One company sold every .com.

For six years, “which registrar should I choose” was not a question you could ask.

The kind of company you buy a domain from today did not exist as a category.

Then a government decision created it.

The three roles everyone treats as the natural furniture of the domain world — registry, registrar, registrant — did not appear because a market found its shape. They were drawn on purpose, by policy, to break apart a monopoly that had become an embarrassment.

The middleman you buy your domain from is a deliberate act of government.

One door

In 1993 the U.S. National Science Foundation created the InterNIC and split the work across three contractors: Network Solutions handled registration, AT&T ran directory and database services, General Atomics provided information services. Name assignment — .com, .net, .org — went to Network Solutions. And for the entire life of that agreement, this one company was both the registry — the single database of who holds which name — and the only registrar, the only door through which a name could be obtained. There was no second door.

Registration was free at first, carried by public money. Then in September 1995, as commercial demand exploded, Network Solutions began to charge: one hundred dollars for a two-year registration, fifty a year. One company, one price, no alternative.

The tension was not only about price. Thirty percent of each fee flowed, until 1998, into a National Science Foundation “intellectual infrastructure” fund — domain holders were financing a public-policy purpose they had no say over. Trademark disputes multiplied. The rule that decided who got a name — first come, first served — rested on a single company’s internal policy. A fast-growing, globally consequential market hung on the decisions of one firm, at a high price and with no competition.

A forged letter

The stakes were not theoretical. One of the most famous early domain thefts happened precisely because there was one door.

In 1994 Gary Kremen registered sex.com to his company. In 1995 a man named Stephen Cohen sent a letter to Network Solutions claiming Kremen’s company wished to abandon the name; the letter, as the courts later established, was fraudulent. Network Solutions transferred the name to Cohen without checking with Kremen. Kremen had nowhere to turn: the same single company was the registry, the registrar, and effectively the dispute process too.

After years of litigation, the federal appeals court held in 2003 that a domain name is property that can be stolen, and ordered Cohen to pay Kremen $65 million. Until then it was not even legally settled whether the name could be yours at all.

The decision that ordered competition

On June 5, 1998, the U.S. Department of Commerce published a statement of policy the industry still calls the White Paper. It set four principles for handing the naming system to the private sector: stability, competition, private bottom-up coordination, and representation.

Here, competition became official policy.

The mechanics arrived in an amendment. In October 1998, Amendment 11 to the government’s agreement with Network Solutions required a Shared Registration System — a design that cut the company in two. The registry function stayed with Network Solutions, now a wholesaler running the shared database. The registrar function was pried open to unlimited competition: any accredited company could sell names into that database on equal terms. A newly created non-profit, ICANN, was handed the job of accrediting them.

Competition in the domain market was created by a contract amendment.

The first five competitive registrars were named on April 21, 1999: America Online, CORE, France Telecom/Oléane, Melbourne IT, and register.com. The testbed opened five days later. A later amendment fixed the wholesale price the registry could charge each registrar at nine dollars per name per year, eighteen for a new registration. The retail layer — the price you actually pay, the interface, the support, the upsells — was thrown to the market. The wholesale layer stayed regulated.

The split was not arbitrary. An extension can have only one authoritative database — two competing .com registries could not coexist, because nothing would decide which one tells the truth about a name. The registry is therefore a natural monopoly; competition is possible only at the layer in front of it. The monopoly did not disappear: the reform compressed it to a single point and opened everything ahead of it.

It did not happen this way everywhere

This was an American answer to an American problem, and it did not become universal at once. Many country-code extensions ran for years as both registry and seller — operated by a national community or university, handing out names directly, with no registrar layer. The competitive, separated model spread gradually, wherever the operator adopted it. The three-actor structure is not the internet’s natural order. It is a decision, taken country by country — or not taken at all.

For a decision-maker with names in several countries, this means the map differs by extension. Responsibility boundaries fall in different places, the registry knows one thing and the registrar another, and the route to dispute resolution changes. One portfolio, several jurisdictions, several structures — each to be learned on its own.

