You type maatx.io into the address bar, and a fraction of a second later your browser already knows where to knock. It feels automatic — an open, ownerless network with no center, where protocol outranks kings. That's the story the internet has told about itself since the nineties. It's a good story, and it's wrong at exactly one point — the point where any name begins. Before your browser can find a site, something has to confirm the domain exists at all. That something is not a cloud of thousands of equal peers. It's a short list of organizations that fits on a single page.
Three Floors, Stacked
The domain name system is built as an upside-down tree. At the very top sits the root — an invisible dot after every address that your browser doesn't even bother to show you. Below it, top-level domains: .com, .io, .ru, .org, and a few hundred others. Below that, the actual domains people and companies buy. All of it rests on one document — the root zone file, which lists every top-level domain that exists and where to go for information about each one. The file is small. But nothing on the internet resolves for anyone without it, because every layer below only answers a query after the root has confirmed its right to answer.
Ask who writes that file, and the abstraction ends.
Thirteen Letters Holding the Root
Formally, the root zone is published by IANA — a function housed inside ICANN, a nonprofit registered in California. Physically, the file is distributed worldwide by Verisign, a US company under contract as the designated Root Zone Maintainer. Thirteen named server clusters, lettered A through M, do the actual serving, run by twelve organizations: Verisign itself holds two (A and J), and the rest are split among American universities, NASA, the US Department of Defense and its Army research lab, the internet backbone provider Cogent, Japan's WIDE Project, Sweden's Netnod, Europe's RIPE NCC, and ICANN itself. Physically, each letter has hundreds of anycast presence points scattered across the globe — probably including a data center in your own country. Administratively, though, the list of who ultimately answers for each letter is a dozen names, skewed noticeably toward American jurisdiction.
In 1998 this was demonstrated directly. Jon Postel, the man who had personally run IANA for decades, asked eight of the then-twelve root server operators to point their machines at his own server instead of the officially designated one. Formally, a test. In substance, a demonstration that real control over the root rested not on law but on trust between a handful of people. The operators complied. Washington reacted with alarm, watching a small group of administrators redraw the planet's address book in a single evening. Postel reversed the redirect the next day. ICANN was created a few months later, an attempt to formalize what had, until then, run on personal agreements. In 2016 the United States formally handed its remaining oversight of IANA to a global multistakeholder community — cutting the last direct thread from the US Commerce Department to the root. The list of keyholders did not get any longer.
Registrars: The Storefront Over the Machinery
Ordinary people never touch the root or the root servers. They touch registrars — companies like GoDaddy, Namecheap, or Reg.ru, where they buy a domain. A distinction gets flattened in everyday speech that matters here: a registry is the organization holding the authoritative database for a given top-level domain, and a registrar is the ICANN-accredited retailer that buys wholesale from the registry and sells to you at retail. When you "buy" a domain, you're actually leasing a name from a registry through a middleman — indefinitely, as long as you keep paying and stay within the rules.
This is where the real bottleneck shows up. The registry for .com and .net — the two largest zones on Earth, with .com alone holding on the order of a hundred and fifty million registered names — is, again, Verisign. One company controls the pipe carrying most of the commercial internet, not just under contract with ICANN but under a separate cooperative agreement with the US Department of Commerce that still governs how much Verisign is allowed to raise its price per name. Thousands of registrars worldwide make up the storefront. One pipe sits behind it.
A Name You Can Have Taken Away
This is where the abstraction turns concrete. Because the root, the largest registries, and most registrars physically sit within specific legal jurisdictions — overwhelmingly American — a name is only as durable as the laws of the country whose company runs the layer underneath it. US authorities have repeatedly used the fact that Verisign and major registrars are American companies to seize .com and .net domains from site owners outside the United States: piracy cases, counterfeiting, and at times sanctions enforcement — reportedly including a 2021 US Justice Department action that seized several dozen websites, including news outlets, linked to Iran, citing sanctions violations. On paper, this is enforcement against bad actors. In practice, it demonstrates that a domain is not property but a permission that can be revoked by a court not in your country, but in someone else's.
There's a quieter example of how fragile the naming layer itself can be. The .io domain is assigned to the British Indian Ocean Territory under the ISO standard IANA uses to allocate country-code domains. In 2024, the UK agreed to transfer sovereignty over the Chagos Archipelago to Mauritius — raising the question of whether .io survives in the registry at all, since history already includes cases where a territory's domain was eventually retired once it dropped off the ISO list. Thousands of startups built their branding around a letter combination they hadn't chosen as a political statement — just a happy coincidence with "input/output." It turns out that coincidence was leased too.
Our record: in the system of Ma'at, Ren is not just a label. To name something is to hold power over it; erasing someone's name from a monument meant, to the ancient Egyptians, erasing the person's very existence. DNS is literally an engineering of Ren at planetary scale: your name on the network exists only because three layers of other people's hands — root, registry, registrar — agree to recognize it. None of those layers belongs to you. Erasing a name today doesn't take a chisel against stone. It takes one line in an admin panel you don't control.
None of this is a reason to abandon domain names — the whole world will keep using them for a long time yet. But it's worth holding the difference between "I have a website" and "I'm permitted to have a website, until I break terms I didn't write." It's the same logic that led MAAT to decline riding a token on someone else's ERC-20 network and build its own chain instead — not out of stubbornness, but because a leased name can go silent on someone else's schedule, not yours. Holding your own Ren isn't paranoia. It's just a sober accounting of who actually writes the root file of your life.