Domain industry glossary

Plain-language definitions of the terms used in our reviews and methodology. Each entry has a stable anchor so we can link to it from other pages (e.g. methodology) and so search engines and AI agents can extract definitions cleanly.

Every entry states its basis. 154 of 180 link a primary source, ICANN's own glossary and policy pages, an IETF RFC, or the company itself, and name the exact term that source uses, which is often not the one the industry says out loud. The remaining 26 are marked Our definition: industry vocabulary that no standards body, registry or ICANN document actually defines. Saying so is more useful than attaching a plausible-looking citation that does not define the word.

Last updated 2026-09-29Prices checked monthly1 of 9 scored reviews with published testing notes11 registrars with primary-source pricingTransparent methodology

A

A record#: A DNS record mapping a name to an IPv4 address: the most common way to point a domain at a server.
AAAA record#: A DNS record mapping a name to an IPv6 address (the modern, larger address space).
ACMEAutomatic Certificate Management Environment#: The protocol behind automated certificate issuance and renewal, including the DNS-based challenge that proves control of a domain by publishing a specific TXT record. It is the main reason DNS API access at a registrar matters for anyone issuing wildcard certificates.
Add Grace Period (AGP)Add Grace Period#: A short window (typically 5 days) after a new registration in which the registrar can delete it for a full registry refund: historically abused for 'domain tasting'.
Aftermarket#: The secondary market where already-registered domains are bought and sold between parties, often at prices far above registration cost.
Agent delegation#: Granting an autonomous software agent authority to act on your behalf, in domains typically to search, register, renew, or change DNS. The registrar-side questions are what the agent is permitted to do, what it cannot do without a human, and whether its actions are attributable and reversible.
ALIAS / ANAME record#: A provider-specific record type that mimics a CNAME at the zone apex, letting a bare domain point at a hostname. It was never standardised, the IETF draft lapsed, so support, naming and behaviour vary between DNS providers.
Anycast DNS#: A technique where the same nameserver IP is announced from many locations, so queries hit the nearest one, faster and more resilient DNS.
Apex domainalso called the naked, root, or bare domain#: The domain at the top of a zone with no subdomain in front of it, such as example.com rather than www.example.com. The apex cannot hold a CNAME record under the DNS specification, which is why registrars and DNS providers offer ALIAS or ANAME records to point an apex at a hostname.
API catalog#: A well-known document at /.well-known/api-catalog listing the APIs a site publishes, so a client can discover them from the origin alone. For a data-publishing site it is the machine-readable equivalent of a documentation index.
At-cost pricing#: Selling domains at the wholesale registry fee plus the mandatory ICANN fee, with no registrar profit margin: the cheapest possible long-term price.
Authoritative DNS#: The DNS server that holds the real records for a zone and gives definitive answers, as opposed to a caching resolver that just relays them.
Auto-renew#: A default setting where the registrar charges your card to renew a domain automatically before it expires, preventing accidental loss.
Auto-renew grace period#: The 45-day window after an expiration during which the registrar can return an auto-renewed domain to the registry for a refund. This is what enables most registrars to offer a 'free recovery within 45 days' policy on expired domains.
Auto-renew grace period fees#: The window after expiry during which the registry has already charged the registrar for a renewal that can still be reversed if the name is deleted. It is the commercial reason registrars differ in how long they hold an expired name before releasing it.

B

Back-end registry#: The technical provider that operates a TLD's registry systems on behalf of the TLD owner. Many small gTLD owners outsource operations to a shared back-end provider.
Backorder#: Paying a service in advance to attempt to register a specific domain the moment it becomes available, without guarantee of success.
BIMIBrand Indicators for Message Identification#: A DNS record that points at a logo a mail client may display beside authenticated messages from the domain. It requires a DMARC policy of quarantine or reject first, so it is a consequence of good mail authentication rather than a substitute for it.
Brand TLD (.brand)#: A top-level domain owned and operated by a single company for its own exclusive use, applied for through ICANN's new-gTLD program.
Bulk transfer#: Moving many domains between registrars at once, either via the registrars' bulk tools or, for whole portfolios, an ICANN bulk-transfer procedure.