The map of accountability

This is where the history stops being trivia and becomes a map — and almost no domain holder can read it.

It helps to be precise about the three roles. The registry keeps the authoritative database of a given extension — say .com — and knows whether a name exists at all and to whom it is assigned. The registrar is the company where you buy and manage the name; it writes into the registry’s database on your behalf, over a standard protocol. The registrant is you — and I deliberately do not write “owner,” because over the name you hold not property but a fixed-term right to use. That distinction is a subject of its own. What matters here: in the chain you are the last link, you never speak to the registry directly, yet you carry the consequence when any layer errs.

What the registrant actually holds is an entry: one line in the registry’s database that points your name in a direction. What you rent is the direction itself: the network turns toward you when it is asked about your name. If that line falls into the wrong hands, the name stays identical letter for letter — it just points to someone else now. Kremen learned this the most expensive way.

When a name is hijacked, when a transfer stalls for a week, when a renewal quietly fails — the first real question is which layer owns the problem. A registry lock lives at the registry. The transfer authorization code, the contact record, the renewal date, the account credentials — those live at the registrar. The DNS that actually routes your traffic may live at a third party entirely.

Twenty years on the infrastructure side leave you with one reflex: before anything else, establish whose layer the problem sits on. That answer decides who is even able to fix it, and how fast. Call a company that cannot touch the problem and you lose days you did not have.

The same split is why you are not trapped. Because the registry became shared in 1999, you can leave a registrar and keep your name — portability was the entire point of the exercise. Most holders never use the right the whole structure was built to give them.

And the price still carries the old shape. The wholesale registry fee for a .com sits at $10.26 in 2025 under the current Verisign–ICANN agreement — barely moved from the nine dollars fixed in 1999, while the retail market around it grew into more than two thousand competing storefronts. The regulated layer held. The open layer did the changing.

Knowing the map is measured in money and risk. If you know where the boundary runs, you know the registry lock is worth asking your registrar to arrange, because it stops the worst hijacks. You know an absurd renewal price is your registrar’s margin decision, not your cost of goods — and you have somewhere to move the name. And you know which provider to call first when the minute counts. The most common failure comes from the same blindness: the holder calls the registrar when the DNS is at a fourth provider, or assumes the registrar grants the registry lock — when it only requests it. A wrong mental map is not ignorance. No one ever showed them how many parties stand behind the name.

Read the layers as exposure and you feel trapped. Read them as a map and you have room to move.

The same company name

There is a final turn the architects of the 1999 system did not plan for. The competition they distributed has started pooling back: a handful of groups — among them GoDaddy, Newfold Digital, and Tucows — hold much of the retail market under dozens of brands. And Newfold Digital today owns Network Solutions — the 1993 monopolist — and register.com, one of the five challengers sent in to break it. The incumbent and its first competitor now file under the same parent.

The split was drawn so you would always have somewhere else to go. That right still stands. The number of genuinely separate places to go is smaller than the number of logos suggests, and most holders have never checked which of their names sit behind the same parent.

Magyar változat: [zona.hu/a-piac-egy-monopolium-vegebol-szuletett/]

No signature on it.

No court behind it.

It says of itself: not a standard.

This text holds more than three hundred country endings today. One of them is where your company lives.

In March 1994, Jon Postel published a memo.

“Domain Name System Structure and Delegation.” Just over two thousand words. Filed as Informational — “This memo does not specify an Internet standard of any kind,” it says of itself, in its own opening.

What it says is stranger than what it is. The manager of a delegated domain is a trustee — for the nation and for the global internet community at once. Then the sentence the whole document turns on: “Concerns about ‘rights’ and ‘ownership’ of domains are inappropriate. It is appropriate to be concerned about ‘responsibilities’ and ‘service’ to the community.” The measure of a manager is set in four words: “equitable, just, honest, and competent.” And the one explosive question — what counts as a country — Postel refused to answer. “The IANA is not in the business of deciding what is and what is not a country.” He handed it to a list maintained elsewhere: ISO 3166.

