Domains, DNS and SSL: the setup chain explained
Before any hosting works, three pieces have to click together: the name that is rented, the records that point it, and the certificate that secures it. The chain, link by link.
Almost every site-is-down emergency lives in one of three places: the domain, the DNS or the certificate. Hosting gets the attention, but the chain in front of it decides whether visitors ever arrive. It has three links, each simple once seen clearly.
Link one: the domain, rented and never owned
A domain is an annual rental in the internet's namespace, controlled entirely by whoever holds the registrar account. Three rules cover most domain trouble: it is registered under the owner's own login, never held by an agency or a host for convenience; that account is secured like a bank login; and the renewal never lapses, because expired domains of living projects are bought by squatters within hours. The domain is independent of hosting on purpose: it is the constant that makes every host replaceable.
Link two: DNS, where the pointing happens
DNS translates the name into destinations, record by record: A and AAAA records aim the website at a server, a CNAME makes a subdomain track a platform's address, MX routes the domain's email (fully independent of the website, which is the fact that saves migrations), TXT carries verification proofs. Two operational truths: caching means changes take effect gradually, with the TTL as the control dial, and the NS records decide which provider's panel is live, a fact best known before it is needed urgently.
Link three: TLS, the padlock, automated
TLS encrypts traffic and proves that the server speaks for the domain. It is mandatory now: browsers flag plain HTTP, and modern web features require HTTPS. This link has automated itself. Let's Encrypt issues certificates free, and any host worth using provisions and renews them silently. The owner's only job is to notice when the automation breaks: an expiry warning means the machinery needs attention, not that anything has to be bought.
The chain in motion
- Register the domain at a reputable registrar, in the owner's own account, with auto-renew on.
- Point its DNS at the hosting, either by A and CNAME records (DNS control stays at the registrar) or by switching nameservers to the host (the panel moves there). Either works; which one was done is worth remembering.
- Let the host issue the TLS certificate for the domain and its www variant, then confirm the padlock on both.
- Email, where the domain is used for it, is its own decision: MX records can point anywhere, independent of the website.
The one mistake that outranks all others
Losing control of the domain: a lapsed renewal, a lost registrar login, or a third party who registered it on the owner's behalf. Websites are rebuildable; the address, and the email that hangs off it, are what a business loses. Own account, two-factor authentication on, renewal paid.
Quick answers
Should the domain be bought from the hosting provider?
It is convenient and usually fine; the rule that matters is that the registrar account is the owner's, whoever runs it. Many prefer a separate registrar so that hosting changes never touch the domain at all. That separation is cheap insurance, not a requirement.
Why does a site work without www but not with it, or the reverse?
The two are separate DNS names and both need records, plus a TLS certificate covering both, plus a redirect choosing one as canonical. When one variant fails, one of those three pieces is missing for it. Any decent host sets all of this up, and checking both variants after every setup takes two minutes.
Does an SSL certificate cost money?
For domain validation, the padlock, no: automated free certificates are the industry default and cryptographically identical to paid ones. Paid products add organisation validation and warranties, relevant mainly where displaying a verified legal identity matters. A host that charges extra for basic TLS is telling the customer something about the host.
Last reviewed 26 September 2026 · Getting Digital