Domains and hosting: a complete guide

Every website stands on three things most people never see: a domain, DNS and hosting. While they work, nobody thinks about them. When something goes wrong, that is usually where: an expired domain, a lost registrar password, a server with no backups, email that suddenly stops arriving.

This is the long guide. If you only need the quick difference between a domain and hosting, start with domain and hosting explained. Here we go deeper: what happens when someone opens your site, who actually runs .com and .bg, how a domain is renewed, transferred and lost, what types of hosting exist and what they cost, what backups and security really do, and what to check before you sign anything. With real cases, tables and sources at the end.

In short

• The domain is the address (yourbusiness.com). You don't buy it forever; you rent it for a year or more and renew it [1].
• DNS is the directory that turns the address into a specific server and says where your email goes [3].
• Hosting is the computer (server) that stores the site's files and sends them to visitors [2].
• Ownership matters most. The domain should be registered to you or your company, with auto-renewal and a secured account.
• Judge hosting by speed, backups, updates and support, not by "unlimited space".

The analogy that works

Each of these can be with a different company. The domain might be registered with one registrar, DNS run by Cloudflare, the site on one host and email in Google Workspace. That is normal and even useful, as long as you know what is where.

What happens when someone opens your site

When a customer types yourbusiness.com and presses Enter, about six things happen in a fraction of a second [3]:

1. The browser asks: "Which server is yourbusiness.com on?" It checks its own memory first, then asks the internet provider's DNS server (the resolver).
2. The resolver asks the root servers: "Who is responsible for .com?" They point it to the .com registry's servers.
3. The .com servers say which nameservers are responsible for yourbusiness.com.
4. Those nameservers return the IP address of the host, for example 104.21.32.1.
5. The browser connects to the server, and the two set up an encrypted connection (that is SSL/TLS, the lock in the address bar).
6. The server sends the page and the browser displays it.

Answers are stored temporarily along the way (that is the TTL, a record's time to live), which is why a second visit is faster and why DNS changes sometimes take effect in minutes and sometimes in hours.

A short history: from one text file to 387 million domains

In the early 1980s every computer on the ARPANET was listed in a single text file that was maintained by hand and downloaded by everyone periodically. Once there were thousands of machines, that stopped working. In 1983 Paul Mockapetris proposed the Domain Name System (DNS), and the standard we still use today was set out in 1987 in RFC 1034 and 1035 [4].

On 15 March 1985 the computer company Symbolics registered symbolics.com, the first .com domain [5]. Today there are 386.9 million registered domains worldwide, 161 million of them .com, according to Verisign's figures for the end of 2025 [7].

Bulgaria has two country endings. The Latin .bg is run by Register.BG [9]. The Cyrillic .бг was rejected by ICANN in 2010 for looking too similar to Brazil's .br, then approved and added to the internet's root zone in 2016; it is run by Imena.BG [8].

Anatomy of a domain

Take shop.yourbusiness.com:

• .com is the top-level domain (TLD), the ending.
• yourbusiness is the name you register (the second-level domain).
• shop is a subdomain. You create it yourself in DNS at no extra cost, and you can have as many as you like: blog., booking., mail..

Types of endings

IANA keeps the full list of endings [6]. For a small business the choice is almost always the country ending or .com. How to choose the name and ending: how to choose a domain name.

Who's who in the domain world

• ICANN / IANA maintain the rules and the internet's root zone.
• The registry runs one ending (Verisign for .com, Register.BG for .bg).
• The registrar is the company you buy from (many hosting companies are registrars or resellers too).
• The registrant is you. That is the person or company recorded as the holder. ICANN sets out the registrant's rights and responsibilities explicitly [10].

The key point: the registrant is the holder, not whoever paid. If a web company registered the domain in its own name, legally it is theirs until they transfer it.

What a domain costs

Prices vary by ending and registrar. As a rough guide, an ordinary .com or country domain costs between €10 and €35 a year. The traps are elsewhere:

• Promotional first year. €1 for the first year and €25 every year after. Look at the renewal price, not the registration price.
• "Free domain" with hosting. Usually free only for the first year, then billed separately. And often registered in the host's name.
• Premium names. Short, popular names in the new endings sometimes cost hundreds of euros every year, not just the first.
• Unneeded extras. "Domain SEO package", "brand protection" for €50 and so on. You need almost none of them.

