Home / Domora / Domora Specification
Domora
The Open Market for Internet Names
Overview
Domora is an open-source domain registrar and marketplace designed to make domain registration, management, ownership, and trading more transparent, secure, and accessible. The platform aims to provide an alternative to traditional domain registrars by prioritizing user control, privacy, transparent pricing, and freedom from deceptive sales practices.
Domora follows a modular design that separates essential domain registration and management capabilities from optional marketplace services, payment integrations, managed DNS, automation, and advanced infrastructure. The platform is intended to serve individuals, businesses, developers, hosting providers, resellers, and organizations seeking greater control over their domain portfolios.
Domora will integrate with existing domain registries and established internet naming standards. Direct registration services will depend on applicable registrar accreditation, registry agreements, technical integrations, and operational requirements. The platform will support self-hosted deployments and managed service offerings, subject to the capabilities and configuration of each deployment.
Core Modules
Domain Registration and Availability
- Provide domain name searches across supported top-level domains.
- Check domain availability through supported registry or registrar integrations.
- Display registration, renewal, transfer, restoration, and applicable registry fees before checkout.
- Identify premium-priced, reserved, restricted, and unavailable domains.
- Support individual and bulk domain registration requests.
- Validate domain syntax, character restrictions, and applicable registration requirements.
- Support internationalized domain names where supported.
- Display available registration periods and extension-specific requirements.
- Recheck availability before submitting registration requests.
- Prevent duplicate submissions and handle conflicting registration attempts safely.
- Provide clear explanations of registration failures and registry responses.
- Maintain a history of domain searches and registration attempts.
- Present consistent registration workflows across supported extensions.
- Clearly disclose extensions and services that are not available through a deployment.
Domain Portfolio Management
- Provide a centralized dashboard for managing domain portfolios.
- Display domain status, expiration dates, renewal settings, nameservers, and registration details.
- Organize domains using folders, labels, collections, and custom groups.
- Support bulk domain management operations.
- Provide search, filtering, and sorting capabilities.
- Allow users to maintain internal notes and domain metadata.
- Display domain lifecycle events and management history.
- Support multiple portfolios for individuals, businesses, and organizations.
- Provide domain portfolio imports and exports in documented formats.
- Identify expiring domains, incomplete configurations, and potential management issues.
- Support configurable portfolio notifications.
- Provide a responsive and accessible domain management experience.
- Maintain clear records of domain ownership information and authorized management access.
Domain Lifecycle Management
- Manage domain registration, renewal, expiration, restoration, and transfer workflows.
- Support inbound and outbound transfers where permitted.
- Track transfer status and authorization requirements.
- Manage registrar locks and supported transfer protections.
- Provide automatic and manual renewal settings.
- Allow renewal preferences to be configured independently for each domain.
- Provide configurable expiration reminders.
- Display applicable grace periods, redemption periods, and pending deletion status.
- Explain extension-specific renewal and recovery policies.
- Notify users of failed renewals, payment problems, and registry-side errors.
- Provide recovery workflows for eligible expired domains.
- Maintain a history of lifecycle events and completed operations.
- Prevent unauthorized transfers and unintended changes through configurable security controls.
- Clearly distinguish registry-enforced restrictions from Domora-managed settings.
DNS Management
- Manage DNS records through supported DNS providers.
- Support common record types, including A, AAAA, CNAME, MX, TXT, NS, SRV, and CAA.
- Support configurable time-to-live values.
- Validate DNS record syntax and identify common configuration errors.
- Provide DNS templates for websites, email, APIs, and other common services.
- Support bulk record changes and DNS zone imports and exports.
- Provide nameserver configuration and delegation status.
- Offer DNS propagation checks and diagnostic tools.
- Support DNSSEC configuration and key management through compatible services.
- Detect conflicting records and common DNS misconfigurations.
- Maintain configuration history and support restoration of previous zone configurations.
- Provide previews and confirmation steps for significant DNS changes.
- Support multiple DNS providers through a consistent management interface.
- Provide API access to supported DNS operations.
- Clearly distinguish domain registration from optional DNS hosting services.
Account Management and Authentication
- Support individual, business, and organizational accounts.
- Provide secure registration, authentication, logout, and account recovery.
