What Developers Should Know Before Buying a Domain
Compare registrar, DNS provider and host roles, check domain renewal and transfer costs, move DNS to Cloudflare, and configure apex and www records for Vercel, Netlify and Pages.
Buying a domain means choosing three separate things: the registrar you pay each year, the DNS provider that answers lookups for the name, and the host that serves the site. They don’t have to be the same company.
The checkout page makes it feel like a single purchase. It shows one cheap number and one button, and the side project hasn’t even got a README yet. A year later the renewal email arrives, the apex domain still doesn’t resolve, and you notice you own more domains than repos with commits this quarter.
This guide covers how to buy a domain without those surprises. It explains the three roles, the pricing and transfer traps to check before paying, how to move DNS to Cloudflare, the records you need for Vercel, Netlify and Cloudflare Pages, and a rule for trimming the collection.
Key Takeaways
- The nameservers set at your registrar decide which DNS provider is authoritative for your domain, so moving your DNS means changing nameservers, not changing registrars.
- The price at checkout is often a first-year promotion. The renewal price is what the domain costs every year after that, and on many registrars and newer TLDs it is much higher.
- Standard DNS does not allow a CNAME at the apex of a domain, because the apex must also hold NS and SOA records and a CNAME cannot share a name with any other record.
- Cloudflare Registrar sells domains at cost, but every domain registered there must use Cloudflare’s nameservers.
- Pick either the apex or www as your canonical hostname and redirect the other to it.
What Is the Difference Between a Registrar, DNS Provider and Host?
The registrar holds your registration and bills you. The DNS provider answers queries for your records. The host serves the actual files. ICANN accredits registrars, and they register names with the registry that runs each TLD. Separately, the nameservers you set at the registrar tell the world which DNS provider is authoritative for the domain.
| Role | What it does | Where you change it |
|---|---|---|
| Registrar | Holds the registration, bills renewals | Transfer to another registrar |
| DNS provider | Answers lookups for your records | Nameservers, set at the registrar |
| Host | Serves the site | DNS records, set at the DNS provider |
You can check who answers for any domain:
# Which nameservers are authoritative for this domain?
dig +short NS example.comIf record types need a refresher, see the DNS basics guide. Everything that follows assumes you know what A, CNAME and NS records do.
How to Buy a Domain Without Falling Into the Usual Traps
Before you buy, check four things: the renewal price, how the TLD is priced, the transfer lock, and whether WHOIS privacy is included. Each takes about thirty seconds, which is less time than the checkout page’s confetti animation.
The renewal price, not the checkout price. First-year promotions are common across registrars, and renewals often cost much more. Find the renewal line on the pricing page or in the cart before you pay.
How the TLD is priced. Prices for .com and .net are capped by their registry agreements, so increases are limited and predictable. Many newer gTLDs, and some country-code TLDs popular with developers such as .io, can be expensive to renew, and their registries set the price. Registry-premium domains often keep their premium price at every renewal. Aftermarket domains usually cost more once and then renew at the standard rate. For a side project, premium names rarely pay off.
The transfer lock. Under ICANN’s current Transfer Policy, your registrar can refuse to move a gTLD registration to another registrar for up to 60 days after you register it. Transfer Policy changes approved by ICANN’s GNSO Council in 2025 would replace this with a fixed 30-day lock once they take effect. Country-code TLDs set their own rules. Changing the registrant’s name, organization or email also starts a 60-day lock under the current policy. Some registrars let you opt out of that lock, and the same policy changes would remove it.
WHOIS privacy. Many registrars include it free, while some charge for it every year. Check which kind yours is before the cart total fools you.
How Do You Move DNS to Cloudflare?
To move DNS to Cloudflare, add the domain to Cloudflare, then replace the nameservers at your registrar with the two Cloudflare assigns, and wait. The registration stays where it is. Only the authoritative DNS moves.
- Add the site in Cloudflare. You get two assigned nameservers.
- Check the imported records. The scan can miss existing ones.
- If DNSSEC is on, turn it off at your registrar first. If you switch nameservers with DNSSEC still active, the domain can stop resolving.
- Replace the nameservers at your registrar.
- Wait. It can take anywhere from minutes to many hours, depending on TTLs and resolver caches.
If it’s not working yet, your machine may be holding a cached answer. Query public resolvers directly, and see how to clear the DNS cache in Chrome:
# Skip your local cache and ask public resolvers directly
dig +short NS example.com @1.1.1.1
dig +short NS example.com @8.8.8.8You should see the two nameservers Cloudflare assigned to your zone.
Developers move DNS to Cloudflare for three reasons: free and fast authoritative DNS, CNAME flattening at the apex on every plan, and one dashboard for DNS, Pages and the CDN (see the best CDNs for modern web apps for how that network compares).