The memo did not invent a practice. It wrote down one already running. Hungary’s .hu had been delegated on 7 November 1990 — nearly four years before the text that would supposedly govern it. Half the country codes on the internet predate their own rulebook.

Postel was the RFC editor, the “Numbers Czar,” and, in person, the IANA itself — the Internet Assigned Numbers Authority, the office that parceled out the internet’s names and numbers. When he died in October 1998, Vint Cerf’s memorial opened: “Jon, our beloved IANA, is gone.” He had, in his last weeks, completed the incorporation of a successor to carry the function — the body we now call ICANN.

One more line from the same memo, because it inoculates against reading this as scripture. In 1994 it predicted: “It is extremely unlikely that any other TLDs will be created.” After the 2012 round, more than 1,200 new generic endings entered the root zone.

The document failed as a prophecy and held as a constitution — because it was never kept for its prophecies.

The most durable legal construct on the internet is a text with no legal force.

Start with why it holds, because the answer is counterintuitive. Responsibility, not right. The trustee construction — as the ccNSO’s own later reading of it puts it — describes a duty of service to the community, not a legal relationship between the manager and the domain. Where the text hands out no right, there is nothing in it to sue over. No contract to breach. No property to claim back.

The delicate decisions are all pushed off the document. What counts as a country goes to ISO, a standards committee in Geneva. Who is a fit manager rests on the consent of the “significantly interested parties” — local consensus, in plainer words. Questions of equity, justice, and honesty are settled locally, under local law; the interpretation working group was explicit that IANA does not step into those.

And everything closes on consent. A transfer needs both the old and the new manager to agree. A revocation is a last resort, reserved for persistent failure of duty. The resting state of the whole system: no one can take anything from anyone by their own hand.

I read it as an operator, not a lawyer. The root zone is a register of responsibility. The IANA table does not list owners; it lists keepers. And the contracts outsiders assume must be there mostly are not: the Governmental Advisory Committee’s own 2005 principles say in writing that they are “not intended to be binding,” that they apply voluntarily, and that a registry’s refusal to adopt them cannot be held against it. A large part of the country-code world stands under no binding contract with ICANN at all.

The text allocates no rights, only responsibilities — so there is nothing in it to sue over.

Every attempt to replace it failed

In 1999 ICANN issued its own update, ICP-1. The ccNSO’s later analysis found it carried policy changes the ICANN Board had never approved by resolution — and that the country-code community had never accepted it. The interpretation group set it aside. In 2001 most country-code registries adopted RFC 1591 itself as their governing policy.

Then came the Framework of Interpretation. Three years of work, 2011 to 2014. Its charter forbade it from writing new rules; it could only interpret the old ones. The product of three years was a reading of the original text, not a revision of it.

The one real addition that ever cleared the full policy process is the 2022 retirement rule. Even that schedules only the death: a deletion from ISO 3166-1 triggers a Notice of Removal, then five years in the root, extendable by five more. It never touched the trust construction underneath.

And that rule was forced into being by a single case. As .yu was being wound down, the incoming registry itself — RNIDS — asked for clear and transparent rules, and an ICANN Board resolution of 30 September 2009 handed the question to the ccNSO to study. A case made the rule, twelve years on.

The text at work

.yu is the orderly death. Delegated in 1989, run first from Ljubljana, then carried after the breakup by YUNET in Belgrade. ISO changed the code from YU to CS in 2003; after Montenegro’s 2006 referendum, the September 2006 revision dropped CS and added RS and ME. On 11 September 2007 the ICANN Board delegated .rs to RNIDS and made the wind-down of .yu a condition; after one extension, .yu left the root zone on 1 April 2010. The numbers carry the drama on their own: Google indexed 69 million .yu pages in 2007, and 6.2 million by mid-2009; of 32,772 registered names, 4,266 were left. An entire country’s namespace went dark on a schedule, over two and a half years.

