Hello fellow Lemmings! I hope this is the right place to ask this. I don’t understand how web domains work. Let’s say I want to buy the domain “abcdefghi.net”. I can go to a domain provider like haruba or godaddy and just buy it. but how can they, a private, sell me these domains? I’m not talking about the hosting, but just the domain. where do they register this domain I’m buying? isn’t it possible to register it myself instead of paying these services to do it for me?
I have some understanding of how this works:
- There’s a non-profit organisation called ICANN at the top who basically controls everything and assigns TLD (top level domains like .com) and so on to registries.
- Registries host different TLDs and keep track of all domains under them.
- Registrar is an ICANN accredited company that can sell domain names. When you buy abcd.net from say Google domains, Google basically files your domain name with the .net registery.
As far as I know, you can’t buy a domain from ICANN directly because they don’t sell stuff? Only registrars can.
In practice there are registrars that charge you the actual price of the domain + a small registration fee (15 cents maybe) in a transparent way without any markup. An example is cloudflare.
Also in practice stay away from GoDaddy. They’re one of the most horrible companies I know. Porkbun, cloudflare, namecheap, namesilo, Google are all usually moderately priced good options. You can find details of all registrars for a tld and their prices using tld-list like: tld-list.com/tld/nameoftld.
Hope that helps :)
When you buy a domain, you buy the right to (among other things) edit the address book for that domain, also known as DNS zones.
Once you buy the domain, for example, you can tell your domain provider “I want example.com to point to the IP address 1.2.3.4”.
Most importantly the domain provider has been given the rights to sell these domains by ICANN who manages what is known as the “root DNS servers”.
When a computer has no idea who to contact to resolve a domain it contacts the root DNS servers first and these tell them to check the entries of the domain provider. It all trickles down from there. If the domain provider wasn’t approved by ICANN then their root DNS servers would never point to them.
In reality there’s more organizations involved including: resellers, registrars and registries. But they all follow the same principle and create a chain of linked address books (DNS zones) that flow from the root DNS servers.
There is not stopping you from setting up your own domain system. You can get all the domains you want for free, but no other computer would be able to access them because by default the convention is to trust only the ICANN DNS servers.
If you use windows, Google “hosts file”. In that file you can enter any domain you want and an associated IP address and your computer will comply with it. You could even have google.com point to your own homepage, but of course that would only be your computer.
By the way, if you hear about DNS servers like google’s 8.8.8.8 or cloudflare’s 1.1.1.1, these are not the root DNS servers. These are called “resolvers” and they are the ones that talk to the root DNS zones and cache their response so that it can be resolved faster instead of having to go down the whole chain every time.
thanks for the super answer! I understand now!
Q: So does ICANN have its own Doman Name Server (for those who dont know: list of domain and IPs, like a phone catalog) that the other commercial DNS’ (like local ISPs and Google DNS and cloudflare DNS) is connected directly to?
Yes. ICANN has the root DNS servers which point to the DNS servers of the registries (company that manages a domain extension in exchange for a hefty sum each year) which point at the DNS servers of the registrar (company authorized by the registry to sell domains) which either hosts your DNS entries or they can point to any server you tell them.
The commercial DNS you mention are called resolvers and are specialized in retrieving records from the linked chain of servers I mentioned above and caching them so it’ll take less time.
You could point your own resolver to the ICANN root server and then set up your computer to use that resolver.
A small correction: the registrar directs the registry (on your behalf) to configure the registry’s DNS servers to point at whichever DNS servers you specify to host the domain, which default to the registrar’s DNS servers. The chain of delegation is most commonly either:
root -> registry -> registraror
root -> registry -> another DNS hosting provider (CloudFlare, AWS Route53, DNS Made Easy, etc)This is really cool. So if I set my domain’s DNS on the registrar’s website, that DNS record is propogated to the registry? I have had this change start working in under five minutes. It’s insane how fast that is given what is actually being done.
Yes, the registrar controls the NS records (and, if your zone is DNSSEC signed, DS records) for your domain in the zone the registry hosts.
[EDIT: I forgot about this part earlier.] The registrar will typically also give you the ability to “register nameservers”, which means specify one or more names within the name space of your domain that you want to act as nameservers and their IP addresses. The registrar will insert A and/or AAAA records into the registry to be used as glue records.
This is probably much further down in the weeds of “how web domains work” than the OP intended.
