Buying a Domain Name

A registration is not a purchase

Nobody sells you a domain name. What you buy is a time-limited entry in the registry database for that extension, plus the exclusive right, for the length of the term, to say which nameservers the name delegates to. Terms are sold in years, and for generic top-level domains ICANN's Transfer Policy caps the total unexpired term at ten. There is no version of this transaction in which the name becomes property you hold forever.

The recurring event in a domain's life is therefore renewal, and the characteristic failure is missing it. After expiration a name is not instantly gone, but it stays recoverable for less time than most buyers assume. Standard registry practice allows an auto-renew grace period of about 45 days, and the registrar chooses when inside it to issue the delete command. Deletion starts an ICANN-mandated 30-day Redemption Grace Period in which the name is completely dark and recovery is a restore — a separate registry operation at a much higher cost — followed by a short pending-delete window in which nothing can be done at all.

Registry, registrar, reseller: who owns which problem

Three parties stand between you and a working domain, and most "my domain is broken" questions are really about which one to call.

The registry operates the extension: it runs the authoritative nameservers for the top-level zone and holds the master database of every name under it — Verisign for .com, Public Interest Registry for .org, Nominet for .uk. Most sell wholesale to registrars only. The registrar is the retailer, ICANN-accredited for gTLDs, and the party that writes your record into that database; your registration agreement is with it, and it controls the registrant of record, the nameservers, the locks and auto-renew. A reseller sits in front of an accredited registrar: account, billing and support run through the reseller, while the contractual counterparty remains the registrar. That extra link is not academic — ICANN's security advisory on domain hijacking found resellers "operated with registrar-level privileges but without ICANN oversight," and a reseller submitted the unauthenticated transfer request in the panix.com hijacking.

A fourth role is confused with the registrar constantly: the DNS host, whoever answers queries for your zone. Registrars commonly bundle DNS and set their own nameservers by default, which is why so many owners think the registrar is the DNS.

• Expired, or transferred without permission — registrar.
• Site resolving to the wrong address, or mail not arriving — DNS host.
• A registry-level status such as serverHold, or an outage across the extension — registry; your registrar cannot lift it.
• Records edited in the registrar's panel while your nameservers point elsewhere — nothing you changed is being served.

ICANN accreditation is a floor, not a rating: it binds a registrar to consensus policies and escrows registration data against its failure, nothing more.

What an availability check is really asking

An availability check is a question about a database, not about the web. It asks the registry whether a record exists for that exact string under that exact extension. A name with no website is often fully registered; a parking page means registered by definition. Nothing in the check inspects content or rights.

The authoritative source for that answer changed recently. Since 28 January 2025 the Registration Data Access Protocol has been the definitive source for gTLD registration data in place of sunsetted WHOIS, and registries and registrars are no longer required to run WHOIS at all — .com, .name and .post excepted. Port 43 WHOIS survives in places but may be absent or stale.

"Not available" also covers more states than "somebody owns it."

• Registered and inside its term.
• Expired but still in the grace and redemption sequence — dark, useless to its holder, and not yet released to anyone else.
• Reserved or blocked by the registry.
• Available, but in a registry premium tier whose higher fee generally recurs at every renewal.
• Restricted at one level only — some country-code registries reserve third-level zones such as co.me for local entities while the second level is open worldwide.

One correction changes what buyers conclude about whole extensions. .com has no registry premium tier. Every unregistered .com costs the registrar the same wholesale amount, so a four- or five-figure asking price is a private seller in the aftermarket, not a registry charge. Elsewhere the tiering is real: short and dictionary names in .io, .ai and .co carry premium bands that recur annually.

The first-year price is not the price

A domain carries at least four distinct prices — registration, renewal, transfer and restoration — and only one of them recurs. Plan around the renewal.

Introductory and renewal pricing are independent variables. A registrar can sell the first year at or below its own wholesale cost, because the economics work on renewals and attached services, so a deep first-year discount is evidence of an acquisition strategy rather than of a cheap registrar. Renewal pricing is usually discretionary and can change on notice. Registrants have a right to accurate information about their registrar's terms and pricing, and protection from hidden fees, but that is a disclosure right, not a price guarantee.

• Transfer to a new registrar normally adds a year to the term, billed by the gaining registrar — a cost, but you get a year for it.
• Restoration during redemption is the largest routine cost in a domain's life: a wholesale registry restore fee, the registrar's margin on top, and a renewal term as well.
• Bundled or billed separately — DNS hosting, privacy or proxy service, email forwarding, registry lock, API access. A headline renewal figure with four paid add-ons is not comparable to one without them.
• Per-extension variation. Registry wholesale costs differ enormously between extensions, so compare on the ones you will actually hold.

