Skip to content

Top-Level Domains: Countries, Cash, and Ghost Domains

Abstract

The last label of every internet address, the top-level domain, began in 1984 as a short administrative list: six generic categories, a temporary .arpa, and two letters per country taken from an ISO standard. Jon Postel picked the ISO list so that he would never have to decide what a country is. That decision had consequences nobody planned. Domains outlived the states they named (.su is still online), states vanished before their domains could go live (.dd), and small territories found that their two letters were worth more than their exports: Tuvalu paid its way into the United Nations with .tv, and by 2025 the .ai domain was expected to provide nearly half of Anguilla’s government revenue. Since 2012 anyone with $185,000 can apply for a top-level domain of their own, which is how the internet acquired .amazon, .zip, and a dispute with eight South American governments.

Funafuti Tuvalu Aerial
Funafuti, the capital atoll of Tuvalu, 2011. Image: Lily-Anne Homasi/DFAT, CC BY 2.0, via Wikimedia Commons.

The First List

The Domain Name System needed a top layer, and RFC 920, published in October 1984 by Jon Postel and Joyce Reynolds, defined it: .com, .edu, .gov, .mil, and .org, with .net added when the system went live. Countries would get two-letter codes. A seventh generic domain, .int for international organizations such as NATO, followed in November 1988.

One more domain was meant to disappear. .arpa, introduced on January 1, 1985, was a holding pen for the existing ARPANET hosts while they moved into the new hierarchy. It was never removed. Reverse lookups, which turn an IP address back into a name, had been built inside it as in-addr.arpa, and in 2000 the IETF gave up on deleting it and redefined the letters as “Address and Routing Parameter Area”. IPv6 reverse lookups live under ip6.arpa; since 2018, home.arpa is reserved for home networks. Nobody can register a name in .arpa.

The first registration in .com came on March 15, 1985: symbolics.com (see Symbolics.com: The First Domain Name Ever Registered).

Two Letters per Country

The first country codes, also from 1985, were .us, .uk, and .il. Australia, Germany, Finland, France, Iceland, Japan, South Korea, the Netherlands, and Sweden followed in 1986. Each was delegated by Jon Postel to someone in the country who asked and seemed competent, often a university computing center.

Postel wrote down the rules in RFC 1591 in March 1994. Country codes came from the ISO 3166-1 list, for a stated reason: “The IANA is not in the business of deciding what is and what is not a country.” ISO had a procedure for deciding which entities belonged on the list; Postel did not want one. The same document defined the domain manager as a trustee “for both the nation, in the case of a country code, and the global Internet community”, a phrase that later carried a lot of weight when governments and private operators fought over who owned a ccTLD.

The United Kingdom broke the rule from the start. Its ISO code is GB, and .gb was created on July 24, 1985, but .uk already existed, set up a few months before RFC 920 because British academic networking used the abbreviation. The British academic network JANET had its own naming scheme, the JANET Name Registration Scheme, which wrote names in the opposite order: the University of Cambridge was UK.AC.CAM, not cam.ac.uk. Mail gateways had to reverse the names when messages crossed into the DNS world. This worked until Czechoslovakia received .cs, at which point a JANET address ending in .CS for a computer science department could be read as a host in Prague and sent there. JANET moved to the DNS in the early 1990s, and the last NRS mail gateway closed at the end of 1997. Nobody ever registered much under .gb; in November 2022, the UK government said it would ask ICANN to retire it.

Dead End: Domains That Outlived Their Countries

The ISO rule has a corollary: when a code leaves the ISO list, its domain should leave the root. In practice, history moved faster than the list.

.dd, East Germany’s code, never went live at all. Postel never delegated it, and the code was withdrawn in 1990 with reunification (see The Domain Name System and Computing in East Germany).

.cs for Czechoslovakia appeared in the IANA tables in autumn 1990. The first domain was registered in October 1991; at its peak, in the winter of 1993/94, it held 114 domains. Czechoslovakia split into the Czech Republic and Slovakia on January 1, 1993, and their new domains, .cz and .sk, absorbed the traffic. .cs was deleted around January 1995. In July 2003 ISO reassigned the code CS to Serbia and Montenegro, which never used it and dissolved in 2006.

.yu for Yugoslavia, introduced on June 15, 1989 and run from the University of Belgrade, survived the breakup of the country it named. Slovenia, Croatia, Bosnia and Herzegovina, and Macedonia took their own domains; .yu stayed with the rump Federal Republic of Yugoslavia and then with Serbia and Montenegro. After Montenegro’s independence, the new domains .rs and .me went live in 2007, and the Serbian registry switched .yu off at 12:00 CEST on March 30, 2010, with about 4,000 websites still using it. Until then, .cs had been the most heavily used top-level domain ever deleted.

