Yes, that is good advice. We are reviewing all our processes about domain registries right now. Major lesson learned, and I would encourage other companies to think this through and learn from our experience today.

I learned this the hard way just a few months ago with Namecheap. Those guys dumped all of my personal information to some people (my name, address, phone number, etc.). I have kids in my home and all they offered me was $100 in Namecheap credit, which I didn't accept out of principle. I spoke with a lawyer and the privacy laws in the U.S. seem to make it not even worth going after them. Registrars basically can do what they want and it's hard to hold them accountable.

What people? Why are you scared of them? Should I be worried, as I have domains at namecheap.

Check out https://news.ycombinator.com/item?id=14139288

Never use namecheap for anything important.

I almost has a domain frozen with namecheap after one warning. If I missed the warning email or checked my email after 24 hours they would have completely suspended my domain. I'm talking about a site with MILLIONS of visitors per month and ten thousands of posts per day, not some small blog.

I’m in the same position and would love to hear more as well

Here's a quick timeline.

I did some work for a client in 2017 who was starting a cryptocurrency business. This involved buying a domain name for him to transfer to him later.

Well in 2018 there was some internal strife in his business that ended with a lawsuit being started. The opposing party started sending subpoenas to Namecheap asking for all information from 2018 onwards in relation to his account. What ended up happening was they released all of my information about my purchases, domains, personal information(anonymized credit card info, my actual physical address, information about my other unrelated clients domains, etc.)... going back to the start of my account.. several years worth of data prior to 2018. All clearly out of scope of the subpoena they were served.

Not only that, Namecheap never notified me of this.. in violation of their own privacy policy. They're supposed to notify their customers of the release of their information in relation to subpoenas by email or certified mail. Instead I found out much later from my previous client when he was given a copy of all of my information. And presumably his opposing parties in the crypto space were also given all of my information.

Seems kind of messed up to release all of that erroneously, without warning... especially to shady people in the crypto space.. you know, with people getting kidnapped over this stuff.

TL;DR Namecheap will drop your info, even if you paid to protect it as soon as they're given a single demand letter. And they won't stop at just giving up the info that's asked for (with 0 fight and 0 notification to you) there's a chance they'll release ALL of your account information.

Thank you for sharing that awful story. Sorry you had to go through it. Quite disappointing to a customer of Namecheap as well.

See my comment above.

I repeat don't use namecheap for any meaningful business, especially anything that is "enterprise"

Cloudflare Secure Registrar - I know you guys probably in some ways compete with Cloudflare, but maybe give them a call. Or for that matter become your own registrar and get into the corporate registrar business. With this experience under your belt, no doubt you'll crush it!

FWIW, CF's registrar is nice, but also represents an extreme form of lock-in on the part of Cloudflare -- the registrar subscription is specifically tied to your enterprise plan and will be terminated if you are not using other CF products.

That is not the case anymore. We would still allow you to continue to purchase just registrar.

Oh, fantastic! I'll let my former colleagues know, assuming no one else has reached out to them (this was a pretty specific piece of feedback we had re registrar, so great to hear that it's changed).

Do you have enough capital to become a registrar?

It's not just capital, becoming accredited is a major paperwork and logistical hassle, and you have to do it with every TLD you want to support.

Pretty sure they only need to worry about dot com.

Which register do you recommend?

MarkMonitor is what Facebook, Google, Apple, Microsoft and other huge companies use. They don't take small accounts, though.

> Google

Google is a registrar themselves... Do you mean they use someone else for their own domains?

Google uses markmonitor:

Domain Name: GOOGLE.COM

   Registry Domain ID: 2138514_DOMAIN_COM-VRSN

   Registrar WHOIS Server: whois.markmonitor.com

   Registrar URL: http://www.markmonitor.com

   Updated Date: 2018-02-21T18:36:40Z

   Creation Date: 1997-09-15T04:00:00Z

   Registry Expiry Date: 2020-09-14T04:00:00Z

   Registrar: MarkMonitor Inc.

   Registrar IANA ID: 292

   Registrar Abuse Contact Email:

[email protected]

It probably looks like what Zoho should use..

Correct, MarkMonitor is a _huge_ business. Alphabet has had an account there for much longer than they have been a Registrar under Google name.

How exactly was that story of a man owning Google.com through Google domains for a few minutes possible, then?

He didn't own the name, he found a way to change the DNS records; while being registered at MM, google.com is still pointed to Google's own DNS servers.

A freak accident and lack of checks.

They're a reseller like everyone else. If I'm not mistaken they actually use eNom for customers buying domains on any of their platforms (though not for their own domains).

They're a reseller for some TLD's, and a registrar for others.

Wasn't aware they'd finally taken the plunge. Thanks for the correction.

Doesn't seem to be true, for my domain registered at Google:

Registrar: Google Inc.

Registrar IANA ID: 895

Registrar Abuse Contact Email: [email protected]

Registrar Abuse Contact Phone: +1.8772376466

Verify yourself at: https://www.iana.org/assignments/registrar-ids/registrar-ids...

Zoho is Zoho Corporation Private Limited IANA ID: 3803

I get emails for a friend's domain that was originally registered through Google Apps (G Suite) many years ago, and I see emails with "enom" in them going back all those years.

That’s before Google domains hit off

Cloudflare Secure Registrar. Few people know that Cloudflare operates a registrar, but they do. The pricing is $enterprise, as it should be:

"Cloudflare Registrar is the highest level of registrar security. It protects your organization from domain hijacking with high-touch, on and off-line verification of any changes to your Registrar account. Cloudflare is an ICANN accredited registrar providing secure domain registration for high-profile domains."

Gandi.net, located in France with strong privacy. And a good API (the new version)

which registrars are these?

I don't like to give recommendations since it either mean promoting the company I work at which just feels like mixing professional and private, or promoting competitors which just feel worse. Instead I prefer giving general advice on what to look for when picking a registrar.

Having a personal contact at the registrar for example might sound unnecessary, but it means that a person at the registrar should know the company involved and the impact of the domain or domains before any serious action like suspension are made. In large and bulk like registrar this isn't the case and as such no one likely knew what Zoho.com was or how many users it would effect. It was likely just an other $10 annual fee among millions of other domains, and as such it is very easy to just suspend and forget and later try fix any issues if those are raised. Cheap and quick solution but very costly if the owner values the domain name above that of $10.

Hey mate,

I've always been a bit perplexed as to how registrar's are created. How could I become a registrar?

Any advise or resources to explore this very open question would be wonderful.

Cheers J

Basically, you have to go through the ICANN accreditation process, which is documented here:

https://www.icann.org/resources/pages/accreditation-2012-02-...

The cheaper, and easier way, if you're looking to start selling domains with a lower barrier to entry (but less control over how much you pay/how you sell your domains) is to find a white-label reseller registrar.

> I've always been a bit perplexed as to how registrar's are created. How could I become a registrar?

In all that time of being perplexed, you never thought to do a simple Google search? https://www.google.com/search?q=how+registrar%27s+are+create...

Thanks for your response Micheal. That's an interesting website. I'll take a look!

Are you a bot?

The first aspect is that every* TLD has it own registry and system. For the generic ones you got ICANN accreditation process, but there is also a bunch of registrar reseller that act as a middle man between ICANN and other registrars.

Usually most processes involve some form of capital investment and/or technical capability. Country specific TLD can either be easier or much much harder depending on which country.

* Not really everyone.