A registry, or registry operator, is the organization responsible for a top-level domain (TLD): it maintains the authoritative database of all domain names registered under that TLD, sets or applies its registration policies and publishes the TLD zone in DNS. In the field of domain names, the registry sits at the wholesale level, while registrars sell domains to the public.
Every TLD has exactly one registry at a time, whether it is a gTLD such as .com or .org or a ccTLD such as .de or .sk. The registry is the single source of truth for who holds a name, which name servers it delegates to and which status locks protect it.
How a registry operates a top-level domain
A registry runs three core systems. The shared registration system (SRS) stores domain, contact and host objects and accepts changes from accredited registrars. The authoritative DNS service publishes NS and DS records for every delegated domain in the TLD zone. The registration data service answers public lookups through WHOIS and RDAP.
Registrars talk to the SRS mainly through the Extensible Provisioning Protocol (EPP), an XML-based protocol over TLS. Commands such as create, renew, transfer and update change the registry database, and the registry regenerates or incrementally updates the zone so that changes reach DNS within minutes for most modern TLDs.
| Function | What it does | Main interface |
|---|---|---|
| Shared registration system | Stores domains, contacts and host objects | EPP for registrars |
| TLD zone publication | Delegates domains to their name servers | Authoritative DNS servers |
| Registration data service | Publishes registration details | RDAP and WHOIS |
| DNSSEC for the TLD | Signs the zone and publishes DS records | Signed TLD zone |
| Data escrow | Deposits copies of the database with a third party | Scheduled escrow deposits |
The registry, registrar and registrant model
Most TLDs separate wholesale and retail roles. The registry does not deal directly with end customers; it serves registrars, which handle sales, billing, customer support and identity checks. This model was introduced for the large gTLDs to create competition among registrars while keeping one central database.
| Role | Responsibility | Relationship |
|---|---|---|
| Registry | Operates the TLD database and zone | Contracts with registrars |
| Registrar | Sells and manages domains for customers | Accredited by the registry |
| Registrant | Holds the right to use the domain name | Customer of the registrar |
| Reseller | Sells domains under a registrar’s accreditation | Contract with the registrar |
| Back-end registry provider | Runs technical registry systems for the operator | Contract with the registry |
Many TLD owners outsource operations to a back-end registry service provider, so the legal registry operator and the company running the servers can differ. For gTLDs, the operator holds a registry agreement with ICANN, while ccTLD registries follow national policies and local law, and some still sell directly to registrants.
Domain lifecycle and status codes
The registry enforces the lifecycle of every domain: registration, renewal, expiration and deletion. For most gTLDs the periods are standardized, while ccTLDs define their own timelines.
| Period | Typical length | Effect |
|---|---|---|
| Add grace period | 5 days after registration | Deletion with a refund to the registrar |
| Registration term | 1 to 10 years | Domain is active while renewed |
| Auto-renew grace period | Up to 45 days after expiry | Registrar can still renew or delete |
| Redemption grace period | 30 days after deletion | Registrant can restore for a fee |
| Pending delete | 5 days | No restore possible, then the name is released |
Each domain also carries EPP status codes. Codes beginning with client, such as clientTransferProhibited, are set by the registrar; codes beginning with server, such as serverUpdateProhibited or serverHold, are set by the registry. A registry lock uses server statuses that can be removed only after an out-of-band verification, which makes it the strongest protection against domain hijacking.
Registry types and policy differences
Registries differ in eligibility rules, data handling and pricing, depending on the type of TLD they run. These differences matter when an organization chooses where to register or how to protect its brand.
| Category | Example scope | Typical policy features |
|---|---|---|
| Legacy gTLD registry | .com, .net, .org | Open registration, ICANN-mandated processes |
| New gTLD registry | Generic words and city names | Sunrise periods, premium name pricing |
| Brand TLD registry | A company’s own TLD | Names reserved for the brand owner |
| ccTLD registry | Country codes | Local presence rules, national dispute processes |
| Sponsored or community TLD | Specific sectors or communities | Eligibility verification |
Registries also differ in how much registration data they store. A thick registry holds full contact data centrally, while a thin registry stores only technical data and relies on registrars for contacts. Privacy regulation has led many registries to redact personal data in public RDAP and WHOIS output.
Common misunderstandings about registries
The registry is often invisible to domain holders, which leads to wrong expectations about who can fix a problem. Knowing the registry’s limited and precise role saves time during incidents and transfers.
- The registry is not the registrar: support requests about billing or account access go to the registrar.
- Registries do not host websites or email: they only delegate the domain to name servers.
- Registration is not ownership: the registrant holds a renewable right of use under registry policy.
- Expired does not mean available: grace and redemption periods delay release for weeks.
- A registrar lock is weaker than a registry lock: a compromised registrar account can remove client statuses.
Understanding it simply
Every domain ending, such as .com or .de, has one official keeper of the list of all names that end that way. That keeper is the registry. It does not sell names to the public itself; shops called registrars do that and pass each order to the registry.
Think of the registry as a national land register and the registrars as real estate agents. Agents handle customers, but only the register records who holds which plot, and only the register’s entry counts when there is a dispute.
Applied in practice
A payment company depends on its .com domain for its website, API and email. Its security team worries that a phishing attack on the registrar account could allow an attacker to change the name servers and redirect customers.
The company asks its registrar to apply a registry lock. The registry sets serverUpdateProhibited, serverDeleteProhibited and serverTransferProhibited, and any change now requires a verified request through a separate channel with named contacts. Routine DNS record changes remain possible, because they happen at the DNS provider, not at the registry.
Months later, an attacker gains access to a staff member’s registrar login and attempts to change the name servers. The registry rejects the update, the domain keeps resolving normally, and the incident ends as a password reset rather than an outage.