C

CAA recordCertification Authority Authorization record#: A DNS record that lists which certificate authorities are allowed to issue TLS certificates for a domain, reducing mis-issuance risk.
Canonical URL#: The declared preferred address for a piece of content when several addresses could serve it. Getting it wrong is a common and costly error: a canonical that points at a URL which redirects tells search engines that the authoritative version of the page is somewhere the crawler cannot settle on.
Catch-all email#: A forwarding rule that accepts mail to any address at your domain and routes it to one inbox.
ccTLDcountry-code top-level domain#: A two-letter TLD assigned to a country or territory, such as .uk, .de, .ca, .il, .ai. ccTLDs are governed by their country's chosen registry and may have local-presence rules, language requirements, or restricted second-level domains.
CDS and CDNSKEY records#: Records published in the child zone that signal to the parent which DS record it should publish, allowing DNSSEC key changes to be automated instead of requiring the registrant to hand a new DS to the registrar. Support varies by registry and registrar, and its absence is why DNSSEC key rollovers are often manual.
Certificate Transparency#: The public, append-only logging of issued TLS certificates, which lets a domain owner discover certificates issued for their names by anyone. It is the practical way to detect misissuance, and it also means certificate logs quietly disclose subdomain names.
Chain of trust#: The DNSSEC hierarchy where each level cryptographically vouches for the one below, root signs the TLD, the TLD signs your domain, so a resolver can verify answers weren't tampered with.
Change of registrant (COR)Change of Registrant#: A material change to the registered owner's identity. Under ICANN policy it can trigger a fresh 60-day transfer lock, which many registrars let you opt out of.
CNAME flattening#: A DNS provider feature that resolves a CNAME target at the authoritative server and answers with the resulting A or AAAA records, so an apex domain can effectively point at a hostname without violating the rule that forbids a CNAME at the zone apex. The behaviour is provider-specific, not part of the DNS standard.
CNAME recordCanonical Name record#: A DNS record that aliases one name to another name, so both resolve to the same place. Cannot be used at the zone apex (the bare domain).
Controller and processor (registration data)#: The GDPR roles that determine who decides how registration data is used and who merely handles it. Registries, registrars and resellers each hold a role, which is what makes accountability for a domain's personal data a contractual question rather than a technical one.
Cybersquatting#: Registering a domain that matches someone else's trademark in bad faith, usually to sell it to them or divert traffic.
CZDSCentralized Zone Data Service#: ICANN's service through which gTLD registries make their zone files available to approved requesters under a standard agreement. It is the mechanism behind most published research on gTLD registration counts and DNS deployment.

D

DefinedTerm#: The structured-data type for an entry in a glossary or controlled vocabulary, letting a machine reader tell that a page defines terms rather than merely mentioning them. This glossary publishes it on every entry.
Delegation#: The act of a parent zone pointing a domain or subdomain to its own nameservers via NS records: how authority is handed down the DNS tree.
DKIMDomainKeys Identified Mail#: A signing scheme in which the sending mail server signs messages with a private key and publishes the public key in DNS under a selector. It proves the message was authorised by the domain and was not altered in transit.
DMARCDomain-based Message Authentication, Reporting and Conformance#: A DNS-published policy that tells receivers what to do with mail that fails SPF and DKIM alignment, and where to send aggregate reports. Publishing a DMARC policy of reject is the standard defence against someone sending mail that appears to come from your domain.
DNSDomain Name System#: The hierarchical naming system that translates human-readable domain names into IP addresses and other resource records. A registrar's DNS quality is judged on supported record types, propagation behavior, and reliability of its authoritative servers.
DNS cache#: Stored DNS answers held by resolvers and operating systems for the record's TTL, so repeat lookups are fast, and why changes take time to appear everywhere.
DNS propagation#: The informal term for the time it takes a DNS change to be seen everywhere, governed by record TTLs and cache expiry, not an actual global 'push'.
DNS record#: An entry in a domain's zone that tells the internet how to route different kinds of traffic: web, email, verification. Managed at your DNS provider.
DNSSECDomain Name System Security Extensions#: A set of extensions that cryptographically sign DNS records so resolvers can verify they haven't been tampered with. Registries publish DS records into the parent zone; the registrar typically provides a UI to upload your DS record.
DNSSEC key rollover#: Replacing a zone's signing key while keeping the chain of trust unbroken, which requires the new key to be published and trusted before the old one is withdrawn. Rollovers are the most common way a DNSSEC-signed domain breaks, because a DS record left pointing at a retired key makes the whole zone fail validation.
DoHDNS over HTTPS#: A protocol that carries DNS queries inside HTTPS requests, encrypting them against observers on the network path and making them indistinguishable from other web traffic. It changes who can see and tamper with lookups; it does not change what the authoritative data says.
Domain control validationDCV#: The check a certificate authority performs to confirm the requester controls the domain, typically by a DNS record, an HTTP file, or an email to a defined address. Whoever controls DNS for a name can therefore obtain certificates for it, which is why DNS access is effectively identity access.
Domain hijacking#: Unauthorised transfer or control of a domain, usually through a compromised registrar account or the email address that receives its confirmations, rather than through any weakness in DNS. The defences are account security, registry lock, and keeping the registrant contact address on a domain you separately control.
Domain investing (domaining)#: Registering or buying domains to resell at a profit, betting on future demand for particular names.
Domain lifecycle#: The stages a domain moves through: available → registered → (if not renewed) expired → auto-renew grace → redemption → pending delete → dropped back to available.
Domain parking#: Pointing an unused domain at a placeholder page, often showing ads, to earn small revenue or hold it for later sale.
Domains By Proxy, LLC#: GoDaddy's WHOIS privacy company, which lists itself as the registrant in public records to keep the real owner's details private. Unrelated to Google Domains despite common co-searching.
DoTDNS over TLS#: A protocol that carries DNS queries over a dedicated TLS connection on port 853. Same confidentiality goal as DNS over HTTPS, but on an identifiable port, which makes it easier for a network operator to permit or block deliberately.
Drop#: The moment an expired, unrecovered domain is deleted by the registry and becomes available for anyone to register again.
Drop-catching#: Using automated systems and many registrar connections to register a valuable domain the instant it drops, before ordinary users can.
DS recordDelegation Signer record#: Delegation Signer record: the fingerprint of your DNSSEC key that you publish at the registry (via your registrar) to link your signed zone into the chain of trust.
Dynamic DNS (DDNS)#: A service that automatically updates a DNS record when a device's IP changes, useful for home servers on residential connections.

