CertaDNS
Skip to lesson

DNS Architecture · lesson 1 of 3

The hierarchy, and who the three parties are

After this lesson you can

Say who controls each level of a domain name, and which of them you can call.

Everything in this track depends on one structural fact: your control over a domain is delegated to you by someone else, through a chain of parties, and each link in that chain is a place the delegation can be taken away. Knowing who those parties are is not administrative trivia — it determines who you call when something goes wrong, and it determines which attacks are possible.

The namespace is a tree

                    .                      the root
                   /|\
            com   org   uk   ...            top-level domains
             |           |
          acme        co.uk                 (uk delegates co.uk)
             |           |
     mail.acme.com   acme.co.uk
Read right to left. Each level delegates the level below it.

Names are read from the right. mail.acme.com is a name inside acme.com, which is a name inside com, which is delegated from the root. The trailing dot you occasionally see — acme.com. — is the root, usually left implicit.

Three parties, constantly confused

PartyWhat it isYour relationship
RegistryOperates a TLD. Holds the authoritative database of every registration in it and runs its nameservers. Verisign runs com; Nominet runs uk.None directly. You are not its customer and generally cannot contact it about your domain.
RegistrarThe company you buy and manage a domain through. Sends changes to the registry on your behalf.Your supplier. Your account with them is the control point for the whole domain.
RegistrantThe party the domain is registered to — a person or an organisation.You, or more accurately whichever colleague’s name and email are actually on the record.

Read the last row again

The registrant contact is frequently a departed employee, a shared mailbox nobody reads, or an agency engaged a decade ago. Every recovery and transfer-dispute process routes through that contact. This is worth checking on your own domains before you finish this course, and it is the cheapest finding in any domain assessment.

Registration and DNS hosting are different things

A domain registration is an entry in a registry database. DNS hosting is servers answering queries. They are frequently sold together and they are separate functions, and separating them mentally is necessary to reason about the attacks in this track.

  • The registration determines which nameservers the world is told to ask. Changing it is a registrar operation.
  • The DNS hosting determines what those nameservers answer. Changing it is a DNS operation.

An attacker with your registrar account does not need your DNS provider: they point the domain at their own nameservers and every record you have ever published becomes irrelevant. An attacker with your DNS account cannot redirect the delegation, but can rewrite every answer. Both are total compromises of the domain, and they are defended differently.

Not all TLDs behave alike

  • Some have registration restrictions — .bank requires verification, some country TLDs require local presence.
  • Some support stronger locking than others. Registry lock is available in most major TLDs and not in all of them, which is a genuine input to deciding where a critical domain lives.
  • Some publish registration data freely and some do not. This matters when you are investigating a lookalike domain, several modules from now.

Last reviewed