A registrar and an authoritative DNS operator solve different problems. The registrar manages the domain's registration relationship and typically the controls used to change its delegation. The authoritative operator serves the records that mail systems query. Knowing which company appears in registration data does not identify every person who can edit the zone.
Ask the right ownership question
References: RFC 1034 §4.2, RFC 4034 §5.
For a registration renewal or transfer, identify the registrar and the organization's authorized account owner. For a TXT change, identify the active authoritative zone and its editing account. For a DNSSEC outage, both parties may be needed because parent DS management and child signing can sit in different systems.
An organization may use bundled registration and DNS, a reseller, custom nameservers or a separate managed DNS service. Even when RDAP lists one registrar and DNS names suggest another provider, neither observation establishes contractual responsibility or access permissions by itself.
Read RDAP as scoped evidence
References: RFC 9083 §4.2, RFC 9083 §4.3, RFC 9083 §4.5, RFC 9083 §5.1, RFC 9083 §5.3, RFC 9083 §9.
RDAP provides structured registration information. RFC 9083 defines response elements such as domain names, entities, roles, events, nameservers, links, notices and remarks. Privacy redaction or limited disclosure can mean that an absent public contact says nothing about whether a private accountable owner exists.
Record the lookup endpoint, final URL, UTC time, response status and relevant fields. Preserve notices and remarks that qualify the response. Events should be interpreted by their eventAction rather than treating every timestamp as registration or expiration. An entity's stated role is evidence of the returned registration role, not proof that it controls the email tenant or DNS editor.
Compare registration and operational paths
References: RFC 1034 §4.2, RFC 9083 §5.3.
Take a time-stamped RDAP domain response through the registry's documented service or a verified lookup tool. Separately trace DNS delegation and query the current authorities for NS, SOA and the required mail record. Put the observations side by side: registrar reported, nameservers reported by RDAP, nameservers actually referred by DNS, and organization account owner confirmed internally.
A synthetic example has registrar R in RDAP, nameservers under operator D in the DNS referral and mailboxes at provider M. The correct action is to publish authentication DNS through the verified D account, obtain mail-specific values from M and use R for registration or parent-delegation changes when applicable. The example does not establish that any real company's service follows that arrangement.
Annotate what remains unknown
A complete evidence sheet marks redacted fields, missing contact attribution, possible reseller relationships and the difference between observation and verified account access. A public example-domain RDAP response is retained below; obtaining the response and internal account evidence for the actual deployment domain remains a separate task.
Keep routine DNS edits separate from registrar transfer, ownership changes and security-sensitive account changes. A request to diagnose a record does not require moving the domain. Escalate to the correct internal owner with the exact record and required action, then verify the resulting authoritative data and mail behavior. Retain the role map so the next incident does not start with the same ownership guess.
Retained public RDAP observation
The retained capture from 7 November 2026, inspected but not repeated for this review, records that a real HTTPS request to the Verisign .com RDAP domain endpoint for example.com returned HTTP 200 on the timestamp retained in the evidence register. The full JSON includes domain, entity, event, nameserver, secureDNS and notice fields. This is the reserved example domain, not a user-owned domain. The annotations explicitly separate registration roles from DNS-editor access, retain the server's disclosure notices and mark the need to compare returned nameservers with actual DNS referrals. No inference of user ownership, registrar login access or mail-provider identity is made from this response.
Keep the evidence scope explicit
The archived HTTP capture identifies the historical endpoint, status and UTC time, and the unmodified response is retained. Its registration metadata does not verify current DNS operation, contractual authority or account access. Obtain current authorized evidence before a real change.