E

EDNS(0)Extension Mechanisms for DNS#: The extension that lets DNS messages exceed the original 512-byte limit and carry option data, which is a precondition for DNSSEC and for modern resolver features. Middleboxes that mishandle EDNS are a classic cause of resolution failures that look intermittent.
Email forwarding#: A registrar feature that forwards mail sent to your domain to an existing inbox, without running a full mailbox: a cheap way to get you@yourdomain.
EPPExtensible Provisioning Protocol#: The XML protocol registrars use to create, transfer, renew and delete registrations at a registry. Almost everything a registrar's interface does to a domain is an EPP command underneath, which is why registrars converge on the same lifecycle behaviour and status codes.
EPP authorization codeauth code, transfer code#: A short alphanumeric code generated by the current registrar that the new registrar requires to initiate a transfer. The registrant must request it from the losing registrar; it cannot be obtained any other way.
EPP status codesExtensible Provisioning Protocol status codes#: Standardized flags on a domain (visible in WHOIS/RDAP) that show its state: such as clientTransferProhibited (a lock) or pendingDelete.
ERRPExpired Registration Recovery Policy#: The ICANN policy governing what a registrar must do around expiry: the notices it must send, when a name must stop resolving, and the recovery window a registrant must be given before deletion. It is the reason expiry behaviour is broadly similar across gTLD registrars.
Expiry date#: The date a registration ends. If not renewed, the domain enters the post-expiry lifecycle; it usually keeps working briefly during the grace period.

F

First-year price#: The often-discounted price to register a domain for its first year, which can be far below the renewal price. Judge long-term cost by renewal, not first-year.
Five-day transfer window#: After a transfer request is submitted, the losing registrar has five days in which it may explicitly approve or deny it; if it does nothing, the registry completes the transfer automatically. This is why a transfer that seems stuck often completes on its own at the end of the window.
FOAForm of Authorization#: The confirmation a registrar obtains from the registrant or administrative contact to authorise a transfer. Under the Transfer Policy the gaining registrar must obtain it, which is why an inbound transfer generates a confirmation email that must be actioned before the transfer proceeds.
FQDNFully Qualified Domain Name#: Fully qualified domain name: the complete, unambiguous name including every label up to the root, sometimes written with a trailing dot.