Some extensions are expensive by design rather than by registrar choice: .io sits far above legacy gTLD wholesale pricing, and .ai pairs premium pricing with a minimum term and scheduled increases. Registrar shopping does not change that.

Available does not mean you are eligible

Behind the registry's yes sits a question the check never asks: are you permitted to hold this name? Some extensions restrict who may register, and the restrictions are enforced.

.us carries a documented US nexus requirement, and any third party may complain that a registration breaches it. The name is locked while the complaint runs, and if the holder cannot cure, the only remedy is deletion — the name drops to open availability rather than passing to the complainant. .eu is the sharper case. Eligibility runs to EU citizenship regardless of residence, EU or EEA residence, or establishment in the Union, and it is tested continuously rather than once. Registrants whose eligibility depended on the United Kingdom's EU membership lost names after withdrawal, having done nothing wrong themselves.

The opposite mistake is more common and wastes more money: assuming a restriction that does not exist. .de, .ch, .es, .nl, .uk, .in and .cn all accept registrants worldwide with no nationality or residency test, yet paid "local presence" add-ons are still sold for several of them. .de withdrew its German administrative-contact requirement in 2018, and .ch has never had a Swiss presence rule — that is .swiss, a different extension entirely. Read the registry's own policy before paying a trustee fee.

Eligibility can also be technical. All of .app and .dev sits on the HSTS preload list shipped inside major browsers, so every name is HTTPS-only from registration, with no opt-out and no bypass. If any part of your plan needs plain HTTP, those extensions are unusable however available the name is. The caveat does not generalize to technical-sounding extensions: .tech and .cloud are not preloaded.

Available does not mean the name is clear

An availability check searches a register of domain registrations. Trademarks live in different registers, kept by different bodies on different terms, and the check cannot see them. A name can be freely registerable and still be one you should not build on.

The governing mechanism is the Uniform Domain-Name Dispute-Resolution Policy, written into every gTLD registration agreement and adopted by many country-code registries. A complainant must prove all three of its elements: that the name is identical or confusingly similar to a mark in which they hold rights; that you have no rights or legitimate interests in it; and that it was registered and is being used in bad faith. That conjunction is load-bearing and is the most common reason strong-looking complaints fail: a name registered in good faith before the complainant's mark existed generally cannot satisfy it, however objectionable a later use.

What a panel can do is narrow: transfer the name or cancel it. Damages and legal fees are unavailable, so if you lose, the exposure is the name and everything built on it rather than a money judgment. The Uniform Rapid Suspension system is faster and narrower still, and only suspends. In the United States the Anticybersquatting Consumer Protection Act gives trademark owners a court route that does reach damages.

This is not a remote risk: WIPO alone handled over 6,200 domain name cases in 2025, its highest caseload on record, and .com accounts for most of its filings. Search the trademark registers covering the countries and sectors you will actually trade in, before you print anything.

How many names to register, and when defensive buying pays

The most repeated advice in this subject is to register your name in every extension you can. For most buyers it is wrong. Every additional registration is a permanent renewal obligation, and the protection it buys is thin: the extensions you skipped still exist, new ones keep arriving, and no defensive portfolio is ever complete. Money spent renewing extensions nobody will type is money not spent on what protects the name the business runs on: multi-year registration, registry lock where offered, DNS independent of the registrar.

The defensible exception is narrower than the advice it replaces.

• The extension your audience will type by mistake — usually the dominant legacy extension for your market, plus the country-code extension where you trade.
• Close variants of a name that gets said aloud: spoken names are misheard before they are mistyped.
• Names you would genuinely pursue if someone else took them: if you would file a UDRP over an infringing registration, holding the obvious variant yourself is cheaper than the proceeding.
• Names already being used against you — a dispute or an abuse report, not a shopping decision.

A portfolio's real risks are operational rather than competitive. ICANN's security advisory committee framed the exposure as an entire portfolio lost to "a user account and password." Names in one account, on one card, recoverable through one mailbox are a single point of failure. Keep the registrant and account email on an independent domain at an independent provider; the same committee warned that it is not safe to send credential recovery instructions for a domain to an address inside it. Enable auto-renew on a payment method somebody monitors, and register the few names you cannot afford to lose for several years at a time.