What Is the Difference Between a Registry and a Registrar?

"Registry" and "registrar" differ by two letters, and people swap them all the time, even in support tickets. But they are very different businesses, and knowing which one you are dealing with explains a lot: why you cannot buy a .com directly from Verisign, why prices differ between companies selling the exact same domain, why a transfer takes days, and why some locks can be removed from your dashboard while others cannot. This article explains what a registry does, what a registrar does, how they talk to each other, where resellers and DNS hosts fit in, and how to find out which companies are behind any domain. It builds on the overview of what ICANN is and its role in domain registration, which sits above both.

The Short Answer

• A registry (or registry operator) runs a top-level domain. It keeps the authoritative database of every name registered under that TLD and publishes the TLD's zone so those names resolve.
• A registrar is the company that sells domains to the public. It takes your order, collects your details and payment, and submits the registration to the registry.
• You, the person or company holding the domain, are the registrant.

A good analogy is a land registry and a property agent. The land registry keeps the official record of who holds which plot; the agent helps you buy one, does the paperwork, and files it with the land registry. You never visit the land registry directly, but its record is what counts.

What a Registry Does

A registry operator is responsible for one or more TLDs. Some well-known examples:

TLD	Registry operator (examples)
.com, .net	Verisign
.org	Public Interest Registry (PIR)
.uk	Nominet
.de	DENIC
.app, .dev	Google Registry
Many new gTLDs	Identity Digital, GoDaddy Registry, and others

You can always look up the current operator for any TLD in IANA's Root Zone Database, because operators do change over time.

A registry's core responsibilities are:

1. Maintaining the registration database. For every domain, the registry stores the domain name, its sponsoring registrar, its name servers, its status codes, its creation and expiration dates, and, depending on the TLD, contact data.
2. Running the TLD's authoritative name servers. The registry publishes the TLD zone, which contains the NS records (and DS records for DNSSEC) for every delegated domain. When a resolver asks the .com servers about example.com, it is the registry's infrastructure that answers.
3. Providing an EPP interface to registrars. Registrars create, renew, update, transfer, and delete domains using the Extensible Provisioning Protocol.
4. Setting wholesale prices and TLD policy. The registry decides what registrars pay per domain-year (within any limits in its agreements), plus eligibility rules, premium name lists, and reserved names.
5. Publishing registration data through RDAP (and, for some TLDs, WHOIS).
6. Enforcing registry-level locks, the server* statuses that registrars cannot remove. See registry lock vs. registrar lock.

Some registry operators outsource the technical work to a back-end registry service provider. The operator holds the contract with ICANN and decides policy; the back-end provider runs the database, EPP servers, and DNS. To you, this is invisible.

Thick and Thin Registries

Registries differ in how much data they hold. A thick registry stores the full registration record, including contact data. A thin registry stores only the technical data (name servers, registrar, dates, statuses) and leaves contact data with the registrar. .com and .net have historically been thin. That is why an RDAP lookup for a .com domain at Verisign gives you a link to the registrar's RDAP server for the remaining details.

What a Registrar Does

A registrar is the retail side. For gTLDs, a registrar must be accredited by ICANN and have an agreement with each registry whose names it sells. Registrars are responsible for:

• Selling registrations, renewals, and transfers and setting retail prices
• Collecting and verifying registrant data, including the email verification ICANN requires
• Sending EPP commands to the registry whenever you register, renew, change name servers, or lock the domain
• Managing account security, including logins, two-factor authentication, and support verification
• Providing auth codes and processing transfers in and out
• Handling abuse reports about domains they sponsor
• Offering extras such as privacy services, DNS hosting, email forwarding, and URL forwarding

When you click "lock domain" in a registrar dashboard, the registrar sends an EPP update adding clientTransferProhibited to your domain at the registry. When you change name servers, it sends an EPP update replacing the domain's host list. The registry's record changes; the registrar's dashboard is just the interface.

Resellers

Many companies that sell domains are not registrars at all. Web hosts, website builders, and agencies are often resellers: they use an accredited registrar's platform and branding. The registrar of record is still the accredited company, and that is what RDAP shows. If you bought a domain through your hosting company and cannot find it in any "registrar" list, check the RDAP record to see who the actual registrar is.

How Registries and Registrars Talk: EPP

Registrars talk to registries over EPP, defined in RFC 5730, with the domain mapping in RFC 5731. Each operation is an XML command over a TLS-encrypted, authenticated session. For example, a registrar checks whether names are available with a command like this:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
  <command>
    <check>
      <domain:check xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
        <domain:name>example.com</domain:name>
        <domain:name>example-shop.com</domain:name>
      </domain:check>
    </check>
    <clTRID>CHK-0001</clTRID>
  </command>
</epp>

The registry answers with avail="1" or avail="0" for each name. Registration, renewal, transfer, and updates work the same way, with create, renew, transfer, and update commands. You will never send EPP yourself unless you become a registrar, but it explains why the registry is the single source of truth: every registrar is just submitting commands to the same database.

Registry vs. Registrar Side by Side

Aspect	Registry	Registrar
Who it serves	Registrars	The public (registrants) and resellers
Scope	One or more TLDs	Many TLDs, from many registries
Holds	The authoritative record and the TLD zone	Your account, contact data, billing, and settings
Price it sets	Wholesale	Retail
Locks it controls	serverTransferProhibited and other server codes	clientTransferProhibited and other client codes
Can you buy from it?	Usually not directly	Yes
ICANN contract (gTLDs)	Registry Agreement	Registrar Accreditation Agreement
Example	Verisign for .com	Any accredited registrar selling .com

Some companies are both: a registry for some TLDs and a registrar for others. ICANN's rules require separation so a registry treats all registrars equally.

