Where to buy domains in 2026: registrars, lockouts and safe transfers
The cheapest domain is not always the cheapest asset. A renewal surprise, a verification hold or a transfer lock can cost more than the registration itself. This guide compares the services we would shortlist today and explains what to check before putting a business domain in an account.
The short answer
- Cloudflare Registrar is the cleanest choice for teams already using Cloudflare DNS and comfortable with its transfer constraints.
- Porkbun is a strong general-purpose registrar with transparent policies and a simple control panel.
- Namecheap is convenient when you also want a built-in marketplace for selling domains.
- Dynadot is useful for larger portfolios and aftermarket inventory.
- GoDaddy has the broadest aftermarket reach, but the interface and renewal pricing require closer attention.
The right choice depends less on the first-year coupon and more on renewal price, account recovery, transfer rules and who controls the email and MFA attached to the account.
What to compare before buying
| Check | Why it matters | What to record |
|---|---|---|
| Renewal price | A one-year promotion can hide the real cost | Price for years 2 and 3 |
| Transfer policy | Registrars can block transfers after changes | Lock period and auth-code process |
| Account verification | A review can pause renewals or transfers | Required documents and support channel |
| DNS control | A registrar outage should not take down DNS | Whether DNS can stay independent |
| MFA and recovery | Losing the mailbox can mean losing the domain | Recovery contacts and backup codes |
| Marketplace terms | Selling is a separate product with fees and settlement delays | Listing fee, payout method and hold period |
Screenshot the checkout and renewal price. Store the invoice and registry ownership details in an internal vault, not in a chat thread.
Registrar notes
Cloudflare Registrar
Cloudflare sells domains at cost and integrates registration with Cloudflare DNS. That is attractive for infrastructure teams, but it is a deliberate trade: domains registered there must use Cloudflare nameservers, and moving a domain between accounts requires confirmation from both sides. Read the transfer conditions before migrating a production domain. (Cloudflare transfer guide)
Porkbun
Porkbun is a sensible default for a small team that wants a straightforward registrar and clear legal terms. Its transfer documentation also calls out a common trap: renewing an expired domain and transferring it soon afterwards may not add another year. Treat an expired domain as a recovery incident, not a routine renewal. (Porkbun transfer guide)
Namecheap
Namecheap is useful when registration and resale live in the same account. Its Market Buy Now product lets owners list domains, including domains registered elsewhere, but a sale is not an instant bank payout: the marketplace agreement describes a processing period and account-credit settlement minus the listing fee. Build that delay into your cash-flow plan. (Namecheap Market Buy Now, Marketplace agreement)
Dynadot
Dynadot is worth considering when you manage many names or actively buy aftermarket inventory. Its marketplace accepts domains registered with other registrars, which can simplify consolidation. Keep a separate portfolio sheet so a marketplace listing never becomes the only record of ownership. (Dynadot marketplace)
GoDaddy
GoDaddy remains a major aftermarket venue. The practical rule is simple: compare the renewal total, privacy settings and transfer-out steps with at least one other registrar before registering a strategic name. High visibility does not remove the need for an exit plan.
Why accounts get locked
Most holds are not random. Common triggers include an unverified registrant email, a payment dispute, a login from a new region, repeated failed payments, or a domain that attracts an abuse complaint. A lock can be temporary, but the timing is what hurts: it often appears when a team is trying to transfer or renew a domain urgently.
Do this before launch:
- Verify the registrant email and keep access outside the company’s main mailbox.
- Enable MFA with two administrators and store backup codes offline.
- Use a company payment method whose billing name matches the account.
- Keep invoices, identity documents and ownership approval in a restricted folder.
- Add a second registrar account only as a documented recovery route, not as an unmanaged duplicate.
Never create several accounts to evade a review. That makes ownership harder to prove and can turn a routine verification into a broader account investigation.
Safe transfer checklist
Before requesting a transfer, check the domain status, expiry date, registrant email and transfer lock. Export DNS records and lower critical DNS TTLs only if you have a planned cutover. Request the auth code through the registrar’s official dashboard, not through an emailed copy-paste from an unknown address.
After the transfer, verify:
- nameservers and DNSSEC;
- MX records and mail delivery;
- redirects, analytics and payment callbacks;
- auto-renewal and the new expiry date;
- administrator access and MFA.
Run the checks from a written change ticket. A domain transfer is infrastructure work, even when the checkout page makes it look like a small purchase.
Our decision rule
For a single editorial or product domain, choose the registrar with the clearest renewal price and recovery path. For a portfolio, choose the one that exports data cleanly and lets another person audit ownership. For resale, read the marketplace settlement rules before buying inventory.
The registrar is replaceable. The domain, the email attached to it and the reputation built on it are not.