- Support multifactor authentication, passkeys, and WebAuthn.
- Support hardware security keys where compatible.
- Allow users to review and revoke active sessions.
- Provide trusted-device management and suspicious-login notifications.
- Support account profile and contact management.
- Separate authentication credentials from domain registrant contact information.
- Provide account-level security settings.
- Require additional verification for sensitive account changes where appropriate.
- Support secure account recovery procedures.
- Provide account data export and account closure workflows.
- Maintain audit records for relevant authentication and security events.
Registrant Contact Management
- Manage registrant, administrative, technical, and billing contact information where required.
- Support reusable contact profiles across eligible domains.
- Allow domain-specific contact assignments.
- Validate contact information against applicable registry requirements.
- Provide contact verification workflows.
- Display which registration details may be publicly available.
- Minimize the collection and retention of unnecessary personal information.
- Protect sensitive contact data through encryption and access controls.
- Maintain a history of relevant contact changes.
- Support organization-specific contact management and delegated permissions.
- Explain when accurate, verifiable registrant information is required.
- Support applicable privacy, disclosure, and data retention obligations.
Transparent Pricing and Billing
- Display itemized registration, renewal, transfer, restoration, and service fees.
- Show the complete payable amount before purchase confirmation.
- Distinguish registry charges, service fees, taxes, and optional services.
- Display renewal pricing and recurring billing terms clearly.
- Avoid preselected paid add-ons and deceptive checkout practices.
- Provide clear controls for automatic renewals.
- Disclose currency conversion costs and payment processing fees where applicable.
- Provide invoices, receipts, and transaction histories.
- Support billing profiles for individuals and organizations.
- Provide payment failure notifications and recovery workflows.
- Support account credits and eligible refunds according to applicable policies.
- Provide spending summaries and renewal cost forecasts.
- Support downloadable billing records for accounting purposes.
- Maintain accurate records of payment authorization and transaction status.
- Clearly disclose changes to pricing and service terms.
Notifications and Alerts
- Notify users of registration confirmations, transfers, and renewals.
- Provide configurable domain expiration reminders.
- Alert users to failed payments and renewal problems.
- Notify users of important DNS and DNSSEC configuration changes.
- Provide security alerts for suspicious logins and sensitive account changes.
- Support marketplace notifications when the relevant module is enabled.
- Provide an in-platform notification center.
- Support email and other configured notification channels.
- Allow users to customize notification categories and delivery frequency.
- Track notification delivery status where supported.
- Prevent duplicate notifications and unnecessary messaging.
- Keep critical security notifications separate from optional promotional communications.
Audit Logs and Activity History
- Record significant account, domain, DNS, billing, and administrative actions.
- Associate events with authorized users, service identities, or automated processes.
- Record timestamps, affected resources, and operation outcomes.
- Provide searchable account-level and domain-level activity histories.
- Distinguish actions initiated by users, administrators, APIs, and automated processes.
- Record authorization decisions for sensitive operations.
- Support tamper-evident audit records where configured.
- Restrict audit access according to roles and organizational policies.
- Support configurable retention policies.
- Provide audit exports for security investigations and compliance reviews.
- Avoid storing passwords, authentication secrets, and unnecessary sensitive information in logs.
Administrative Management
- Provide administrative oversight of supported registrar operations.
- Manage users, organizations, permissions, and service configurations.
- Monitor registrations, transfers, renewals, and failed operations.
- Manage registry connections and supported extension configurations.
- Monitor integration health, background jobs, and service availability.
- Provide controlled intervention workflows for operational failures.
- Require strong authentication for privileged accounts.
- Record administrative actions in protected audit logs.
- Separate routine support permissions from privileged operational permissions.
- Support approval requirements for sensitive administrative operations.
- Provide incident management and service status reporting.
- Support documented procedures for compromised accounts and abusive activity.
- Maintain clear records of administrative interventions and their authorization.
API and Developer Access
- Provide documented APIs for supported registration, portfolio, DNS, and account operations.
- Support scoped API tokens and granular permissions.
- Allow token expiration, rotation, and revocation.
- Provide webhooks for supported domain and transaction events.
- Publish versioned API documentation.
