# Build it yourself · Part 1

## Chapter 1: A domain of your own

> Markdown copy of https://kuuko.app/build/domain/ for agents; the HTML page is the source. Part 1 of Kuuko's guide to building the core yourself. Text: CC BY-SA 4.0 · Commands and configs: CC0.

*Checked: 30 October 2026*

---

### Why

Your devices will reach your resolver by a name, `dns.<your-domain>`. Encrypted DNS needs that name: it's what the certificate proves (chapter 5), and it's how your devices know they're talking to your server and nobody else. A name you own also stays yours if you change server or provider later.

### What you need

- A registrar: a company that sells domains. We use Spaceship; any registrar that offers two-factor login and a transfer lock will do.
- About 15 minutes (our estimate).

### Steps

1. **Pick a name and an ending you'll keep.** A short name is easier to type when you set up a device. The resolver will live on a subdomain of it, `dns.<your-domain>`, so the main name stays free for anything else.
2. **Check the renewal price before you buy.** Many registrars sell the first year cheaply and charge much more from the second year on. In May 2026, a .com renewed for about $10 at the cheapest registrars and $23 or more at some well-known ones.
3. **Buy the domain.**
4. **Turn on two-factor login** for your registrar account. Whoever controls this account controls your domain, and with it where your devices send their questions.
5. **Turn on the transfer lock** (sometimes called "registrar lock"). It stops anyone from moving the domain to another registrar without you unlocking it first.
6. **Turn on WHOIS privacy**, if your registrar offers it, so your name and address aren't published with the domain.
7. **Note the renewal date** in your calendar, or turn on auto-renew. An expired domain means your devices can't find your resolver.

### How you know it worked

- In your registrar account, the domain shows as active, with the transfer lock on and two-factor login enabled.
- In a terminal on your Mac:

  ```
  whois <your-domain>
  ```

  The status lines include `clientTransferProhibited`, the transfer lock. The exact output differs between endings and registrars.

### Pitfalls

- **Endings like .io carry extra uncertainty.** Some country endings depend on decisions you have no say in. Prefer a common ending you expect to keep for years, and buy only what you need.
- **The first-year price isn't the price.** Compare renewals, not offers.

### Time and cost

- About 15 minutes (our estimate).
- A .com renews for about $10–23 a year at common registrars (May 2026); some charge more.

---

Next: [Chapter 2: DNS hosting with DNSSEC](https://kuuko.app/build/dnssec/)

Text: CC BY-SA 4.0 · Commands and configs: CC0