Where DNS Hosting Fits In

There is a third role that confuses people: the DNS host. Your registrar tells the registry which name servers are authoritative for your domain. Those name servers belong to your DNS host, which may be your registrar, your web host, or a provider like Cloudflare or Route 53. The DNS host is where your A, MX, and TXT records live.

So for a typical .com site:

1. The registry (Verisign) publishes example.com NS ns1.yourdnshost.net in the .com zone.
2. Your DNS host's servers answer queries for the records inside example.com.
3. Your registrar is the company you pay and the one that sent the NS update to Verisign.

This distinction matters during transfers, because moving the registration does not have to move your DNS. The article on domain registrar vs. DNS host covers it in depth.

How to Find the Registry and Registrar for Any Domain

Find the Registry

IANA's WHOIS server tells you who operates a TLD:

whois -h whois.iana.org org | grep -iE "^(organisation|whois)"

You can also see the registry's name servers, which are what the root zone delegates to:

dig NS org. +short

Find the Registrar

Query the registry's registration data. RDAP is the modern way, and rdap.org redirects you to the correct registry server:

curl -sL https://rdap.org/domain/example.com \
  | jq -r '.entities[] | select(.roles | index("registrar"))
           | .vcardArray[1][] | select(.[0] == "fn") | .[3]'

Or with classic WHOIS against Verisign's server for .com:

whois -h whois.verisign-grs.com example.com | grep -iE "registrar:|registrar iana id|whois server"

See the Delegation Chain

dig +trace shows the hand-off from the root servers to the registry's TLD servers, and from there to your DNS host:

dig +trace example.com NS

The first block comes from the root servers, the second from the TLD (registry) servers, and the last from the domain's own authoritative servers at the DNS host.

A Script That Shows Both

This Python script, using only the standard library, follows the RDAP chain. It queries the registry, then follows the related link (common for thin registries like .com) to the registrar's RDAP server.

import json
import sys
import urllib.request


def get(url):
    req = urllib.request.Request(url, headers={"Accept": "application/rdap+json"})
    with urllib.request.urlopen(req, timeout=20) as resp:
        return resp.geturl(), json.load(resp)


def registrar_name(data):
    for ent in data.get("entities", []):
        if "registrar" in ent.get("roles", []):
            for item in ent.get("vcardArray", [None, []])[1]:
                if item[0] == "fn":
                    return item[3]
    return "unknown"


domain = sys.argv[1] if len(sys.argv) > 1 else "example.com"
registry_url, registry = get(f"https://rdap.org/domain/{domain}")

print(f"Registry RDAP:  {registry_url}")
print(f"Registrar:      {registrar_name(registry)}")
print(f"Name servers:   {', '.join(ns['ldhName'] for ns in registry.get('nameservers', []))}")

related = [
    link["href"]
    for link in registry.get("links", [])
    if link.get("rel") == "related" and "domain" in link.get("href", "")
]
if related:
    print(f"Registrar RDAP: {related[0]}")

If the domain was bought through a reseller, the registrar shown here is the accredited registrar behind it.

Why the Difference Matters

Pricing

The registry sets a wholesale price; the registrar adds its margin, plus the ICANN fee for gTLDs. That is why the same .com costs different amounts at different registrars, and why introductory prices often jump at renewal.

Transfers

A transfer between registrars changes which registrar sponsors your domain in the registry database. The registry enforces the rules: it checks the auth code, refuses transfers while transfer-prohibited statuses are set, and auto-approves after five days if the losing registrar does nothing. Your domain stays registered at the same registry the whole time. See how to transfer a domain to another registrar.

Support and Problems

When something goes wrong, you deal with your registrar. Registries rarely handle requests from registrants directly. If your registrar is unresponsive or breaching ICANN rules for a gTLD, escalate to ICANN Compliance; for ccTLDs, the registry itself may have a complaints or dispute process.

Security

Registrar-level protections (account 2FA, registrar lock) can be undone by anyone who controls your registrar account. Registry-level protections (registry lock) require a verified out-of-band process. Both are worth understanding; what registrar lock is explains the status codes.

---

Registry vs. Registrar FAQ

Conclusion

The registry and the registrar play complementary roles. The registry runs the TLD: it keeps the authoritative database, publishes the zone that makes your domain resolvable, sets wholesale prices, and enforces registry-level policy. The registrar sells you the domain, manages your account, and translates every click in your dashboard into EPP commands that update the registry's record. Add the DNS host, which answers queries for the records inside your domain, and you have the full picture.

Once those roles are clear, most domain questions get easier. Pricing and support are registrar matters. Transfers move you between registrars but never off the registry. Registrar lock lives at the registrar, while registry lock lives a level higher. And when you need to know who is behind a domain, an RDAP lookup tells you both in seconds.

Here are some useful references for going deeper on registries and registrars:

1. IANA: Root Zone Database — the registry operator for every TLD.
2. RFC Editor: RFC 5730: Extensible Provisioning Protocol — the protocol registrars use to talk to registries.
3. RFC Editor: RFC 5731: EPP Domain Name Mapping — the domain commands, statuses, and auth info.
4. ICANN: 2013 Registrar Accreditation Agreement — the obligations of accredited registrars.
5. RFC Editor: RFC 9083: JSON Responses for RDAP — the format of the registration data you query above.