- Apply request validation, rate limiting, and abuse prevention.
- Support idempotency for eligible registration and payment operations.
- Provide consistent error responses and diagnostic identifiers.
- Support machine-readable data imports and exports.
- Provide sandbox environments where supported.
- Maintain API usage logs and operational monitoring.
- Support service accounts for authorized automation.
- Document integration requirements and compatibility expectations.
- Establish clear API versioning and deprecation policies.
Registry Integration Framework
- Provide a modular gateway for supported domain registry connections.
- Support the Extensible Provisioning Protocol where required by registry operators.
- Isolate registry-specific behavior behind documented integration adapters.
- Support secure registry authentication and transport.
- Manage registry sessions and connection lifecycle.
- Normalize registry responses into consistent internal results.
- Support safe retries for eligible temporary failures.
- Reconcile uncertain operation outcomes before repeating registry commands.
- Track command status and asynchronous responses.
- Enforce registry-specific policies and validation requirements.
- Provide connection health checks and diagnostics.
- Support test environments when provided by registry operators.
- Protect registry credentials through secure secret management.
- Allow additional registry integrations without requiring unrelated core modules to be redesigned.
RDAP and Registration Data Services
- Support domain registration data lookups through compatible RDAP services.
- Display available registration, registrar, status, and nameserver information.
- Respect access controls, rate limits, and privacy restrictions.
- Distinguish authoritative registration information from cached results.
- Provide clear explanations of domain status codes.
- Support privacy-aware response filtering.
- Integrate with supported registry and registrar data sources.
- Provide standardized error handling and lookup diagnostics.
- Support required registration data disclosure workflows.
- Protect lookup services against abuse and excessive requests.
Security and Access Control
- Apply least-privilege access and role-based authorization.
- Encrypt sensitive information in transit and at rest.
- Protect registry credentials, API tokens, and cryptographic keys.
- Support strong authentication and secure account recovery.
- Require explicit authorization for sensitive domain operations.
- Provide additional verification for high-risk changes.
- Support configurable approval workflows for organizations.
- Maintain security audit records.
- Provide session management and credential revocation.
- Support security monitoring and suspicious activity detection.
- Protect against unauthorized transfers and domain account takeover.
- Provide documented vulnerability reporting and remediation procedures.
- Support secure backups and recovery testing.
- Document security limitations, trust boundaries, and external dependencies.
Open Source Governance
- Publish source code under a clearly identified open-source license.
- Provide contribution guidelines and public issue tracking.
- Maintain a transparent development roadmap and release history.
- Document architecture, operational behavior, and security policies.
- Encourage independent code reviews and security assessments.
- Publish security advisories and relevant incident disclosures.
- Support community discussions and documented design decisions.
- Provide reproducible build and release processes where practical.
- Distinguish community-developed software from separately operated services.
- Support self-hosting without mandatory dependence on a proprietary control plane.
- Provide documented migration and data export procedures.
- Encourage portable data formats and standards-based integrations.
- Maintain clear project governance and contributor acknowledgment practices.
Optional Plugin Modules
Domain Marketplace
- Allow domain owners to list eligible domains for sale.
- Support fixed-price listings and auctions.
- Provide domain discovery and marketplace search.
- Allow sellers to define asking prices, listing terms, and listing duration.
- Support buyer inquiries, offers, and seller communications.
- Display listing status and transaction history.
- Provide configurable listing fees with transparent disclosures.
- Offer domain valuation estimates with clear explanations of their limitations.
- Support portfolio listings for users managing multiple domains.
- Provide marketplace analytics for participating sellers.
- Support listing withdrawal and offer management.
- Provide reporting and moderation workflows for suspicious listings.
- Support domain transfer workflows for completed sales.
- Integrate with optional escrow and payment services.
- Clearly distinguish marketplace listings from verified ownership guarantees.
Escrow and Transaction Protection
- Integrate with qualified third-party escrow providers.
- Track payment, transfer, verification, and release milestones.
- Define clear transaction conditions and authorized actions.
- Notify buyers and sellers when action is required.
- Support eligible cancellations and refunds.
- Maintain records of transaction events and relevant evidence.
- Provide dispute reporting and resolution workflows.
