How to buy a domain safely in Pakistan

Before you pay anything

Buying a domain from its owner is different from registering a new one. There is no checkout page and no instant delivery. You are paying a person to hand over control of a name they registered, and the handover happens inside a registrar account or at PKNIC, not on the chat where you agreed the price.

That gap between paying and receiving is where buyers lose money. The checks below cost nothing. Do them before you send a rupee.

Check who controls the domain

Every registered domain has a public record. For a .com (or .net, .org and most other global extensions) you can read it through RDAP, the system that is replacing the old WHOIS. A free lookup page is client.rdap.org: choose "Domain", type the name and run the query. The result shows the registrar, the creation and expiry dates, the status codes and the nameservers. Contact details are usually hidden for privacy, so do not expect to see the seller's name.

For a .pk or .com.pk domain, use the Domain Lookup (WHOIS) search on the PKNIC home page, which shows the domain's registration record.

What to compare: the registrar shown in the record should be the one the seller says they use. The nameservers should match the site the domain currently points to. If the seller claims to own a .pk name and the PKNIC record does not match what they told you, ask them to explain before going further.

On SastiDomains, every seller must add a short TXT record to the domain's DNS before their listing goes live. That proves they can change the domain's settings today. It does not prove they are the legal owner, which is why the public record is still worth reading yourself.

Expiry date and locks

Look at the expiry date in the record. A domain that expires in two weeks is risky: if the seller lets it lapse mid-deal, the transfer can fail and the name may end up in a redemption period or be deleted. Ask the seller to renew first, or build the renewal into the price.

Then read the status codes. ICANN's status-code guide explains them. "ok" means no pending operations or restrictions. "clientTransferProhibited" means the registrar will reject a move to another registrar until the seller removes the lock, which is normal and fixable. "clientHold", "redemptionPeriod" or "pendingDelete" mean the domain is not resolving or is on its way out, and you should not pay for it in that state.

One more check for a .com that was registered recently: ICANN's transfer policy lets the registrar of record deny a transfer requested within 60 days of the creation date. If the record shows the domain was created last month, a registrar-to-registrar transfer may have to wait. A push between two accounts at the same registrar is usually still possible.

Trademark risk

A domain that is somebody's brand is a liability, not a bargain. If you buy a name that matches a registered trademark, the trademark owner can file a dispute and take the domain, and the seller has no obligation to refund you.

Before you buy, search the name in a web search engine, on social media and in the IPO Pakistan trademark register (the Intellectual Property Organization of Pakistan). If a company is already trading under that name, or a well-known brand is spelled slightly differently in the domain, walk away. Generic words, place names and made-up words are the safe end of the market.

The common scams

Most domain scams are simple, and all rely on the buyer paying first.

• Pay and disappear. The seller takes a bank transfer or wallet payment, then blocks you. There is no refund route because you paid a private person.
• The lookalike domain. You agreed to buy example.com. The seller "transfers" examp1e.com or example.com.pk and insists the deal is done. Read the exact spelling and extension of what lands in your account.
• Pressure to pay outside escrow. "Send it direct and I'll give you a discount." "Escrow is slow, another buyer is waiting." A seller who will not use escrow is telling you something.
• The fake proof. A screenshot of a registrar dashboard proves nothing; it takes a minute to edit. A DNS change you asked for, made while you watch, is real proof.

What escrow does, step by step

Escrow means a third party holds the money until both sides have done their part. On SastiDomains it works like this:

1. You pay SastiDomains, not the seller. Bank transfer, Raast, JazzCash or Easypaisa, in rupees, for the listed or agreed price. There is no buyer fee.
2. The seller transfers the domain to you. We tell the seller the payment is held and guide both of you through the registrar's or PKNIC's steps.
3. You confirm you control the domain. Only you can give this confirmation, and only after you have checked the domain is in your own account (see below).
4. SastiDomains pays the seller. Within 24 hours of your confirmation. The seller's 10% commission comes out of that payment, not from you.
5. If the transfer fails, you are refunded. The seller cannot complete the handover, the deal is cancelled and your money comes back.

What "transfer" actually means

For a .com and other global extensions

There are two ways a .com changes hands, and you should agree which one with the seller before paying.

A push within the same registrar. If you open an account at the seller's registrar, the seller can move the domain into your account from their dashboard. It is usually free and takes minutes. You can move the domain to a registrar of your choice later.

A transfer to another registrar. The seller unlocks the domain, gets its authorization code (also called an auth code, EPP code or transfer code) from the registrar and gives it to you. You start a transfer at your own registrar, enter the code and pay that registrar's transfer fee, which normally includes a year's renewal. ICANN's transfer policy requires the seller's registrar to release the code and remove the lock on request, and the old registrar has five calendar days to object before the registry completes the move, so allow about a week. The 60-day rule above can block this route for freshly registered names.

In both cases, make sure the registrant contact is changed to your name and email. Holding the domain in your account but with the seller's details on the record is not full control.

For a .pk or .com.pk

PKNIC's "Change Domain Info" page says the registrant record is locked, and that changing it means sending original signed documents by post to PKNIC in Lahore, with phone verification and a few business days of processing after the documents are verified. A .pk deal is therefore slower and more paper-based than a .com deal. Read our .pk domain transfer guide before agreeing a price.

Confirm you control the domain before releasing payment

Do not confirm a transfer on the strength of a seller's message or screenshot. Check it yourself:

• Log in to the registrar or PKNIC account that now holds the domain, using your own credentials, and open the domain's management page.
• Make a change and watch it stick. Change the nameservers, or add a TXT record with a random value, then check it from a different device or an online DNS lookup. If the change appears, you control the DNS.
• Read the registrant details on the domain record. They should be yours, not the seller's.
• Re-run the public lookup from the section above. The record should now match what you expect.

Only after all of this should you tell SastiDomains the transfer is complete. Once you confirm, the seller is paid and the deal cannot be reversed.

After you buy

The easiest way to lose a domain you just bought is to forget about it.

• Renew it. If the expiry date is within the next few months, renew now. PKNIC's price list shows ₨2,100 per year for Pakistan-based registrants, charged for two years at a time, so expect ₨4,200 for a .pk renewal. Registrar renewal prices for a .com vary.
• Lock it. Turn the registrar transfer lock back on so nobody can move the domain without unlocking it first. For a .com, this is the clientTransferProhibited status you saw earlier.
• Keep your contact details current. Renewal reminders and transfer confirmations go to the email on the record. If that email dies, the domain can quietly expire.
• Keep the paperwork. Save the listing, the chat, the payment receipt and the confirmation message as your record of a legitimate purchase.