What registry roles do
Every name sits in a registry. A .eth name sits in the .eth registry. The registry holds the name's roles, such as who can transfer it or change its resolver.
The wallet that holds a name owns it. Roles let other wallets do single jobs on it without giving the name away.
A name can also have a registry of its own, for its subnames. Its roles decide who can create and manage those subnames.
Records are different. They live on the resolver, which has its own roles. See Grant resolver 'roles' to edit name records.
If you used ENS v1, roles replace the separate Manager a name could have then. See What happened to the Manager role?
See who holds a role
Anyone can look. Open the name in ENS Explorer and select Roles. You don't need to connect a wallet. The tab has up to three tables:
Parent registry / Roles: what each wallet can do to this name.
<name> Registry / Roles: who can create and manage the name's subnames. It shows once the name has a registry of its own.
<name> Resolver / Roles: who can edit the name's records.
Each row is a wallet, with a tick for each role it holds.
Admin and user
Each role has two levels:
User: the wallet can do that job.
Admin: the wallet can do that job and decide which other wallets hold the role.
If no wallet holds Admin on a role, no one can grant that role again.
Roles on your name
These sit on the parent registry, the registry your name is in.
 |
Can Transfer: move the name to another wallet.
Set Resolver: choose the name's resolver, the contract that answers questions about it and stores its records.
Set Subregistry: choose the registry that holds the name's subnames.
When you register a .eth name, your wallet holds these three here. A .eth name needs no role to renew: anyone can pay to renew it.
Granting or removing a role here changes the name's token ID, so a marketplace listing tied to the old number stops working. See Why did my name's token ID change?
On a subname, this table shows the roles held on the parent name's registry, so it can list many more, such as Renew and Unregister. Below it, Registry-wide roles lists wallets whose roles cover every name in that registry. Explorer notes that these can't be changed from this page. See What can the parent of a subname still do?
Give a wallet a role on your name
Each change is a transaction, so you need a little Sepolia ETH for network fees (gas).
On the name's Roles tab, in Parent registry / Roles, select Add user.
Enter the wallet's ENS name or address.
Tick the roles at User or Admin level. A box stays grey when that role can't be given on this name. On a .eth name, Renew and Unregister are grey. Can Transfer isn't on the panel.
Select Save, then Start, then Open wallet, and approve in your wallet.
To take a role away, select the icon at the end of the wallet's row, untick the role or select Remove user, then save and approve the same way. You need Admin on a role to remove it from another wallet.
Important: on a subname, Unregister ("Can unregister (delete) the name") lets the holder delete it, so grant it only to a wallet you trust. Removing your own roles can lock you out.
Roles on your subnames
The <name> Registry / Roles table shows once you have deployed a registry for the name's subnames, the first step of Create a subname (ENS Explorer). Deploying gives your wallet every role on that registry, with Admin, and they cover all the subnames in it.
 |
The roles you will most often need, with Explorer's own description in quotes:
Registrar: "Can register new labels", which means creating subnames.
Register Reserved: "Can register reserved labels".
Renew: "Can extend name expiration".
Set Resolver: "Can change the resolver address".
Set Subregistry: "Can change subregistry addresses".
Set Parent: "Can update canonical parent".
The table also lists Can Name, Can Transfer, Set Uri, Unregister, Upgrade and Was Reserved. The registry's Add user panel doesn't offer these.
To change these roles, select View and manage under the table. That opens the registry's own Roles page, which has Add user.
 |
 |
Roles on your records
The <name> Resolver / Roles table shows who can edit the name's records. Those roles sit on the resolver, not the name, and changing them doesn't change the token ID. To give or remove access, see Grant resolver 'roles' to edit name records.
Not sure how registries and resolvers differ? See Registry and resolver: what's the difference?