- Disclose escrow fees and provider limitations.
- Verify supported transfer milestones before signaling that transaction conditions have been met.
- Avoid representing software-managed payment workflows as regulated escrow without an appropriately authorized provider.
Payment Provider Integrations
- Integrate with supported card processors and payment service providers.
- Support bank payment methods where available.
- Support multiple currencies and localized pricing displays.
- Provide payment authorization, capture, refund, and reconciliation workflows where supported.
- Support recurring billing through authorized payment providers.
- Offer optional cryptocurrency payment integrations.
- Support selected cryptocurrencies and stablecoins through compatible providers.
- Disclose exchange rates, conversion fees, settlement terms, and payment limitations.
- Provide transaction identifiers and reconciliation records.
- Apply appropriate fraud prevention and risk controls.
- Support payment-provider failover where practical.
- Keep sensitive payment credentials within appropriately protected payment systems.
- Apply relevant tax, sanctions, consumer protection, and financial compliance requirements.
Domain Privacy Services
- Support privacy services where permitted by applicable registries and jurisdictions.
- Replace publicly displayed contact details with eligible proxy or redaction services.
- Provide domain-specific privacy status indicators.
- Support encrypted storage of sensitive personal information.
- Apply data minimization and field-level access controls.
- Support appropriate data retention and deletion policies.
- Provide privacy-aware logging and analytics.
- Support encrypted backups and cryptographic key rotation.
- Restrict access to sensitive registrant information.
- Document circumstances in which disclosure is legally required.
- Provide privacy request and data access workflows.
- Separate public registration data from private account records.
- Clearly explain that privacy services do not eliminate legal registration or disclosure obligations.
Advanced Cryptographic Security
- Support integrations with hardware security modules and key management systems.
- Provide secure key rotation, revocation, and access policies.
- Support separation of duties for sensitive cryptographic operations.
- Protect registry credentials and service secrets.
- Support integrity verification for selected audit records.
- Provide cryptographic verification for supported exported records.
- Document trust boundaries and recovery procedures.
- Support DNSSEC key management through compatible services.
- Protect against replay attacks and unauthorized privileged operations.
- Support optional self-managed keys where compatible with service requirements.
- Document where encryption is end-to-end and where trusted services must access plaintext data.
- Avoid claiming zero-knowledge operation for workflows that require plaintext access to perform authorized operations.
Managed DNS and Global DNS Distribution
- Provide optional authoritative DNS hosting.
- Support redundant nameservers and distributed deployments.
- Support anycast DNS through compatible network infrastructure.
- Integrate with external DNS providers.
- Support DNS zone replication and configuration synchronization.
- Provide DNSSEC signing and key rollover where configured.
- Monitor authoritative DNS availability and response performance.
- Support DNS health checks and failover integrations.
- Provide service health alerts and operational reporting.
- Support DNS zone migration and portability.
- Offer configurable query logging with privacy protections.
- Clearly distinguish registration services from optional DNS hosting.
Reseller and White-Label Services
- Allow approved resellers to manage customer domain portfolios.
- Provide reseller-specific pricing and service configurations.
- Support branded customer portals and white-label interfaces.
- Maintain customer-level data and permission separation.
- Support delegated billing and domain management.
- Provide reseller APIs and webhooks.
- Offer consolidated portfolio and renewal reporting.
- Support configurable service plans and transparent fees.
- Maintain ownership and authorization records.
- Support customer data export and migration.
- Provide reseller operational reports and integration monitoring.
- Enforce applicable registry, accreditation, privacy, and contractual requirements.
Organization and Team Management
- Support organizations with multiple users and domain portfolios.
- Provide role-based access control and configurable permissions.
- Allow delegation of DNS, billing, registration, and marketplace responsibilities.
- Support approval workflows for sensitive actions.
- Provide organization-level authentication and security policies.
- Maintain records of invitations, role changes, and access revocations.
- Separate financial, operational, and security responsibilities.
- Support team notifications and activity reports.
- Provide organization-level data exports.
- Prevent unauthorized privilege escalation.
- Support controlled access removal when a team member leaves an organization.
Domain Portfolio Analytics
- Calculate current and projected renewal costs.
- Identify domains approaching expiration.
