Verifying the seller

Start with the registration record

Look the name up in WHOIS and, where available, RDAP. RDAP is the newer protocol, returns structured data and is served by the registry and the registrar rather than by a third party website, which makes it the better source when the two disagree.

Most contact data is redacted for privacy, so the useful fields are the ones that survive:

• Sponsoring registrar. Should match whatever registrar the seller names.
• Creation date and last updated date. A record updated last week is worth asking about.
• Expiry date. Should match what the seller states in the agreement.
• Status codes. clientTransferProhibited is normal. serverTransferProhibited, pendingDelete, redemptionPeriod or a registry hold are not, and are covered in registrar locks and waiting periods.
• Nameservers. These are the anchor for the control check that follows.

Where the registrant is published, as it is for some organisations and some country code extensions, compare it against the party named in the agreement. Where it is redacted, absence of a name proves nothing either way.

Ask for a live proof of control

The registration record shows what is registered. It does not show who can log in. The gap between those two things is where most fake seller cases live.

Ask for one of these, chosen by the buyer rather than offered by the seller:

1. A DNS record. The buyer supplies a random string. The seller publishes it as a TXT record on the domain and confirms when it is live. The buyer queries the domain directly and sees the string. Only someone with control of the zone can do this.
2. A file on the website. The buyer supplies a filename and contents. The seller places it at the root of the site and the buyer retrieves it over the open web. This works only where the name already resolves to a server the seller controls.
3. A nameserver change. The seller points the name at nameservers the buyer specifies, or at a marketplace parking service, and the change appears in a public lookup. This is the strongest of the three because it moves the whole delegation.

Set a short deadline, an hour or two, and treat delay as information. A holder with control does this immediately.

A screenshot of a registrar control panel proves nothing. Images are trivial to fake and reveal nothing that a public lookup does not already show.

Check the person against the payment

A seller can be genuine and the payment instruction still be wrong, because email interception targets exactly this moment. Two rules cover it.

First, the account receiving the money must be in the name of the party in the agreement. A private individual selling a name should be paid into an account bearing that individual name. A company should be paid into a company account. Payment to a third party, to a different country than expected, or to an account opened recently is a stop, not a hurdle.

Second, bank details are confirmed once, out of band. Call a number obtained independently, not the one in the email signature. Details that change mid deal are treated as fraud until proven otherwise, however plausible the explanation. The pattern is set out in spotting payment fraud.

Check the seller against the history

A short background pass costs minutes and occasionally saves a deal.

Look at archived versions of the site to see how long the name has been used and by whom. Search the name together with words such as dispute or arbitration to catch a domain that has been through a proceeding. Search for the seller's name and email address to see whether the same address appears attached to other identities.

For company sellers, check the registration number in the national company register. A number that does not resolve, or resolves to a company dissolved years ago, ends the conversation.

Verifying an intermediary

Where a broker, an agent or an employee is acting, the checks extend one step. Ask who the registrant is and get written confirmation from that party that the intermediary is authorised to sell. An employee selling a company asset without authority creates a transfer that can be reversed later, even after payment.

Marketplaces reduce this risk because the listing generally requires proof of control before the name is published, typically by pointing the nameservers at the platform. That is proof of control rather than proof of title, which is why the payment sequence still matters and why escrow remains the right default for anything beyond a trivial purchase.

What verification cannot tell

None of these checks establish that the name is free of a trademark problem, that no dispute is pending, or that the seller has not already promised the name to someone else. Those risks are handled in the agreement through warranties rather than through lookups, and the buyer keeps the record of what was represented at the time.