How a domain is renewed, lost and rescued

A domain expires on an exact date. For generic endings (such as .com), what follows usually looks like this, although registrars have their own rules [11]:

Country endings such as .bg have their own rules, so check your registrar's terms.

Yes, it happens to the big ones

• Google, 2015. A former Google employee, Sanmay Ved, saw google.com listed as available on Google Domains and managed to buy it for one minute before Google cancelled the order. Google paid him a reward of $6,006.13, a number that, with a little squinting, spells "Google" [14].
• Marketo, 2017. The big marketing software company let marketo.com lapse after its automatic renewal failed. Its site and its customers' services broke until a Twitter user paid the renewal on its behalf [15].

If it happened to them, it can happen to anyone. So:

• Turn on auto-renewal and renew 2–5 years ahead.
• Keep a valid card on the registrar account.
• Don't use an email on the same domain to recover the registrar account. If the domain expires, that email stops and you can't receive the password reset. Use another address.

Ownership: the check that saves the most stress

The story we hear most often: "Our previous web designer built the site years ago, the domain is in their name and they don't answer the phone." Five minutes of checking prevents it:

1. Check who the registrant is. For .com and other generic endings, since 2025 the official source is RDAP, which replaced the old WHOIS [13]; for .bg, use Register.BG's lookup [9]. Because of GDPR personal details are often hidden, but the company usually shows.
2. Ask for access to the registrar account, or at least confirmation that you are the registrant.
3. Write down the registrar, the expiry date and the email address that gets the notices.
4. Your contract with the developer should say the domain is yours and how it is transferred. More: website contract: what to check and red flags when hiring a web developer.

Transferring a domain

Moving a .com or other generic domain between registrars uses a transfer code (also called an EPP or auth code) from the current registrar. ICANN's rules usually block a transfer shortly after registration or a previous transfer, most often for up to 60 days [12]. For .bg the process goes through Register.BG. Changing registrar doesn't take the site down as long as the DNS records stay the same. How to change sites without losing rankings and email: how to move your domain to a new website.

The DNS records you should know

You don't have to set them up yourself, but it helps to know what's what when someone says "change the A record". An example for the made-up plovdivcarservice.com:

Your email lives in DNS

The nastiest surprise when changing sites: someone switches the nameservers, forgets the MX records and email stops. So always copy every record before moving DNS.

SPF, DKIM and DMARC are TXT records that prove email from your domain is genuine. Since February 2024 Google requires all three from anyone sending more than 5,000 messages a day to Gmail, and at least SPF or DKIM from everyone [16]. If your quotes land in spam, check these first. In detail: business email on your domain.

When DNS goes down, the big ones go down too

• Dyn, October 2016. A flood of requests from infected home devices (cameras, routers) aimed at the DNS provider Dyn made Twitter, Netflix, Reddit, Spotify and others unreachable for hours for many users in the US and Europe [17]. Their sites were running, but nobody could find them by name.
• Facebook, 4 October 2021. A faulty network change cut off Facebook's DNS servers, and for about 6 hours facebook.com, Instagram and WhatsApp disappeared from the internet [18].

The lesson for a small business: DNS with a reliable provider and two-factor protection on the account matter more than finding the cheapest option.

Domain security

• Two-factor authentication (2FA) on the registrar account. Whoever gets in there can redirect your site and your email.
• Transfer lock (registrar lock), on by default.
• DNSSEC, if your registrar and DNS provider support it. It signs DNS answers so they can't be swapped on the way.
• Beware of "your domain is expiring" letters from companies you don't know. They are often fake invoices or attempts to move you to an expensive registrar.

Hosting: what you are actually paying for

Hosting is a server connected to the internet around the clock, holding your site's files and sending them to every visitor [2]. What you really buy is disk space, computing power, traffic, server upkeep and (if you're lucky) backups and a person who picks up the phone.

Dynamic and static sites

This difference explains a lot about speed and price:

• A dynamic site (WordPress, online shops) assembles each page at the moment of the visit: it runs code (usually PHP), reads from a database and only then returns HTML. That's why it needs a more powerful server, updates and protection. WordPress runs 39.5% of all websites in the world [21].
• A static site is assembled in advance. The server simply sends ready-made files, often from a network of servers around the world (a CDN). Such a site is very fast, cheap to host and has far fewer things that can be hacked. The sites we build at Studio V1 are like this and are hosted on Cloudflare.