G

Gaining registrar#: The registrar you are transferring a domain to. It initiates the transfer using the authorization code.
GDPR redaction#: Since 2018, registries and registrars redact most personal data from public WHOIS/RDAP for individuals to comply with the EU's GDPR, so 'privacy' is now partly the default, not just a paid add-on.
General availability (GA)General Availability#: The phase when a TLD is open for anyone to register names first-come, first-served at standard prices.
Glue record#: An IP address record stored at the parent registry for a name server whose hostname falls under the same domain it serves. Used to break the chicken-and-egg lookup problem when ns1.example.com is the name server for example.com.
Grace period#: A window after expiry during which the original registrant can still renew at the normal price before the domain enters redemption.
gTLDgeneric top-level domain#: A TLD not tied to a country, such as .com, .org, .net, .app, .dev. Most gTLDs are policy-governed by ICANN and have published wholesale price agreements.

H

HSTS preloadHTTP Strict Transport Security preload#: A list built into browsers of hosts and whole top-level domains that must only be reached over HTTPS, removing the first-request downgrade window. Some extensions, including .dev and .app, are preloaded at the top level, so every name under them is HTTPS-only in major browsers.
HTTPS / HSTS#: HTTPS is encrypted web traffic; HSTS is a policy that forces browsers to always use HTTPS for a site, and some TLDs (.dev, .app) enforce it for the whole zone.

I

IANAInternet Assigned Numbers Authority#: The function within ICANN that maintains the authoritative root zone file, the registry of all top-level domains, and global IP address allocation. The IANA root database lists the registry operator for every TLD.
IANA registrar ID#: The numeric identifier IANA assigns to each ICANN-accredited registrar, published in a public list. It is the reliable way to confirm that the company behind a brand name is actually accredited, and to identify the registrar of record shown in a WHOIS or RDAP response.
ICANNInternet Corporation for Assigned Names and Numbers#: The non-profit organization that coordinates the assignment of domain names and IP addresses globally. ICANN accredits registrars, sets policy for generic top-level domains (gTLDs), and oversees the contractual relationships between registries and registrars.
ICANN fee#: A $0.18 USD per-year fee that ICANN charges registrars for each gTLD registration. It is itemized separately by some registrars (notably Cloudflare's at-cost pricing) and bundled into the headline price by others.
ICANN-accredited registrar#: A company that has signed ICANN's Registrar Accreditation Agreement and is authorized to register gTLD domains directly with the registries. Each has a unique IANA registrar ID.
IDNInternationalized Domain Name#: A domain containing non-ASCII characters (e.g. Cyrillic, Hebrew, Chinese). Implemented via Punycode encoding in the DNS layer (xn--prefixed labels). Not all TLDs support IDNs.
IDN homograph attack#: Registering a name that uses characters from another script which look like Latin letters, producing a domain visually indistinguishable from a legitimate one. Browsers mitigate it by displaying punycode in mixed-script cases, and registries mitigate it with per-script IDN tables.
IDN table#: The registry-published list of which characters and character combinations are permitted in a given TLD, and which variants are bundled together. It is the reason an internationalised name that is valid in one extension may be rejected in another.
IETF / RFCInternet Engineering Task Force / Request for Comments#: The Internet Engineering Task Force writes the internet's technical standards as numbered RFC documents, including the ones defining DNS, EPP, and DNSSEC.
IndexNow#: A protocol for telling participating search engines that specific URLs have changed, by submitting them with a key that is published as a file on the site. It replaces waiting for a recrawl on pages that actually changed; it does not influence how those pages rank.
IPS tag#: The UK equivalent of a transfer authorization code: to move a .uk/.co.uk domain you set its IPS tag to the new registrar's tag rather than pasting an EPP code.

J

JSON-LDJavaScript Object Notation for Linked Data#: A way of embedding structured, machine-readable statements about a page inside the page itself. Search engines and extraction tools use it to identify entities, prices, and dates without inferring them from layout, which is why structured data must always match what a visitor can actually see.

K

KSK / ZSKKey-Signing Key / Zone-Signing Key#: Key-Signing Key and Zone-Signing Key: the two DNSSEC keys. The KSK signs the keyset (and is referenced by the DS record); the ZSK signs the actual records.

