Domains, DNS and Hosting, Explained for Beginners

Most explanations of domains and DNS for beginners either skip the mechanics and tell you to click Connect, or bury you in record types you will never touch. This lesson covers the four records that matter, the one number that decides how long a change takes, and why the padlock stopped costing money.

There are three moving parts. A name somebody controls. Records that say where the name points. A machine that answers when someone follows the pointer. That is a website's address, in full.

A domain is a rental, not a purchase

You do not buy a domain. You register it for a term — usually a year, sometimes ten — and hold it as long as you keep renewing. No registrar can sell you a name outright, because the name belongs to a registry that licenses the right to hold it.

A domain you forget to renew can be gone within weeks, and buying it back is expensive when it is possible at all. Auto-renew and a valid card prevent the most avoidable disaster in this course.

Registrar and host are two different jobs

A registrar records who controls the name. A host stores your files and answers requests for them. Unrelated services — the split only confuses people because the two are so often sold together in one checkout.

Buy both from one company and your DNS settings sit in that company's control panel. Buy the name in one place and the hosting in another — normal, and often cheaper — and you must decide which company runs your DNS. Whichever you pick, that is where the records live. Find that screen once now, while nothing is on fire.

Hosted builders add a third option: hand them your nameservers and let them run DNS entirely. Easier, less control. You do not need an opinion about that yet.

The four DNS records that actually matter

DNS defines dozens of record types. For a first website you will use four.

A — name to address

An A record maps a name to an IPv4 address: example.com to 203.0.113.10. AAAA does the same for IPv6. If a host gives you an IP address to point at, an A record is what you are creating.

CNAME — name to another name

A CNAME maps one name onto another: www.example.com points at a hostname the platform owns, and whatever that resolves to is what visitors get. Builders and static hosts prefer CNAMEs because they can move their own infrastructure without asking you to update anything.

One rule causes nearly all CNAME confusion: a CNAME cannot coexist with other records at the same name. Your root domain almost always has others — MX at minimum — which is why the root usually cannot be a CNAME. Providers work around it with ALIAS, ANAME or CNAME flattening. Use whichever yours offers.

MX — where your email goes

MX records say where mail for your domain is delivered. The trap: changing web hosting does not move your email, but replacing a DNS zone or switching nameservers deletes the MX records that were making mail work.

Before you change nameservers or clear a zone, copy every existing record into a plain text file. If mail stops an hour later, the fix is in front of you instead of inside a support queue.

TXT — proof and email authentication

TXT records hold arbitrary text and do two jobs: proving to a service that you control the domain — Google Search Console's DNS method is a TXT record — and carrying the email authentication settings SPF, DKIM and DMARC. Paste in the strings your provider gives you; you do not need their syntax yet.

Propagation is not a real thing. TTL is.

Someone will tell you your change needs 24 to 48 hours to propagate. There is no propagation. DNS has no broadcast mechanism and nothing is pushed anywhere.

What exists is a distributed cache with an expiry clock. When a resolver looks up your domain it keeps the answer for a number of seconds called the TTL, or time to live. Until that timer runs down it serves the stored answer and does not ask again.

So the wait is the TTL in place before your change. 300 seconds means minutes. 86,400 seconds means up to a day. The 24-to-48-hour figure is a fossil of early registrars enforcing 86,400-second TTLs; it matches no current standard. Modern defaults are commonly 3,600 seconds.

Which hands you a useful move. A day before a planned migration, drop the TTL on the records you will change to 300 seconds and let the old one expire. Then switch, and it lands in minutes. Raise the TTL again afterwards.

Two exceptions keep the long tail alive. Nameserver changes happen at the registry, which sets its own TTLs — up to 48 hours. And a minority of ISP resolvers ignore TTLs entirely. Neither is a reason to panic at hour six.

HTTPS is free now, and here is why

The padlock is a TLS certificate — a file proving your server is entitled to serve your domain. It used to cost money because a human at a certificate authority did work to issue it.

Then came Let's Encrypt: a free, automated, open certificate authority run by the nonprofit Internet Security Research Group. Certificates are issued over a protocol called ACME, in which your host proves domain control and receives a certificate with no human involved. That is why every host and builder hands you HTTPS at no charge. It is an API call, not a favour — and you should not pay for an ordinary certificate in 2026.

Certificate lifetimes are collapsing

Let's Encrypt issues 90-day certificates by default today, with optional six-day short-lived ones. It has published a plan to reach a 45-day maximum by February 2028, with an interim step on 10 February 2027 moving the default profile to 64 days. Industry-wide, the CA/Browser Forum maximum drops to 47 days from 15 March 2029, with interim caps near 200 days after March 2026 and 100 days after March 2027.

Read that as a trend line, not dates to memorise. The direction is one-way, and the consequence is blunt: manual renewal is finished as a practice. Nobody remembers a chore that recurs every six weeks forever on a site they rarely log into.

That is a genuine, under-discussed argument for letting somebody else run your hosting. A managed host — SiteGround is one example of the category — or any hosted builder renews certificates automatically and you never see it happen. (That one is an affiliate link; almost nothing else here is, and this lesson would say the same without it.) If you run your own server, your job is not renewing by hand. It is making sure something automated does, and knowing how you would find out if it stopped.

The first-year-cheap trap, with the actual numbers

You have seen the 99-cent first-year .com offers. Verisign runs the .com registry and charges every registrar the same wholesale price: $10.26 a year, rising to $10.97 on 1 November 2026, an increase of about 6.9%. Add the ICANN fee of roughly $0.18 to $0.20 and the true floor is about $10.46 today, $11.17 after November.

Now the part that matters: registration and renewal cost the registry exactly the same. There is no wholesale discount for a first year, for anyone. A 99-cent first year is therefore not a saving the registry made possible — it is a registrar losing about nine dollars to acquire you and recovering it at renewal, often at $18 to $22.

Compare the renewal price, and better still the five-year total. A flat $12 a year is $60 over five years. A 99-cent first year followed by $22 renewals is $88.99. The headline was cheaper; the half-decade was not.

At-cost registrars exist. Cloudflare Registrar states publicly that it applies no markup and charges identically for registration and renewal, WHOIS privacy included. We deliberately do not print a figure: the exact .com price is not published there and third-party trackers disagree. Judge the model, not a number.

The registry contract also permits 7% increases in four years out of every six, and industry projections put .com wholesale near $13.45 by 2029. Budget the renewal, not the promo.

Choosing a name

Say the name out loud to someone who has never heard it. If they ask whether it has a hyphen, it is the wrong name. Hyphens and digits fail the phone test. Stay clear of anything near a trademark. And do not buy a premium domain before the site exists.

Where this sits in the course

Everything above is route-agnostic. Builder, WordPress or hand-written HTML, the records behave identically. If you have not chosen yet, the full walkthrough of how to make a website puts this lesson in its place in the path.

Before you move on

• You know which company holds your DNS, and you have opened that screen once.
• Your existing records, MX above all, are saved outside the control panel.
• You checked the renewal price, not the first-year price.
• Auto-renew is on and the card on file is current.
• If a move is coming, the TTL is already down to 300 seconds.
• Something automated renews your certificate, and you know what it is.