Types of hosting

Prices are approximate and depend on the provider and VAT.

How to judge a host

1. Speed

The first thing hosting directly affects is time to first byte (TTFB): how quickly the server starts to respond. Google recommends that most sites stay under 0.8 seconds [22]. Slow hosting means a slow site, however well the design is done. More: why is my website slow.

A CDN is a network of servers around the world that keep copies of your site close to the visitor [23]. A customer in Varna gets the site from a nearby server rather than from the other end of Europe. Cloudflare, one of the largest such providers, sits in front of 28.5% of all websites [21].

2. Reliability (uptime)

Hosts promise "99.9% uptime". It sounds like almost 100%, but here is what it means in practice:

Also check what happens if the promise is broken: you usually get a small discount, not compensation for the customers you lost.

3. Backups

This is the difference between a bad day and a disaster. On 10 March 2021 a fire at OVHcloud's data centre in Strasbourg, one of the largest in Europe, completely destroyed the SBG2 building and part of the one next to it. Thousands of sites disappeared, and customers who kept their backups in the same data centre lost everything [19].

So ask:

• How often are backups made? (At least daily for a site that changes.)
• How far back are they kept? (At least 14–30 days, because a hack or a mistake is often noticed weeks later.)
• Where? Backups should be somewhere else, not on the same server or in the same building.
• Has a restore been tested? A backup nobody has ever restored is a hope, not a plan.

A good rule is "3-2-1": three copies, on two different media, one of them off site.

4. Security and updates

Hacked sites are rarely the victims of genius hackers. The cause is almost always old software. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025 alone, 91% of them in plugins rather than WordPress itself [20]. If you have a WordPress site, someone needs to update the core, theme and plugins regularly and remove the ones you don't need.

What else the host should have: a web application firewall (WAF), DDoS protection, separate accounts for each site, automatic SSL.

5. The SSL certificate

The lock in the browser is free today: Let's Encrypt issues certificates automatically and at no cost [24]. If your host sells "SSL for €80 a year" for an ordinary business site, you are probably overpaying. Automatic renewal matters too: the maximum lifetime of SSL certificates is being cut in stages, from 200 days (from March 2026) to 47 days in 2029 [25], so renewing by hand is no longer an option. More: what is an SSL certificate.

6. Support

Try it before you buy: send them a question and see when and how they answer. What matters is whether a person answers, in what language, and whether support is included in the price or sold separately.

7. Data location and GDPR

If your site collects data (a contact form, bookings), the host processes personal data on your behalf. The General Data Protection Regulation requires a contract with such a processor [27]. A server or provider in the EU makes things simpler. More: GDPR and cookies on your website.

What it all costs together: three examples

Rough yearly figures for an ordinary business site:

Email is usually a separate cost: Google Workspace and Microsoft 365 cost a few euros per person per month. More on how the full bill adds up: how much does a small business website cost and website maintenance cost.

How to choose: 12 questions before you pay

1. Whose name will the domain be registered in?
2. What is the renewal price, not just the first year?
3. Is auto-renewal included?
4. Is there two-factor protection on the account?
5. How fast is the server (TTFB), and is there a CDN?
6. How often are backups made, how far back, and where?
7. Who updates the software, and how often?
8. Is SSL free and automatic?
9. Who answers when there's a problem, how, and how fast?
10. What does the data processing agreement say, and where are the servers?
11. How do I take my site and data with me if I leave?
12. What is not included, and what does it cost separately?

Moving hosts without downtime: 8 steps

1. Make a full copy of the site and database at the old host.
2. Write down every DNS record, especially the MX and TXT records for email.
3. Lower the TTL to 5 minutes a day in advance, so the switch takes effect quickly.
4. Upload the site to the new host and test it on a temporary address.
5. Change the A/CNAME records (or the nameservers) at a quiet hour.
6. Check SSL, the forms, email and redirects.
7. Watch Google Search Console for a few weeks.
8. Don't cancel the old host for at least a week, until you're sure everything works.

If page addresses change in the move, add permanent (301) redirects. Otherwise you lose the links and rankings you've built up. More: domain authority: a complete guide.

