketing stack offline. Squarespace bought Google Domains, about 10 million names, for roughly US$180 million in a deal that closed on September 7, 2023, according to Wikipedia. Between July 9 and July 12, 2024, attackers hijacked migrated domains belonging to at least a dozen organisations, mostly cryptocurrency firms, according to KrebsOnSecurity. Squarespace later attributed the incident to "a weakness related to OAuth logins" that it said it fixed within hours.

Brand protection is the second reason. Lookalike registrations sit behind phishing, fake stores and ad impersonation. Surfshark used newly registered domain feeds to count 212 GTA 6-themed domains in a month, a quarter of them suggesting scam intent, in research PPC Land covered when scam domains were projected to reach 750 by the game's launch. The World Intellectual Property Organization (WIPO) handled more than 6,200 domain disputes in 2025, its highest annual total, according to WIPO.

Registrars also fed advertising inventory. Parked pages, names held without content and filled with ad links, were monetised through AdSense for Domains and syndicated into Google's Search Partner Network. Google removed parked domain ads from the Search Partner Network on February 10, 2026. Domains also matter to search: Google's March 2024 spam policies added expired domain abuse, aimed at lapsed names bought and repurposed to exploit their old ranking signals, as PPC Land reported when Google announced its new spam policies.

Criticisms and open disputes

Abuse handling is the longest-running complaint. Until 2024, ICANN's registrar contract required investigation of abuse reports but did not define DNS abuse or require mitigation. Amendments that took effect on April 5, 2024 require registrars to "promptly take appropriate mitigation actions" when they hold actionable evidence of DNS abuse, according to ICANN. Critics argue enforcement remains uneven. The Interisle Phishing Landscape 2025 study, covering May 2024 to April 2025, named NiceNic, Aceville, Dominet, Webnic and OwnRegistrar as the registrars with the highest phishing incidence, according to Domain Name Wire. Registrars counter that they cannot judge content and that suspending a name on thin evidence harms legitimate holders.

Privacy is the second dispute. After the EU's General Data Protection Regulation (GDPR) took effect in May 2018, registrars stopped publishing most registrant contact data in WHOIS, the decades-old lookup service. Brand owners and security researchers lost a tool they relied on. ICANN's Registration Data Request Service (RDRS), a pilot for requesting hidden data, received more than 3,700 requests in two years, and about 26% were approved while about 55% were denied, according to ICANN. Participation was voluntary, covering 46% of domains under management by the pilot's end. Privacy advocates call the redaction overdue; trademark owners call the access route inadequate.

Consolidation draws a third objection: when Cloudflare added premium transfers, Daniel Vassallo warned that a single vendor holding everything leaves no fallback. Price is a fourth, since registrants cannot control registry renewal increases.

What a registrar is not

Registry. The registry operates the TLD database and sets wholesale prices and policies; the registrar sells and services names. Some companies hold both roles for different TLDs, but ICANN treats them as separate contracts.

Reseller. A reseller sells names under its own brand through an accredited registrar's systems, without its own ICANN accreditation. The accredited registrar remains responsible to ICANN.

Web host. A host runs the servers that store a website. Many companies sell both, but a domain can point to any host.

DNS provider. The registrar records which name servers are authoritative; a separate DNS provider may answer the actual queries.

Recent developments

The record-keeping layer changed in 2025. ICANN switched off the contractual WHOIS requirement for generic TLDs on January 28, 2025, making the IETF's Registration Data Access Protocol (RDAP), ratified in March 2015, the definitive source of registration data, according to ICANN. The Registration Data Policy, which replaced interim post-GDPR rules, took full effect on August 21, 2025, according to ICANN. Transfer rules are also being reworked: the Generic Names Supporting Organization (GNSO) Council accepted 47 recommendations in March 2025 that would scrap the 60-day lock after a change of registrant, according to NamePros.

Automation is the newest frontier. On April 30, 2026, Cloudflare said AI agents working through Stripe Projects could open an account, buy a domain and deploy code, with a default spending cap of US$100 a month per provider. Cloudflare had already started tracking more than 1,400 TLDs on Radar in October 2025. As of October 2026, registering a domain is harder to trace than a decade ago and, increasingly, something software does without a person involved.

Timeline

  • September 14, 1995 - Network Solutions begins charging US$100 for a two-year .com, .net or .org registration.
  • October 1998 - US Department of Commerce amends Network Solutions' agreement to create a Shared Registry System.
  • November 1998 - Commerce recognises newly formed ICANN to oversee competition in registration.
  • April 21, 1999 - ICANN names five testbed registrars and 29 further applicants.
  • August 26, 1999 - ICANN Board adopts the Uniform Domain-Name Dispute-Resolution Policy.
  • December 1, 1999 - First UDRP complaints can be filed.
  • March 7, 2000 - VeriSign agrees to acquire Network Solutions for US$21 billion in stock.
  • October 17, 2003 - VeriSign sells Network Solutions' registrar business to Pivotal Private Equity.
  • March 2004 - IETF publishes EPP as RFC 3730.
  • January 13, 2015 - Google Domains opens in public beta.
  • March 2015 - IETF ratifies the RDAP specifications.
  • May 2018 - GDPR takes effect; registrars redact most public WHOIS contact data.
  • September 7, 2023 - Squarespace completes the purchase of about 10 million Google Domains registrations.
  • November 2023 - ICANN launches the Registration Data Request Service pilot.
  • March 2024 - Google adds expired domain abuse to its search spam policies.
  • April 5, 2024 - DNS abuse mitigation duties take effect in ICANN registrar contracts.
  • July 9-12, 2024 - Domains migrated from Google Domains to Squarespace are hijacked.
  • December 2024 - Cloudflare Registrar accepts premium domain transfers.
  • January 28, 2025 - WHOIS obligations end for generic TLDs; RDAP becomes the definitive source.
  • March 2025 - GNSO Council accepts 47 Transfer Policy recommendations.
  • August 21, 2025 - ICANN's Registration Data Policy takes full effect.
  • February 10, 2026 - Google removes parked domain ads from the Search Partner Network.
  • April 30, 2026 - Cloudflare lets AI agents register domains through Stripe Projects.
  • June 30, 2026 - Registered domains reach 401.6 million worldwide.
  • October 7, 2026 - ICANN publishes 1,615 applications in the 2026 new generic TLD round.
  • November 1, 2026 - .com wholesale price scheduled to rise from US$10.26 to US$10.97.

Summary

Who: Registrars such as GoDaddy, Namecheap, Squarespace, Tucows and Cloudflare sell names to registrants, working between registries such as Verisign and ICANN, which accredits them. Network Solutions held the original monopoly; ICANN opened competition in 1999.

What: An accredited company that registers domain names with a registry on a customer's behalf over EPP, collects fees, keeps contact data, publishes it through RDAP, enforces transfer and expiry rules, and must act on evidence of DNS abuse.

When: Competition began with ICANN's testbed registrars on April 21, 1999. Abuse duties tightened on April 5, 2024, WHOIS gave way to RDAP on January 28, 2025, and the .com wholesale price rises on November 1, 2026.

Where: Across all generic TLDs under ICANN contract, with country-code TLDs governed by national registries' own rules, serving a market of 401.6 million names as of June 2026.

Why: Splitting the registry from the retail layer created price competition and choice. For marketers, the registrar account controls the domain behind every campaign, tag and email, and registrar policy shapes how quickly impersonating domains can be traced and taken down.