wallets security ens

· Educational crypto

ENS names: what a .eth name proves and what it doesn’t

What an ENS name like alice.eth actually is, why a name is only a pointer that can change, how primary (reverse) names are verified, how look-alike names spoof readers, and what expiry means—ENS-spec literacy, not investment advice.

A short name such as alice.eth is much easier to read than a 42-character hex address, so it feels more trustworthy. That feeling is the risk. An ENS name is a label that points somewhere. It is not a guarantee about who controls the destination, and the destination can change. This page explains what a name proves, what it does not, and how to check one before you send.

How it works: registry, resolver, record

ERC-137 (created 2016-04-04) describes ENS as three layers. The registry records who owns each name and which resolver contract answers questions about it. The resolver returns records, such as the address the name points to. A registrar hands out names under a parent like .eth.

Primary names: the reverse direction

Wallets and explorers sometimes show a name next to an address. That is a primary name, also called a reverse record. The owner of the address sets it, and anyone can claim any name in their reverse record. ENS’s docs say an app should only display a primary name after checking it forward: look up the name, and confirm it resolves back to the same address. If it does not, the label is meaningless.

Look-alike names and normalization

ENSIP-15 (created April 3, 2023) defines how names are normalized so the same-looking name maps to one canonical form. It describes spoofing tricks the standard has to handle: invisible zero-width characters, confusable characters from other scripts, and mixed-script names. It also says plainly that not every normalized name is visually unambiguous. Normalization lowers the risk. It does not mean any name you can read is the one you meant.

Names expire and change hands

ENS’s ETH Registrar docs explain that .eth names are registered for a period and must be renewed. After expiry there is a 90-day grace period. Then the name goes into a 21-day temporary premium auction, after which anyone can register it. Names are also transferable as NFTs. A name you saved a year ago may now belong to someone else.

How to verify before you send

  1. Get the name from the person, not a search result or a reply. The same rule applies as for address poisoning.
  2. Read the resolved address your wallet shows. Compare the first and last several characters with an address you already confirmed through another channel.
  3. Check the network. If you are sending on an L2 or another chain, confirm the name resolves for that chain. Background: networks and chain IDs.
  4. Be suspicious of near-matches. Extra characters, swapped letters, unusual scripts, or emoji variants all deserve a second look.
  5. Re-verify saved names after long gaps. Expiry and transfers mean the old owner may not be the current one.
  6. Use a small test send for first-time recipients. Then confirm with the recipient through a channel you already trust before sending more.

What we will not do

We will not tell you whether to register, buy, or sell any name, and we will not comment on name “values” or trading. We will not recommend specific wallets or name-lookup tools.

TakeawayAn ENS name is a pointer, not proof of identity. Read the address it resolves to, on the chain you are using, and re-check names you saved long ago. Treat primary names next to addresses as unverified until they resolve back.

Related free docs

Sources

Educational content only — not investment advice. This page explains how ENS names resolve as a literacy topic; it does not recommend any name, wallet, tool, network, or asset to buy, sell, or hold.

← All docs