- Track registration, renewal, and marketplace spending.
- Summarize domains by extension, status, and organization.
- Identify unused domains and incomplete DNS configurations.
- Provide configurable reports and data exports.
- Track listing performance for marketplace sellers.
- Display historical portfolio changes.
- Offer optional domain valuation estimates with transparent limitations.
- Support scheduled portfolio summaries.
- Identify potentially redundant services and avoidable renewal expenses.
- Keep analytics optional and minimize unnecessary personal data collection.
Automation and Policy Engine
- Automate eligible renewals, notifications, DNS updates, and portfolio maintenance.
- Provide configurable rules based on domain status, dates, and approved events.
- Support scheduled and event-driven workflows.
- Require explicit authorization for sensitive actions.
- Provide dry-run previews for bulk and automated operations.
- Support approval requirements for transfers, ownership changes, and high-impact DNS modifications.
- Enforce configurable spending limits and operation-specific policies.
- Provide execution logs and failure notifications.
- Support safe retries and recovery from interrupted workflows.
- Allow users to pause or disable automations.
- Prevent automation from silently changing user-defined authorization policies.
- Provide human review for exceptional or high-risk operations.
Abuse Prevention and Trust Services
- Provide abuse reporting and case management.
- Support investigation workflows for phishing, malware, spam, and other domain-related abuse.
- Track reports, evidence, decisions, and relevant correspondence.
- Support registry and legally authorized requests through documented procedures.
- Apply proportionate risk controls to suspicious registrations and marketplace activity.
- Detect unusual account behavior and potential domain theft.
- Provide review and appeal workflows where applicable.
- Maintain records of enforcement actions and authorized disclosures.
- Avoid unsupported automated accusations.
- Support applicable registrar abuse-handling obligations.
- Provide public guidance for reporting abuse and securing domain accounts.
Dispute Resolution and Recovery
- Provide structured workflows for domain access and ownership disputes.
- Support account recovery with documented verification procedures.
- Track disputed transfers and unauthorized account changes.
- Provide workflows for investigating suspicious ownership changes.
- Preserve relevant audit records during investigations.
- Support applicable registry dispute procedures and external dispute mechanisms.
- Provide status updates to authorized parties.
- Restrict access to sensitive case information.
- Document the limitations of registrar-level intervention.
- Avoid presenting Domora as a legal authority over domain ownership disputes.
Internationalization and Accessibility
- Support multiple interface languages.
- Support internationalized domain names and appropriate Unicode handling.
- Provide localized currency and date formatting.
- Support keyboard navigation and accessible interface controls.
- Follow recognized web accessibility standards.
- Provide accessible form labels, error messages, and status announcements.
- Support responsive layouts across device sizes.
- Provide clear pricing and renewal disclosures.
- Support region-specific policy notices where required.
- Document limitations affecting language-specific domain registration.
Observability and Service Reliability
- Provide application health checks and service monitoring.
- Track registration, renewal, transfer, DNS, and payment workflow failures.
- Support structured logging, metrics, and operational dashboards.
- Monitor registry connections and external service dependencies.
- Support distributed tracing across critical workflows.
- Provide backup, restoration, and disaster recovery procedures.
- Support service health reporting and incident communication.
- Define configurable availability and recovery objectives.
- Protect monitoring data against unauthorized access.
- Support graceful degradation when optional integrations are unavailable.
- Prevent temporary provider failures from causing duplicate registrations or charges.
Backup, Portability, and Migration
- Provide encrypted backups of supported application data.
- Support tested restoration procedures.
- Export domain portfolios, DNS zones, contact records, invoices, and audit histories where applicable.
- Support standard data formats and documented APIs.
- Provide migration tools for supported registrar and DNS providers.
- Support bulk imports with validation and previews.
- Identify records that cannot be migrated automatically.
- Preserve ownership and authorization boundaries during migration.
- Provide configuration backups and version history.
- Support self-hosted deployments with documented backup procedures.
- Minimize dependence on proprietary data formats.
- Provide documented migration and service exit procedures.
Compliance and Operational Policies
- Support workflows for applicable ICANN and registry requirements.
- Provide configurable data retention and disclosure policies.
- Support required registration verification and contact validation.