L

Landrush#: A launch phase after sunrise where anyone can apply for premium or contested names in a new TLD, often by auction, before open registration.
lastmod#: The sitemap field stating when a URL's content last changed. It is only useful if it reflects real data changes; a single hand-typed date across every URL tells a crawler that everything changed at once and nothing has changed since, which is false in both directions.
llms.txt#: A plain-text file at a site's root that summarises the site and points to its most useful pages and datasets for large language models, in the spirit of robots.txt for crawlers. It is a convention rather than a standard, and it does not compel any model to use it.
Local presence#: A requirement (or optional service) that a domain have a contact or trustee based in the TLD's country. Some registrars sell a local-presence service to meet it.
Losing registrar#: The registrar you are transferring a domain away from. It must release the domain and can only refuse for specific ICANN-allowed reasons.

M

Markdown content negotiation#: Serving a Markdown representation of a page when the client asks for it via the HTTP Accept header, while humans continue to get HTML at the same URL. It gives machine readers clean text without a separate URL structure, and it is ordinary HTTP content negotiation rather than a vendor feature.
Markup#: The margin a registrar adds on top of the wholesale registry fee and the ICANN fee to set your retail price. At-cost registrars add little or none.
MCPModel Context Protocol#: An open protocol through which an AI model or agent connects to external tools and data sources over a defined interface. For registrars it is the emerging way an agent performs a real action such as checking availability or reading account state, rather than scraping a web interface built for humans.
MTA-STSSMTP MTA Strict Transport Security#: A mechanism that lets a domain declare that receiving mail servers must use authenticated TLS, published through a DNS TXT record and an HTTPS-hosted policy file. It closes the downgrade gap left by opportunistic TLS in SMTP.
MX recordMail Exchange record#: A DNS record that tells the internet which mail servers accept email for a domain, with priority values.

N

Name servers#: The authoritative DNS servers a registrar configures at the registry to delegate a domain. Changing name servers points the domain to a different DNS provider (e.g. moving from your registrar's DNS to Cloudflare DNS) without transferring the domain itself.
Nameserver#: A server that answers DNS queries for a domain. Your registrar points the domain at nameservers, which then serve your records.
Negative caching#: Resolvers cache the fact that a name does not exist, for a period taken from the zone's SOA minimum field. This is why a newly created record can appear slower than expected if something queried the name before it existed, and why a low SOA minimum matters during a migration.
Nexus requirement#: A rule requiring the registrant to have a specific connection to a place or group, residency, citizenship, or a local business, to register a TLD.
NS recordName Server record#: A DNS record naming the authoritative nameservers for a domain or subdomain: the source of truth for its zone.

P

Pending delete#: The final ~5-day lifecycle stage after redemption, when the domain can no longer be recovered and is queued to drop back to available.
Premium domain#: A domain reserved by the registry (or a previous registrant) and sold at a higher-than-standard wholesale price. Each registrar surfaces premium prices differently; some registrars don't sell premium tiers at all.
Premium TLD / premium name#: A specific domain the registry itself prices above the standard rate (often permanently, including renewals) because it's short or valuable, separate from aftermarket resale.
Presumptive renewal#: The provision in most gTLD Registry Agreements under which the registry's contract renews at expiry unless specific failure conditions apply. It is the reason a registry operator's pricing power over a namespace is effectively long-term, and therefore why renewal price history matters when choosing an extension.
Privacy / proxy service#: A service that replaces the registrant's real contact details in public WHOIS with the provider's own, shielding the owner's name, address, email, and phone.
PTR recordPointer record#: The reverse-DNS record that maps an IP address back to a hostname, published in the in-addr.arpa or ip6.arpa zones. It is controlled by whoever holds the IP allocation, normally the hosting provider, not by the domain's registrar. Mail servers commonly check that forward and reverse records agree.
Punycode#: An ASCII encoding (prefix 'xn--') that represents internationalized (non-Latin) domain names, since DNS itself only handles ASCII. Browsers show the readable Unicode form.