.su is the exception now meeting its first real test. Delegated on 19 September 1990, fifteen months before the Soviet Union ceased to exist. The code left the standard in 1992; the extension outlived its empire by more than three decades. According to press reports, the PTI — the body that now operates the IANA function — notified the manager, ROSNIIROS, in a private letter dated 6 February 2025 of a wind-down planned through 2030. No public announcement has followed, and 2030 is a plan, not a settled date.

.nu is where the trust construction meets the edge of law. Niue’s government sued in Sweden from 2018; the Södertörn district court in March 2024, and then the Svea Court of Appeal on 5 June 2025, rejected the damages claim. The district court held that the foundation had followed the existing framework and had no duty to seek Niue’s permission; the appeal court upheld the outcome. By the foundation’s account, the delegation itself rests with a separate body, IUSN. Read as my own structural inference: RFC 1591’s community-trustee idea was never enforceable before a Swedish court. The lawsuit over the trust construction was decided not by the rules of trust, but by local law — exactly as Postel’s text had arranged the world.

.io is the next test, still open. The Chagos sovereignty transfer was signed in May 2025; as these lines are written the IO code remains in the standard and the delegation is unchanged. If ISO ever removes it, the five-plus-five removal schedule begins. Earlier name changes ran the same way — Zaire became CD in 1997, East Timor became TL in 2002 — a new country, a new ending.

What this means if you decide

If your primary domain name lives on a country code, the top link in your chain of title is neither property nor contract. It is a trust mandate. There is no ownership behind it that a court protects, and no service contract you could cancel and re-sign somewhere else. Most corporate risk maps do not carry that line at all.

So three questions belong on the table when you choose an extension, or when you next audit the portfolio you already hold. Who runs the ending, and what is that body’s relationship to its own local community and government. Under what legal order the manager itself operates — which is the jurisdiction question a name inherits the day it is registered. And what happens if the country code’s status changes in the standard — because there is now a schedule for exactly that, and five years, plus five, is precisely as long as it was long enough for at .yu: time for an orderly move, for whoever starts in time.

The root zone records everything except ownership.

It does not note who owns an extension. It notes who answers for it.

That is the whole legacy of Postel’s two thousand words: at the very top of the internet, the concept of property does not exist. There is only service.

Magyar változat: [zona.hu/ketezer-szo-tartja-egyben-a-nevteret-1994-ota/]

The top of the internet is taking applications again.

Fourteen years since the last window. This one closes on 12 August.

For a 227,000-dollar evaluation fee, any organization can propose a new domain extension — a private slice of the root zone, the top level of the internet’s names.

Last time, 1,930 applications arrived, aimed at a namespace that until then held 22 generic extensions.

Most of what they bought, you have never typed.

The 2012 round put more than 1,200 new extensions into the root zone, close to 100 of them in non-Latin scripts — the first of the round, delegated in October 2013, was Arabic, seventeen months after the application deadline.

Fourteen years is long enough to measure what happened next.

At the end of 2025, .com alone carried 161 million domain names — more than three times the 47.8 million held by every extension from that round combined.

The brand-owned extensions did worse.
By one industry tally from the end of 2024, roughly 130 of about 500 delegated brand extensions had been handed back or terminated, and around 126 of the survivors held a single domain name: the placeholder ICANN’s contract requires.

The story of these near-empty brand extensions would be worth a piece of its own.
What matters here is the shape of the whole dataset: the outcomes sorted themselves by category, and they sorted early.

A brand extension with no migration plan stalled the same way, whatever industry the brand came from.
A generic word with no sales channel behind it stayed empty no matter how good the word was.
The failures repeated by type, and the types were visible in the applications themselves.

The 2026 round opens with its outcomes already legible — and the proof is its own rulebook.

ICANN calls the round’s rulebook the Applicant Guidebook.
Against 2012, the title reads literally: a guide compiled from the last round’s case files.