Domain and hosting myths

1. "I bought the domain, it's mine forever." No. You rent it and have to renew it.
2. "I paid, so the domain is mine." It's yours if you're recorded as the registrant. The payer and the holder are different things.
3. "Unlimited hosting means unlimited." There are almost always "fair use" rules and CPU limits.
4. "Hosting in my own country is better for SEO." Google mentions server location as one possible signal of a site's intended audience, but a country ending and the content say far more [26]. With a CDN the site loads from a server near the visitor anyway.
5. "SSL is expensive." For an ordinary site it's free [24].
6. "My host makes backups." Maybe. Check where they are and try restoring one.
7. "Email and the site have to be in one place." No, and it's often better if they aren't. DNS decides what goes where.

Glossary

• Domain: the site's address, e.g. yourbusiness.com.
• TLD: the ending: .com, .bg, .eu.
• Registry / registrar / registrant: who runs the ending, who you buy from, who the holder is.
• DNS: the system that turns names into server addresses.
• Nameservers (NS): the servers responsible for your domain's DNS.
• TTL: how long a DNS answer is remembered.
• IP address: the server's numeric address.
• Hosting: the server the site lives on.
• CDN: a network of servers worldwide that deliver the site from nearby.
• TTFB: how long the server takes to start responding.
• Uptime: the percentage of time the site is working.
• SSL/TLS: the encrypted connection, the lock in the browser.
• RDAP / WHOIS: the lookup for who registered a domain.
• EPP / auth code: the code for transferring a domain between registrars.

See also

• Domain and hosting explained: the short version
• How to choose a domain name
• Business email on your domain
• What is an SSL certificate
• How to move your domain to a new website
• Domain authority: a complete guide
• Web design: a complete guide

References

1. MDN Web Docs (Mozilla). "What is a domain name?" developer.mozilla.org
2. MDN Web Docs (Mozilla). "What is a web server?" developer.mozilla.org
3. Cloudflare Learning Center. "What is DNS? How DNS works." cloudflare.com/learning
4. P. Mockapetris. RFC 1034, "Domain names: concepts and facilities" (1987). rfc-editor.org
5. Wikipedia. "Symbolics" (symbolics.com, the first .com domain, 1985). en.wikipedia.org
6. IANA. "Root Zone Database." iana.org/domains/root/db
7. Verisign. "Domain Name Industry Brief." verisign.com
8. IANA. "Report on the Delegation of the бг domain representing Bulgaria" (2016). iana.org
9. Register.BG, the .bg domain registry. register.bg
10. ICANN. "Registrants' Benefits and Responsibilities." icann.org
11. ICANN. "gTLD Lifecycle." icann.org
12. ICANN. "Transfer Policy." icann.org
13. ICANN. "ICANN Update: Launching RDAP; Sunsetting WHOIS" (2025). icann.org
14. Google Security Blog. "Google Security Rewards: 2015 Year in Review." security.googleblog.com
15. The Register. "Marketing giant Marketo forgets to renew domain name" (2017). theregister.com
16. Google Workspace Admin Help. "Email sender guidelines." support.google.com
17. Wikipedia. "2016 Dyn cyberattack." en.wikipedia.org
18. Engineering at Meta. "More details about the October 4 outage" (2021). engineering.fb.com
19. The Register. "OVHcloud fire report" (2022). theregister.com; BleepingComputer. "OVH data center burns down knocking major sites offline" (2021). bleepingcomputer.com
20. Patchstack. "State of WordPress Security in 2026" (2025 data). patchstack.com
21. W3Techs. "Usage statistics of content management systems" and "Usage statistics of Cloudflare" (November 2026). w3techs.com; w3techs.com
22. web.dev (Google). "Time to First Byte (TTFB)." web.dev/articles/ttfb
23. Cloudflare Learning Center. "What is a CDN?" cloudflare.com/learning
24. Let's Encrypt. "How It Works." letsencrypt.org
25. DigiCert. "TLS/SSL certificate validity is shortening." digicert.com
26. Google Search Central. "Managing multi-regional and multilingual sites." developers.google.com/search
27. Regulation (EU) 2016/679 (GDPR), Article 28 "Processor". eur-lex.europa.eu