.su is the exception that proves how weak the rule is. The domain for the Soviet Union was assigned on September 19, 1990; a 19-year-old Finnish student, Petri Ojala, had proposed .su in place of the planned .ussr. The Soviet Union dissolved on December 26, 1991, fifteen months later. Russia received .ru, but .su was never shut down. The Russian Institute for Public Networks still runs it, new registrations resumed in 2001, and in February 2025 it held 111,695 domains, compared with almost 5.9 million under .ru. Its relaxed rules made it popular with cybercriminals until suspension rules were introduced in 2013. In March 2025, ICANN reportedly informed the operator of a planned phase-out by 2030.

Selling a Country Code

The other surprise was money. A two-letter code that happens to spell a word, or an abbreviation, can be marketed to the whole world. Several small territories found themselves owning one.

.tv belongs to Tuvalu, a Pacific island nation. In 1998 the Toronto company Information.CA secured the registry rights with a promise of US$50 million; after payment delays, Idealab took over the deal in 1999 with $12.5 million upfront and $1 million per quarter. Tuvalu became the 189th member of the United Nations on September 5, 2000, and paid for its membership with the .tv revenue; the Guardian’s headline was “Island sells web address to buy UN membership”. VeriSign bought the registry on December 31, 2001 for $45 million. The streaming boom raised the price: after Amazon bought Twitch in 2014, the payments were renegotiated upward, in 2019 .tv royalties made up 8.4 percent of the government’s revenue, and on December 14, 2021, Tuvalu signed with GoDaddy for $10 million a year.

.tk belongs to Tokelau, a territory of New Zealand in the South Pacific. Its operator, Freenom, gave domains away for free. The result was the largest country-code domain on the internet: 31.3 million names in 2016, well ahead of China’s .cn with 16.8 million. The registry provided about a sixth of Tokelau’s annual income. It also provided free addresses to phishers: in the second half of 2010, .tk domains accounted for about 21.5 percent of all phishing attacks recorded worldwide. On March 3, 2023, Meta sued Freenom for cybersquatting, new registrations stopped, and in February 2024 Freenom left the domain business.

.ai belongs to Anguilla, a British territory in the Caribbean. Registrations opened on February 16, 1995, and for thirty years the registry was effectively run by Vince Cate, an American programmer who had moved to the island in 1994. Cate was also a cryptography activist: his website invited visitors to “become an international arms trafficker in one click” by emailing three lines of Perl implementing RSA to his server in Anguilla, a protest against US export controls, and in 1998 he renounced his US citizenship (see The Crypto Wars of the 1990s). For most of those years .ai was a curiosity; in 2018 it earned about $2.9 million. Then came ChatGPT. In 2023 the Anguillan government took in about $32 million from .ai registrations, more than ten percent of the territory’s GDP, and a minister stated that .ai revenue, below one percent of state income before the AI boom, would reach about 47 percent in 2025. Identity Digital took over the registry’s operation in January 2025. By June 2026 there were about 1.28 million .ai domains.

.io belongs to the British Indian Ocean Territory, the Chagos Islands, whose inhabitants Britain removed in the 1960s and 1970s to make way for the US base on Diego Garcia. The domain was delegated on September 16, 1997 to the British entrepreneur Paul Kane, whose company sold it to Afilias in April 2017 for $70.17 million. Because “I/O” reads as input/output, .io became the default address of software startups. The UK government stated in 2014 that it received no revenue from the domain; exiled Chagossians have demanded a share. In October 2024 the UK announced it would hand the islands to Mauritius, and the treaty was signed on May 22, 2025. ICANN’s IANA chief Kim Davies explained that a treaty alone changes nothing: only the removal of IO from the ISO list would start a five-year phase-out. As of 2026, that has not happened. Ratification of the treaty stalled after US President Donald Trump turned against the deal in January 2026, and .io continues to work.

Opening the Root

The list of generic domains stayed short for fifteen years. ICANN added seven in November 2000 (.aero, .biz, .coop, .info, .museum, .name, .pro) and a handful more after 2004, among them .mobi, .travel, and .asia; .xxx was approved in March 2011 after an earlier rejection. In May 2010, the first top-level domains in non-Latin scripts went live, for Egypt, Saudi Arabia, and the United Arab Emirates in Arabic script, followed by Russia’s Cyrillic .рф.

The real opening came with the New gTLD Program. From January 12, 2012, any organization could apply for its own top-level domain, at a fee of $185,000. ICANN received about 1,930 applications. The first new domains were delegated in 2013, and by 2018 there were more than 1,200. Hundreds of applications were for brand names.

Two applications showed the limits. Amazon applied for .amazon in 2012. Brazil and Peru objected, joined by the other members of the Amazon Cooperation Treaty Organization (Bolivia, Colombia, Ecuador, Guyana, Suriname, and Venezuela), arguing that the name of a river and a rainforest belonged to the people living there. ICANN’s government advisory committee recommended rejection in 2013; an independent review panel sided with Amazon in 2017; the domain was finally granted in 2019. Only Amazon can register names under it.

Google’s .zip and .mov opened to the public on May 3, 2023, and security researchers immediately objected that they look like file names. A chat message mentioning invoice.zip might be turned into a link to a website; phishing sites using both domains appeared within days.

The second application round opened on April 30, 2026 and closed on August 12, 2026.

📚 Sources