Your Domain, Your DNS, and Your Hosting Are Three Different Things
Registrar, DNS, hosting. The three get used as though they mean the same thing, and they do not. They are three separate services, usually bought from three different companies, sitting in three different accounts.
You mostly do not need to think about that. It starts to matter when you move a website, set up email, add a tool that asks you to “verify your domain,” or try to work out who is even allowed to make the change. Knowing which of the three you are dealing with is usually the difference between a five-minute edit and a long afternoon.
Here is what each one is, what it controls, and how they hand off to each other.
The three-part stack
Registrar, domain records, hosting.
Three different things.
A working website needs all three. They are managed separately, they fail separately, and they usually sit in three different accounts — which is why "the website is down" can mean three unrelated problems. Two of them also serve as proof of your identity online, so it is worth knowing which is which.
Domain registrar
Where your domain name is registered.
Every domain is registered through a registrar — Cloudflare, Namecheap, GoDaddy. That account is where the registration is renewed, locked, and transferred, and where you set which nameservers are allowed to answer for the name. It sits above the other two.
Domain records (DNS)
The list that says where the name should point.
A registered name does nothing on its own. Its records — a short list of entries in a DNS zone — tell the rest of the internet which server answers for the website, which one handles the email, and which services are allowed to act on the domain's behalf. Editing them is how a site or an inbox moves.
Web hosting
The computer that stores your site and serves it to visitors.
Your pages, images, and code live on a server run by a hosting company, or on a platform that bundles hosting in — Squarespace, Shopify, WordPress.com. It stays on and answers requests around the clock. This is the part priced by capacity, traffic, and features.
Side by side
| Registrar | Domain records | Hosting | |
|---|---|---|---|
| What you buy | The exclusive right to use one name | Nothing physical — a set of pointers, usually included with the domain or the host | Storage, bandwidth, and a machine that is always on |
| Why it matters | Controls the name, and therefore everything attached to it | Decides where traffic and mail actually go, and proves ownership to other services | Holds the site itself, and whatever data it collects |
| Where it lives | Your registrar account | Wherever your nameservers are — registrar, host, or a DNS provider | Your hosting or site-platform account |
| When it goes wrong | The name stops working everywhere at once — site, email, logins | Visitors or mail land in the wrong place, or nowhere | The site is slow, or returns an error, but the name still resolves |
| Changing providers | Transfer the domain; the name stays yours | Edit the entries, or move the whole zone to new nameservers | Copy the site to the new host, then update the records to match |
How they work together
Someone types example.com into a browser
- Someone types the addressThe browser has a name. It does not yet have a number.
- The domain records get the question
which server answers for this name? - The records answer with an address
A → 203.0.113.42 - The browser asks that server for the page
GET / → 203.0.113.42 - Hosting sends the files back
200 OK · index.html - The page appearsThree separate services, one request, well under a second.
The registrar never answers a request. Its role is upstream: it keeps the registration valid and remembers which nameservers to trust. If the registration lapses, the lookup has nothing to ask, and the whole chain stops — no matter how healthy the hosting is.
Why access to these matters
The domain is treated as proof of identity
Hosting holds a website. The registration and the records hold something larger: the domain is how outside services confirm who your business is. That makes these two accounts security-critical in a way that is easy to underestimate.
A record is how you prove you own the domain
Google Workspace, Microsoft 365, single sign-on, TLS certificates, payment and marketing platforms all verify ownership by asking you to publish a record. Whoever can add a record can pass those checks and stand up services in your name.
Redirecting mail redirects password resets
Change the mail records and inbound email can be quietly copied or captured — including reset links for banking, payroll, and vendor portals. Every account that trusts an address at your domain becomes reachable, without anyone touching those accounts directly.
One account, then many
The registrar account controls which nameservers answer, so it controls the records too. From there an intruder moves outward — mail, then identity provider, then the systems behind it — and the traffic still looks legitimate, because it is coming from your domain.
Treat these two accounts like the keys they are
- Multi-factor authentication on the registrar and DNS accounts, without exceptions.
- Registrar transfer lock on, auto-renew on, billing contact current.
- Owned by the business, not by a former employee, an agency, or a personal address.
- Record changes logged and reviewed. An unexpected new entry is a signal.
Where people get caught out
“We moved the website and email stopped.”
Website and email are separate records on the same name. Pointing everything at a new host overwrites the MX entries that route mail. Move the website record, and leave the mail records alone unless email is moving too.
“The domain expired and everything went dark.”
The registration sits above hosting, so a lapse takes down the site, the email, and any logins tied to the name at the same moment. The hosting keeps running and keeps billing; nobody can reach it. Auto-renew plus a current card on the registrar account is the whole fix.
“I changed a record and nothing happened.”
Answers are cached all over the internet. Each record's TTL says how long others may hold the old one — often minutes, sometimes a day or more. Lower the TTL a day before a planned move so the switch lands quickly.
Words you'll hear
- Nameserver
- The machine that holds your records and answers lookups. Set at the registrar.
- A record
- Points the name at a numeric server address. The website entry.
- CNAME
- Points one name at another name instead of an address. Common for hosted platforms.
- MX record
- Says which mail service receives email for the domain.
- TXT record
- Free-form text on the domain. How most ownership checks and mail-security policies are published.
- TTL
- Time to live — how long the rest of the internet may cache a record before rechecking.
Why this comes up so often
Two of these three accounts are not really about your website at all. They are about identity. Every service that needs to confirm your business is your business asks you to publish a record on your domain, which means whoever controls the records can pass those checks. That is a much larger surface than most people assume they are protecting when they set up a domain.
The practical version is short. Find out who holds the registrar account and who holds the DNS, confirm both are owned by the business rather than a person who used to work there, and put multi-factor authentication on both. Auto-renew and a transfer lock cost nothing and close the two most common ways a domain goes dark.
Not sure who holds yours?
If you cannot answer where your domain is registered or who can edit its records, that is worth an hour of somebody’s time before it becomes an emergency. We audit this as part of onboarding, and we are happy to walk through it on its own.