R

RAARegistrar Accreditation Agreement#: The contract between ICANN and an accredited registrar that sets out what the registrar must do: validate contact data, publish registration data, hold funds in escrow, honour transfers, and give registrants specified rights. It is the document behind most protections a gTLD registrant actually has.
RDAPRegistration Data Access Protocol#: The structured JSON successor to WHOIS. ICANN required gTLD registries and registrars to support RDAP by 2019. RDAP supports standardized authentication, internationalized data, and machine-readable responses.
RDAP bootstrap#: The IANA-published registry that maps a TLD to the RDAP service that answers for it, so a client can find the right server without hardcoding a list. This is what lets a lookup tool support every gTLD without per-TLD configuration.
RDAP protocolRegistration Data Access Protocol#: The JSON-over-HTTPS successor to WHOIS, with structured responses, standard error handling, internationalisation and a path to differentiated access. Unlike WHOIS it has a defined response format, which is what makes automated registration lookups reliable.
RDDSRegistration Data Directory Services#: ICANN's umbrella term for the services that publish domain registration data, covering both WHOIS and RDAP. Registry and registrar contracts state availability and response-time obligations in terms of RDDS rather than naming one protocol.
Recursive resolver#: The DNS server (run by your ISP or a public resolver like 1.1.1.1) that chases a query from the root down to the authoritative answer and caches it.
Redemption Grace Period (RGP)Redemption Grace Period#: The ~30-day stage after the grace period when a domain is held for possible recovery by the original registrant for a steep redemption fee, before pending delete.
Redemption period#: The 30-day window after a gTLD domain expires during which the registrant can recover it by paying a redemption fee (typically $80-$200). After redemption, the domain enters a pending-delete state for 5 days, then drops to the open market.
Registrant#: The person or organization that legally owns a domain registration. Contact details for the registrant are recorded in the registry's WHOIS database (subject to privacy redaction).
Registrar#: An ICANN-accredited (for gTLDs) or registry-accredited (for ccTLDs) company that sells domain registrations to end users on behalf of registries. Registrars handle billing, DNS configuration, WHOIS records, and transfers.
Registrar data escrow#: An ICANN requirement that registrars regularly deposit registrant data with a neutral third party, so registrations survive if a registrar fails.
Registrar lock#: A status flag (clientTransferProhibited) the registrar sets on a domain to block transfer requests until the registrant unlocks it. Helps prevent unauthorized transfers. Distinct from registry lock, which is set at the registry level for additional security.
Registrar of record#: The ICANN-accredited registrar officially responsible for a domain's registration: the entity a transfer moves the domain away from or into. A reseller's registrar of record is its accredited backend.
Registry#: The organization that operates a top-level domain and maintains the master database of all second-level registrations under it. Examples: Verisign operates .com and .net; Public Interest Registry operates .org; Identity Digital operates .io.
Registry Agreement#: The contract between ICANN and a gTLD registry operator covering price, service levels, data escrow, zone file access and public interest commitments. Renewal price behaviour on a gTLD is a term of this contract, which is why some registries can raise prices freely and others cannot.
Registry fee (wholesale)#: The per-domain price the registry charges registrars, set by the registry contract. Your retail price is this fee plus the registrar's markup (and the ICANN fee for gTLDs).
Registry lock#: A higher-security lock applied at the registry, requiring out-of-band verification (often a phone call) before any change to the domain. In WHOIS/RDAP it appears as the registry-set serverTransferProhibited (plus serverUpdateProhibited and serverDeleteProhibited) status codes: the registry-level counterparts of the registrar-set clientTransferProhibited. Typically only offered for high-value domains and at a premium.
Registry operator#: The company that runs the technical backend of a TLD: maintaining the authoritative database of every domain in it and publishing the zone. Sometimes the same as the sponsor, sometimes a separate commercial operator.
Registry price cap#: A contractual ceiling on what a registry may charge registrars per registration year. Some legacy gTLDs are capped and have their increases scheduled in the contract, while most newer gTLDs are uncapped, which is the structural reason renewal prices differ so widely between extensions.
Renewal date#: The deadline by which you must renew to keep a domain. Registrars send reminders and often auto-renew by default.
Renewal jump (promo trap)#: The gap between a low promotional first-year price and a much higher standard renewal: the biggest hidden cost in choosing a domain.
Renewal notice#: The advance notification a registrar must send before expiry under ICANN policy. Missed renewal notices, not deliberate decisions, account for most lost domains, which is why the registrant contact address should never live on the domain it is protecting.
Renewal parity#: A pricing model in which the renewal price equals the first-year price, so there is no promotional cliff. It is not the same as at-cost pricing, which means the registrar passes through the registry wholesale fee with no markup; a flat price can still carry a large markup.
Reseller#: A company that sells domains under its own brand but through another company's ICANN accreditation, rather than holding its own. The accredited registrar behind it is the registrar of record. Website builders often resell.
Reseller versus registrar#: A reseller sells registrations under its own brand while an accredited registrar holds the registry relationship and appears as registrar of record. The distinction matters at the worst moment: escalation, transfer authorisation and data-escrow protections attach to the accredited registrar, not to the reseller's brand.
Restore fee#: The charge for recovering a domain during the redemption grace period after it has been deleted for non-payment. It is set well above a normal renewal by registry policy, so letting a name lapse and recovering it is materially more expensive than renewing on time.
Restricted TLD#: A TLD that limits who may register, by profession, location, or accreditation. Contrast with open TLDs anyone can buy.
Retail price#: The price you actually pay a registrar, made of the registry fee + ICANN fee + the registrar's markup, and shown as a first-year and a renewal figure.
Root zone#: The top of the DNS hierarchy, published by IANA, that lists every top-level domain and the nameservers authoritative for it.