Cloudflare Registrar sells domains at cost and handles both new registrations (from the Cloudflare dashboard) and transfers in. Every domain registered there must use Cloudflare’s nameservers, so if you want a different DNS provider, you have to transfer the domain to another registrar.
Why Can’t the Apex Domain Be a CNAME?
www can be a CNAME pointing at your platform, but the bare apex (example.com) can’t. A CNAME can’t share a name with any other record under RFC 1034 §3.6.2 and RFC 2181 §10.1, and every zone apex has to hold NS and SOA records. That is why this configuration is invalid:
; NOT allowed by standard DNS
example.com. IN NS ns1.example-dns.net.
example.com. IN CNAME <platform-target>.To point an apex domain at Vercel or Netlify, you have three options:
; www points at the platform with a CNAME
www.example.com. 3600 IN CNAME <your-project-target-from-platform-dashboard>.
; Pick ONE for the apex:
; Option A: A record to the IP your platform documents
example.com. 3600 IN A 192.0.2.10 ; replace with the platform's documented IP
; Option B: ALIAS / ANAME (provider-specific, not a standard record type)
; example.com. ALIAS <platform-target>.
; Option C: On Cloudflare, create a CNAME at "@" and Cloudflare flattens itFor Vercel, its knowledge base says to use option A at the apex, or to hand the domain’s nameservers to Vercel instead. Vercel also lists default DNS values, but many projects are given their own, so copy the values from your domain settings screen. Netlify’s domain settings list its own targets in the same way. ALIAS and ANAME records let an apex act like a CNAME, but only some DNS providers offer them.
Cloudflare Pages works differently. For an apex domain on Pages, the domain has to be a Cloudflare zone in the same account as the Pages project, with its nameservers pointed at Cloudflare. An A record or ALIAS at an outside provider won’t work. A subdomain only needs a CNAME at your existing DNS provider.
Finally, choose either the apex or www as the canonical hostname and redirect the other to it, so that every visitor, cookie and search result ends up on one address. Vercel’s docs suggest making www the main hostname and sending the bare domain to it with a redirect. To check the redirect:
# Expect a 301/308 from the non-canonical host to the canonical one
curl -sI http://example.com | grep -i -E '^(HTTP|location)'Sixty Domains, Three Projects
Every domain renews every year, whether or not anything is deployed on it, so a collection of unused names costs you more each year you keep it. That name you bought at 1 a.m. for a CLI you never started is still billing you.
Set a rule and follow it. One option: if the repo has had no commit in a year, let the domain lapse. Once a year, export your domains and their expiry dates from the registrar dashboard and match them against your repos. Turn on auto-renew only for domains you’d miss, meaning ones with a live project, email or inbound links.
If you’re consolidating registrars, remember that each transfer starts a new lock, so you can’t hop a domain between registrars quickly. Plan moves around renewal dates.
Conclusion
A domain involves three roles. The registrar bills you, the nameservers pick who answers DNS, and the DNS records point at your host. Keep those separate and most setup problems get easier to reason about, including the apex CNAME rule. Before the next impulse purchase, read the renewal price. Then open your registrar dashboard and switch off auto-renew on every domain you wouldn’t miss.
FAQs
What happens if a domain expires before I renew it?
For most gTLDs, an expired domain first enters an auto-renew grace period, when you can still renew it at your registrar. If the registrar then deletes it, ICANN's Expired Registration Recovery Policy requires a 30-day Redemption Grace Period. During that period DNS resolution is disabled and transfers are blocked. Restoring the domain in that window often costs an extra redemption fee. Sponsored gTLDs and ccTLDs follow their own rules.
Do I lose my remaining registration time when I transfer a domain to another registrar?
No. For most gTLDs such as .com, .net and .org, a transfer adds one year to the current expiration date and does not restart the term. Most registries cap terms at 10 years, so a transfer can be rejected if the extra year would exceed that cap. A transfer within 45 days of renewing an expired domain may not add the year. Country-code TLDs set their own rules.
What is the difference between CNAME flattening and an ALIAS or ANAME record?
Both fix the apex problem the same way. The authoritative DNS provider resolves the target hostname itself and answers with A and AAAA records, so resolvers never see a CNAME. Cloudflare calls this CNAME flattening, Route 53 calls it an alias record, and other providers call it ALIAS or ANAME. Because the provider does the lookup, a geo-routed target may return addresses picked for the provider's location, not the visitor's.
Does changing nameservers trigger the 60-day transfer lock?
No. The ICANN change-of-registrant lock only applies when the registrant's name, organization or email address changes, and nameservers are not registrant data. Pointing a domain at Cloudflare or any other DNS provider leaves the registrar, the registration and the expiration date as they were. For gTLDs, the usual transfer blocks are a new registration, a recent transfer or a change to those registrant fields.