- Provide abuse handling, complaint tracking, and relevant reporting workflows.
- Support applicable privacy and consumer protection obligations.
- Maintain records required for billing, disputes, and operational audits.
- Provide controls for access to sensitive registration data.
- Support registrar data escrow integrations where required.
- Document operational responsibilities for each deployment model.
- Distinguish software capabilities from obligations that apply to an accredited registrar.
- Support configurable policies without overriding mandatory registry rules.
- Provide evidence exports for compliance reviews.
Architectural Principles
- Modular architecture with clear boundaries between core functionality and optional services.
- Open-source development and publicly reviewable code.
- Standards-based interoperability wherever practical.
- Privacy by design and data minimization.
- Transparent pricing and informed user consent.
- Least-privilege authorization and secure defaults.
- Explicit approval for sensitive operations.
- Auditable administrative and automated actions.
- Safe retries and reconciliation for external registry operations.
- Vendor neutrality and data portability.
- Separation of payment processing from core domain management.
- Optional integrations that can be disabled without compromising unrelated core functionality.
- Clear disclosure of limitations, dependencies, and operational requirements.
- Human oversight for exceptional security, ownership, and dispute decisions.
- Documented backup, recovery, and incident response procedures.
- No hidden paid add-ons or manipulative checkout practices.
Licensing and Attribution
Domora is released under the GNU Affero General Public License v3.0 or later (AGPL-3.0+).
Redistributions, forks, and derivative works must comply with the applicable license terms and preserve the attribution requirements described in the project’s notice.md file. Network-deployed versions must comply with the AGPL-3.0+ source code requirements where applicable.
The project supports community collaboration, independent review, and self-hosted deployments. Optional commercial services and hosted offerings must respect the applicable open-source license and clearly disclose any separate service terms.
Specification Branding License (SBL)
Standard
- Fully AGPL-3.0+ compliant system.
- Copyleft enforced for network deployments.
- Required attribution:
- Roxanne Ardary
- https://www.roxanneardary.com/
Optional
- Specification Branding License (SBL)
- Attribution-free commercial deployment.
- Pricing based on scale, usage, and deployment scope.
- https://roxanneardary.com/domora/
License & Notice Requirements
Domora is released under the GNU Affero General Public License v3.0 or later (AGPL-3.0+).
By contributing to any Open Arsenal project, you agree that your contributions will also be released under this license.
Please note the following:
- All contributions must comply with the AGPL-3.0+ terms.
- Under Section 7 of the license, all redistributions, forks, and derivative works must preserve attribution to Roxanne Ardary and roxanneardary.com.
- Domora specifications are free to use with attribution. A Specification Branding License can be negotiated upon request.
- The project’s notice.md file tracks attribution requirements and contributor acknowledgments. Any update that adds new contributors or modifies attribution should also update
notice.md. - When submitting a pull request, ensure that any new files maintain the attribution headers where applicable.
- Network-deployed versions of this software must also remain fully AGPL-3.0+ compliant, including exposure of source code modifications when applicable under the license.
For full legal details, please refer to the AGPL-3.0+ license and the project’s notice.md file.
Notice – Domora
Attribution Requirement: Under Section 7 of the AGPL 3.0+ license, all redistributions, forks, and derivative works, including network-deployed versions of this project, must provide attribution to Roxanne Ardary and roxanneardary.com.
Contributors
This file tracks contributors and their specific contributions to the project.
- Roxanne Ardary, roxanneardary.com – October 25, 2026
Created the repository for Domora. Developed the project concept and specification for an open-source domain registrar and marketplace focused on transparent pricing, privacy, secure domain management, and domain trading. - [Add other contributors here] – [Date]
[Describe contribution in one sentence]
License – Domora
This repository is licensed under the GNU Affero General Public License v3.0 or later (AGPL-3.0+).
Key Points:
- You are free to use, modify, and distribute the code.
- All redistributions, forks, and derivative works or network-deployed versions must also be licensed under AGPL-3.0+ and provide attribution to Roxanne Ardary and roxanneardary.com as required under Section 7 of the license.
- The software is provided “as is,” without warranty of any kind.
For the full license text, see GNU AGPL-3.0 License .



