ds

.za.org

Generic top-level domain — names are registered at the third level, under .org

WHOISPeople & Community

Register
—first year
Renew
—a year
Transfer
—to move it
Registrars
—quoting it
Lookup
WHOISanswers for it
DNSSEC
Signed1 DS record in the root
Level
Thirdmybrand.za.org

Check a name

One command, straight against the registry — no account, no page to load.

Fills the command and the registrar links below in with your own name. The page is static — nothing is looked up here, and nothing you type leaves the browser.

ds mybrand --tld za.org

Add --where for the registrars and the registry's rules, --registry for the server that answered, or --all-info for everything at once.

What it costs

No registrar in the price table bundled with ds quotes .za.org, so the CLI prints no figure beside it — one of 927 such TLDs. That is a gap in the table as often as it is a TLD nobody sells. See Prices for supplying your own table with --pricing-file.

Who can register

No eligibility rule is on file for .za.org, which is not the same as a promise that it is open: the list is hand-maintained and covers the restricted TLDs a registrar is likely to offer you. Check the registry's own page before counting on a name. 81 TLDs do carry a rule — see Who can register.

How ds answers for it

RDAP first, WHOIS second — the same order for every TLD. .za.org has no RDAP service, so the answer comes from WHOIS text on port 43.

WHOIS
http://www.za.net/cgi-bin/whois.cgi?domain=Queried over HTTP, from the bundled whois.json. The name is called free when the reply contains No such domain — text matching, which is why RDAP is preferred where it exists.

ds mybrand --tld za.org --registry prints whichever of these answered. If a bundled WHOIS host has gone stale, IANA is asked who serves .za.org today. See Accuracy notes.

The registry

From IANA's delegation record for .org — .za.org is a zone under it, so the registry, the servers and the dates below are .org's. .za.org is a generic TLD.

Run by
Public Interest Registry (PIR)Based in United States of America. ICANN records the contracted registry operator as Public Interest Registry. Delegated 1985-01-01, record last updated 2026-03-10.
Registry site
publicinterestregistry.orgWhere the registry documents .org — its rules, its accredited registrars, and any launch phases. Not a shop: registries sell wholesale to registrars, not to you.
Published services
rdap.publicinterestregistry.org · whois.publicinterestregistry.orgWhat the registry itself tells IANA it runs. Note: the bundled table asks http://www.za.net/cgi-bin/whois.cgi?domain= instead — one of them is out of date, and ds falls back to asking IANA when a bundled host goes stale.
Name servers
a0.org.afilias-nst.infoa2.org.afilias-nst.infob0.org.afilias-nst.orgb2.org.afilias-nst.orgc0.org.afilias-nst.infod0.org.afilias-nst.orgThe 6 authoritative servers for the .org zone — what the root delegates to. Nothing ds queries directly; they are what makes a registered name resolve.

What it is

Derived from the root zone and ICANN's registry list — each one is a fact with a source.

  • generic IANA Root Zone Database types it "generic"
  • legacy-gtld ICANN delegated it before 2013-10-23 — see delegated

What it is for

Our reading, not a fact — nothing in the root zone says what a TLD means. Hand-maintained in tld-categories.json.

  • People & Community Family, friends, charity, and the groups people belong to.

In the root zone

The delegation itself, read out of the root zone — serial 2026090900, on 2026-09-09. The registry section above is IANA's record of what .org was delegated to; this is what the root actually answers with when a resolver asks it where .org lives. .za.org is not in the root zone — nothing below the top level is. It resolves because .org does, on .org's servers.

Delegated to
  • a0.org.afilias-nst.info199.19.56.12001:500:e::1
  • a2.org.afilias-nst.info199.249.112.12001:500:40::1
  • b0.org.afilias-nst.org199.19.54.12001:500:c::1
  • b2.org.afilias-nst.org199.249.120.12001:500:48::1
  • c0.org.afilias-nst.info199.19.53.12001:500:b::1
  • d0.org.afilias-nst.org199.19.57.12001:500:f::1
The 6 name servers the root hands out for .org, with the glue addresses that come with them — every one of them answers over IPv6. None of this is what ds queries: these servers know which names exist, not who registered them.
DNSSEC
Signed — 1 DS record in the root
  • key 26974RSA/SHA-256 · SHA-2564FEDE294C53F438A158C41D39489CD78A86BEB0D8A0AEAFF14745C0D16E1DE32
Each one is a fingerprint of .org's own signing key, published by the root and signed with the root's key — which is how a resolver that trusts only one key can prove an answer under .za.org came from its registry and was not tampered with in transit. It says nothing about who owns a name or whether one is free.

Ask the root yourself — no registry involved, and the same records this section was built from: dig +norec @a.root-servers.net org. NS and dig +norec @a.root-servers.net org. DS.

Under .org

Also answered by http://www.za.net/cgi-bin/whois.cgi?domain=