S

Scoped API token#: An API credential limited to specific permissions, specific resources, or a time window, rather than granting full account access. It is the practical control that makes handing registrar access to an automation or an agent a bounded risk instead of an unbounded one.
Second-level domain#: The label directly to the left of the TLD, usually the part you actually register and brand.
serverHold / clientHold#: EPP status codes that remove a domain from the DNS zone so it stops resolving: set by the registry (server) or registrar (client), often over disputes or unpaid fees.
SOA recordStart of Authority record#: The DNS record at the apex of every zone that names the primary nameserver and the zone's administrative contact, and carries the serial number and the timing values (refresh, retry, expire, minimum) that secondary servers and resolvers use. A zone without a valid SOA is not a zone; changing the serial is how secondaries learn the zone changed.
Speakable markup#: Structured-data annotation marking the sections of a page most suitable to be read aloud by a voice assistant. In practice it is a hint about which sentences carry the answer, which makes it useful discipline for answer-first writing regardless of voice.
SPFSender Policy Framework#: A TXT record listing which hosts are authorised to send mail using the domain. Receivers check the sending IP against it. SPF is published at the domain, so it is one of the DNS responsibilities that follows the domain to a new registrar or DNS provider and must be recreated during a migration.
Sponsored TLD (sTLD)Sponsored Top-Level Domain#: A specialized gTLD with a defined community and eligibility rules enforced by a sponsor organisation.
Sponsoring organisation#: In the IANA root database, the organisation responsible for a top-level domain: for a ccTLD this is usually the country's government or a designated manager, distinct from any commercial registry operator that runs the backend.
Sponsoring registrar#: Another name for the registrar of record: the registrar that currently manages a domain and appears in its WHOIS/RDAP record.
SRV recordService record#: A DNS record that publishes the hostname and port for a named service over a named protocol, with a priority and weight for selection. Used by protocols that need service discovery rather than a bare address, including SIP, XMPP and Microsoft Active Directory.
SSL/TLS certificate#: A certificate that enables HTTPS by proving a site's identity and encrypting traffic. Free options (Let's Encrypt) mean you rarely need to buy one from a registrar.
Subdomain#: A label added in front of your domain to create a separate address, managed entirely through your own DNS at no extra registration cost.
Subdomain takeover#: An attack in which a DNS record still points at a third-party service that no longer holds the target resource, letting someone else claim it and serve content from your name. It is a routine consequence of decommissioning a service without removing its DNS record.
Sunrise period#: The launch phase of a new TLD when trademark holders (validated via the TMCH) can register matching names before the general public.

