(Not the registrar. E.g., .com TLD is operated by Verisign.)
I wanted a domain for my e-mail. Sounds simple.
But I am a major overthinker, so over the period of past 2 weeks (damn!) I've been deciding between e-mail providers, choosing potential domain names, choosing a TLD (round 1 - by price and looks), looking through registrars, deciding whom to choose for nameservers, and now I am comparing registry operators (TLD round 2).
There are differences, such as who can register a domain, restrictions on domain privacy, and some TLDs like .dev are on HSTS preload list.
Currently, I am mostly looking at EURid with .eu TLD.
What piqued my interest is being able to transfer a domain directly through the registry. So, if a registrar locked me out or shut down, I could still transfer my domain.
From EURid:
From your registrar: Your first point of contact should be your registrar.
From the My .eu platform: You can also issue the transfer authorization code yourself on the My.eu account.
From EURid: This should be done only as a last resort. After proving you are the holder of the domain and cannot obtain an authorization code from your current registrar or via the My .eu platform, you can request an emergency transfer authorization code directly from EURid
Alright.
But I must wonder, how do I prove my ownership?
First sign that this may not be that secure is right on the same page:
Print the form, sign it and send it to us via email at authcoderequest@eurid.eu. If the requester is an organization, please print the form on company letterhead paper or add a company stamp.
OK, the form. Here's the request page. Fields are domain name, first name, last name, job title, email address, and reason for the request.
I generated the form to see what's there. So... is this the security?:
I hereby confirm that I am the rightful holder of the domain name mentioned above, or that I have obtained the legal power to represent the holder, and that all data provided is true and correct. I am fully aware that making a false statement in this matter is considered fraud and may have judicial consequences.
I mean, it doesn't even sound like they collect your signature during the verification, not that a picture provides much security. This is one of the methods:
You can receive a small bank payment (less than one euro) from EURid, which includes a 10-character code that starts and ends with “EU”, with six digits in between (EUXXXXXXEU). After receiving this payment, the domain holder logs in to the My .eu platform and enters the code to verify their registration data.
Either way, it seems this might be mitigated by registry lock:
The Registrar Lock Service will also protect your domain name from accidental changes, but the difference from Registry Lock is that a locked domain name can still be transferred with an authorisation code sent to your My .eu account or an emergency authorisation code received from EURid.
Enough about safety. What about privacy?
The T&C [PDF] prohibits the domain having info of the registrar:
Your registration data must be your own data and must not be that of your Registrar, or of a proxy holder or a representative of a natural person or legal entity who does not meet the eligibility criteria. You may at any time check your registration data via the web-based WHOIS or the secure registrant portal available on our Website.
But it gets a bit better in the WHOIS policy [PDF]:
When the Registrant is a natural person the Registry publishes the Registrant´s e-mail address and language.
Alright. I hope there's someone else who took a similarly overcomplicated route in choosing a domain name.