Root domains: what they are, how the root zone works, and what TLDs have to do with it

The first meaning applies in hosting, Content Management Systems, and SEO tools. The second applies in technical DNS contexts. This guide covers both, explains how the DNS root zone works, and shows where TLDs fit in.

What is a root domain?

The term "root domain" carries two distinct meanings depending on context, which can cause confusion when switching between CMS, SEO tools, and DNS documentation.

In SEO, hosting, and backlink analysis, a root domain is the apex or bare domain - the registered domain name without any subdomain prefix. When you own example.com, that is your root domain. Adding "www" or "blog" in front creates a subdomain, not a new registration.

In DNS technical documentation, the root domain refers to the very top of the domain name system hierarchy. It is represented by a single trailing dot (.) - the invisible period at the end of every fully qualified domain name. Every domain name you type into a browser ultimately resolves through this root.

The table below clarifies the key terms across both contexts.

How the DNS hierarchy works: from root to subdomain

The domain name system organizes every address on the internet into a strict hierarchy. At the very top sits the root zone, represented by a single trailing dot. Below it come the top-level domains - .com, .org, .io, and more than 1,500 others. Below TLDs sit second-level domains, which are the names you register through a registrar. Subdomains can then be added beneath those.

Tracing a fully qualified domain name like blog.example.com from left to right reveals the structure: "blog" is the subdomain, "example" is the second-level domain, ".com" is the TLD, and the trailing dot (often omitted in browsers) represents the root.

The root zone holds authoritative records that delegate each TLD to its respective registry. IANA maintains these records, and ICANN oversees the overall system. When a new TLD is approved and added to the root zone, it becomes reachable globally through this delegation mechanism.

What is the root zone and who manages it?

The root zone is the DNS database that sits at the top of the domain name system hierarchy. It contains name server records for every delegated top-level domain, specifying which authoritative name servers handle queries for that TLD.

The Internet Assigned Numbers Authority maintains the root zone file, which is updated whenever TLDs are added, changed, or removed. ICANN oversees the broader process and coordinates policy decisions around delegation.

The root zone started with roughly 22 generic TLDs - .com, .net, .org, and a small set of country-code extensions. The ICANN new gTLD program, launched in 2012, dramatically expanded the root zone. Today, more than 1,500 TLDs are delegated in the root zone, including new generics like .photography and .store alongside country-code extensions for nearly every nation.

What are root servers and how do DNS queries work?

Root servers are the authoritative name servers for the root zone. There are 13 root server clusters, labeled A through M, operated by different organizations including ICANN, Verisign, and others. Thanks to Anycast routing, hundreds of physical servers worldwide share these 13 IP address clusters, so no single root server represents a single point of failure.

1. Your browser sends the request to a local DNS resolver (typically provided by your internet service provider or a public resolver).
2. The resolver checks its cache. If it has a recent answer, it returns the IP address immediately.
3. If the result is not cached, the resolver queries a root server. The root server does not know the final IP address - it returns the authoritative name servers for the relevant TLD.
4. The resolver queries that TLD name server, which returns the authoritative name servers for the specific second-level domain.
5. The resolver queries that authoritative server, which returns the IP address.
6. The IP address is passed back to your browser and the page loads.

DNSSEC and root zone security

DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records, protecting users from attacks such as cache poisoning. The root zone is signed using a key-signing key (KSK) maintained by IANA, anchoring the chain of trust that extends downward through TLDs to individual domain registrations.

Root domains and domain registration: what to know

Registering a domain name means claiming a second-level domain under a TLD that is already delegated in the root zone. The TLD you choose determines the registry that manages it, and each registry sets the wholesale price for registration and renewal. Registrars apply their own pricing on top of that, which is why the same domain name can cost significantly different amounts depending on where you buy it.

TLD-list tracks registration and renewal prices across more than 100 registrars, covering every TLD in the root zone.

Root domain questions answered

About the Author:

TLD-list

Editor team

Small crew of builders who believe a great idea should not be held back by a bad domain deal. We know this space inside out, from obscure new extensions to the registrar tricks that quietly inflate your renewal. We put that knowledge to work so you can spend less time worrying about domains and more time building the thing that matters.