The final version was published in December 2025.
Three of its rules sit directly over 2012 wounds.

Closed generics.
In 2012, companies applied to hold dictionary words as private space — .book, .search — because nothing in that year’s rules said they could not.
The ban arrived retroactively, after the applications were in, and the strings went to the shelf: when the ICANN Board confirmed in January 2024 that the model stays banned in the new round, .search and .book had still not launched.
A dictionary word, bought a decade earlier, frozen by a rule change that came after the purchase.
This time the prohibition is in the book before the window: closed generic applications are off the table unless a public-interest test for them exists — and none does.
The interesting part is the admission inside the rule: the sharpest risk of 2012 was rule risk.
The terms changed after the purchase.

Backend operators.
In 2012, technical capacity was a promise inside the application — every applicant described the registry it intended to run, and evaluators read the description.
In 2026 the promise has been moved outside the application and tested first: ICANN published its initial list of evaluated Registry Service Providers on 30 January 2026, three months before a single application could be filed.
Every applicant must name, from that list, the provider that will run its extension’s machinery — the registry core, the DNS, the DNSSEC signing — before the extension can reach the root.
Anyone who has run registry-side infrastructure reads the shift instantly: the extension is the shop window, the backend is the plant.
The window display is about to gain hundreds of new names.
The plants will belong to a short list of operators — the visible market broadens while the invisible one consolidates.

The entry fee.
The bluntest mechanism of 2012 was the last-resort auction: when several applicants wanted the same string and refused to settle, ICANN auctioned it among them.
Sixteen strings went that way, and the bidding raised roughly 225 million dollars, which sat in a segregated fund with no assigned purpose.
That fund is now financing this round’s access program.
The Board routed 5 million dollars of it to the Applicant Support Program in September 2024 and another 4.9 million in March 2026 — enough to carry up to 75 supported applicants at a 75 to 85 percent discount on the evaluation fee, with bid credits and reduced operator fees behind it.
Seventy-five such applications were in the pipeline as of 19 March.

The money companies once spent outbidding each other for the same word now pays the entry fee of applicants the old price had excluded.

All three rules lean in the same direction: the round moved its risks forward.
The provider exam sits before the application, the ban before the window, the support decision before the round — the Applicant Support Program took applications from November 2024 to December 2025 and closed before the main window even opened.

The 2026 guidebook is the 2012 autopsy, reissued as rules.

Which turns this October into something unusual: a forecast published as a list.

About nine weeks after the window closes, ICANN makes every applied-for string public — Reveal Day, mid-October on the current schedule.
Every string and every applicant, visible at once.
The weeks in between are an administrative check: ICANN verifies the applications for completeness and accuracy.

If your company’s name appears on that list under someone else’s application, the clock is already running: the string list is confirmed two weeks after Reveal Day, and government early warnings and objection windows follow from there.
Checking the list takes one afternoon.
It belongs on a calendar now, because the deadlines will not wait for a quarterly legal review.
The grounds for objection are few and named, and the deadlines are short; anyone else gets the public comment period.

Contention has a pressure valve this time: an applicant whose string collides with another’s can switch to a pre-submitted replacement string within fourteen days of Reveal Day.
And an applicant that reads its own odds honestly can still leave — the round runs a structured refund schedule, in three windows.

For every other entry, the handbook supplies the reading.
The string itself tells you almost nothing — 2012 proved a perfect extension moves no one on its own.
A pre-evaluated backend is table stakes now.
The question that separates applicants is the one the last round actually asked, and the ghost towns failed: does anyone outside the applicant have a reason to type this extension?

That is also the one question the new rulebook cannot regulate.
Every rule in it repairs a supply-side failure — who may apply, on what infrastructure, at what price.
Demand is not in the book, because demand cannot be written into one.
Which is why the ghost towns remain possible, and why the reading skill matters.

The categories to sort by are the 2012 ones.
Behind a brand application, look for a migration plan — a placeholder-only future is visible from the outside.
Behind a generic word, look for the sales channel: the registrars who will actually offer it.
Behind a community application, look for whether the community exists anywhere outside the application.

