You can usually tell from the NS and SOA records. For example, "dig io ns", "dig io soa", "dig org ns", "dig org soa". Afilias is the only registry operator i

You can usually tell from the NS and SOA records. For example, "dig io ns", "dig io soa", "dig org ns", "dig org soa". Afilias is the only registry operator i know of that uses nameservers with names like "a0.example.com", and the SOA email address has their name. TLDs can, and occasionally do, switch from one registry operator to another, though. (After all, that's what .io did.)