T

Temporary Specification (gTLD registration data)#: The 2018 ICANN measure that brought gTLD registration data publication into line with the GDPR by redacting most personal contact data from public WHOIS. It is why looking up a domain today usually returns a redacted record and an anonymised forwarding address rather than a name.
Thick vs thin WHOIS#: Thick WHOIS keeps full registrant data at the registry; thin WHOIS (historically .com/.net) keeps it only at the registrar. Registries have been moving to thick models.
Tiered registry pricing#: A registry practice of charging different wholesale prices for different names within the same TLD, usually by placing sought-after strings in higher tiers. A domain in a premium tier normally renews at the premium rate for as long as it exists, not just in the first year.
TLDTop-Level Domain#: Top-level domain: the last label of a domain name, after the final dot. TLDs are either generic (gTLDs like .com) or country-code (ccTLDs like .de).
Total cost of ownership (domain)#: The full multi-year cost of holding a name: the first year, every renewal at the standing rate, any separately itemised fees, privacy if it is charged for, and transfer costs. It is the only number that lets two registrars be compared honestly, because a promotional first year can hide a renewal several times higher.
Trade#: At some ccTLD registries, the formal process for changing a domain's owner (distinct from a registrar transfer), sometimes with its own fee and paperwork.
Trademark Clearinghouse (TMCH)Trademark Clearinghouse#: ICANN's central database of verified trademarks that powers new-gTLD rights protections like sunrise registration and trademark-claims notices.
Transfer dispute resolution#: The ICANN process through which a registrar or registrant can challenge a transfer they believe was improper, including reversal where a transfer was obtained without proper authorisation. It is the backstop behind the transfer rules rather than a routine customer-service path.
Transfer-in#: The process of moving a domain into a registrar. For most gTLDs it adds one year of registration on top of the remaining time.
Transfer-in year#: For most TLDs a transfer adds a full year of registration to the existing expiry rather than replacing it, so transferring does not forfeit time already paid for. A handful of extensions do not follow this, which is worth checking before moving a name close to expiry.
Transfer-out#: The process of releasing a domain from your current registrar: unlock it and provide the authorization code to the new one.
TTLTime To Live#: Time to live: how many seconds resolvers may cache a DNS record before re-checking. Lower it before a planned change so updates propagate faster.
TXT record#: A free-form text DNS record used for domain verification and email authentication (SPF, DKIM, DMARC).
Typosquatting#: Registering misspellings of popular domains to catch mistyped traffic, sometimes for ads or phishing.

U

UDRPUniform Domain-Name Dispute-Resolution Policy#: Uniform Domain-Name Dispute-Resolution Policy: ICANN's process for resolving trademark-based disputes over gTLD domains without going to court.
URSUniform Rapid Suspension#: Uniform Rapid Suspension: a faster, cheaper complement to UDRP for clear-cut trademark abuse that suspends (rather than transfers) the domain.

V

Variant TLD#: A second delegated top-level domain representing the same name in another script or form, such as a traditional and simplified pair. Holding a name under one does not give you the equivalent under the other; they are separate delegations with separate registrations.

W

WDRPWHOIS Data Reminder Policy#: The ICANN requirement that a registrar send each registrant an annual reminder of their registration data with a prompt to correct it. The annual email that looks like spam and asks you to confirm your contact details is usually this.
Web linking (Link header)#: The HTTP header that expresses typed relationships between a resource and other resources, such as pointing at an API catalogue or a machine-readable service description. It lets a client discover a site's structured surfaces without parsing the page.
Well-known URI#: A path under /.well-known/ reserved for site-wide metadata that clients can find without being told where to look, such as security.txt or an API catalogue. The registry of these paths is maintained by IANA.
WHOIS#: A public directory protocol that returns ownership and contact information for a domain. Since the EU's GDPR took effect in 2018, registrant personal data is usually redacted in WHOIS output; registries and registrars retain the full records.
WHOIS / RDAP server#: The service that answers lookups about a domain's registration. WHOIS is the legacy text protocol; RDAP is its structured, access-controlled successor.
WHOIS accuracy#: ICANN requires registrants to provide accurate contact data and respond to verification; false or unresponsive WHOIS can lead to suspension.
WHOIS privacy#: A service where the registrar substitutes its own proxy contact details for the registrant's personal data in WHOIS queries. Free WHOIS privacy is now standard at most major registrars on gTLDs and many ccTLDs.
Wholesale price#: The price the registry charges registrars per year for a domain registration or renewal. ICANN-governed gTLDs have published wholesale prices; ccTLD wholesale prices are set by the country registry. Cloudflare Registrar's 'at cost' model means they charge wholesale + ICANN fee with no markup.
Wildcard DNS record#: A record whose owner name begins with an asterisk label, matching any subdomain that has no more specific record. Convenient for catch-all routing and a common source of surprise, because it also answers for names nobody intended to publish, including typos and probe traffic.

Z

Zone file#: The text representation of all DNS records for a zone, in the master file format. Registries publish their zone files to approved parties, and a registrar or DNS provider's export function normally produces this format, which makes it the practical unit for moving DNS between providers.

#

60-day transfer lock#: An ICANN policy that prevents a gTLD domain from being transferred to a different registrar within 60 days of a new registration, a previous transfer, or a registrant contact change. Owners can transfer-out earlier if they explicitly opt out at registration time (where supported).

See how we use these terms in scoring →