And the calendar keeps the excitement honest.
Applications without contention or objections reach the root 14.5 to 19.5 months after Reveal Day — late 2027 at the earliest, with launches stretching into 2028.

A string on the October list is a claim, not a product.

Fourteen years ago, the industry read the reveal list as a treasure map, and priced it accordingly.
It was a forecast, and most of it has since come true — by category, if not by every string.

This October the list will be a forecast again.
The difference is that the method for reading it is now public — written into the round’s own rules, with a price list attached.

The first expansion was an experiment. This one is an open-book exam — and the book is 2012.

Magyar változat: [zona.hu/tizennegy-ev-utan-ujra-bovul-a-gyokerzona-a-2012-es-kor-a-kezikonyv/]

Voice.com sold for $30 million.

June 2019. One word, five letters, no website attached.

More than most companies will ever be worth.

It was the highest price ever paid, in public, for a domain and nothing else.

MicroStrategy, a NASDAQ-listed company, sold it; Block.one, a blockchain startup fresh from a multibillion-dollar raise, bought it.

A name like that lands on the balance sheet as an asset, carried beside the trademarks and the buildings — something the company holds.

What it actually holds is a line in a database that someone else keeps.

A .com resolves because one registry keeps the authoritative record and points the name where it is told.

That registry is a company in Reston, Virginia, operating .com under an agreement with the U.S. Department of Commerce. Owning voice.com — owning any .com — is that record continuing to name you.

Two things follow. Both have already happened.

In 1995 a man took sex.com with a forged letter — a single faked page a registrar accepted, the court later found, without ever calling the owner. When the case reached the Ninth Circuit in 2003, it ruled that a domain is property: it can be bought, sold, and stolen. It had been stolen the only way a domain can be — the registry changed the line.

In October 2020 the U.S. Department of Justice seized 92 domains with a warrant. No server was raided, no building entered. The seizure gave its reason in one clause: all 92 were “owned and operated by United States companies.” The names were American property because the companies behind them were American.

The name points where the registry says it points — and the registry answers to a government, not to you.

This is what the balance sheet hides.

A parcel of land is enforced by the state where it sits, and you sit there too. A one-word .com is enforced by a registry in someone else’s jurisdiction, reachable by that country’s courts, transferable on an order the registrant never sees drafted.

The title runs through a chain — ICANN, the registry, the registrar — and the registrant holds none of its links. For a buyer paying eight figures, or a deal team three days into due diligence, that is not a detail. It is the asset.

The $30 million was real. The asset was real.

What it bought was the right to have a database keep pointing one name at one owner — for exactly as long as the people who keep the database, and the government behind them, have no reason to point it somewhere else.

Magyar változat: [zona.hu/a-domain-tobbet-erhet-mint-maga-a-vallalat/]

July 8, 2008.

Microsoft, Cisco, Sun and the maker of BIND release patches for their nameservers on the same day. Same flaw, every product.

The advisory describes the fix in detail. The attack gets one sentence.

The man who found it asks for thirty days of silence before he explains.

His name was Dan Kaminsky. What he had found was not a bug in anyone’s product.

It was the protocol.

DNS matches every answer to its question with a 16-bit transaction ID. 65,536 possibilities. Dan Bernstein, the author of djbdns, had flagged the number as guessable back in 1999; mainstream implementations counted on the cache to hold an attacker to a few guesses a day.

Kaminsky’s finding: ask the resolver for names that do not exist. 1.example.com. 2.example.com. Each one is new to the cache, so each one opens a fresh race against the real answer — and a forged answer that wins a single race can inject new records for the entire domain.

Guess until you win, and the resolver is yours. Its users’ web traffic, their email, their password resets — all of it goes where you point it.

Kaminsky called Paul Vixie, the DNS veteran behind BIND. Vixie’s conclusion: “everything in the digital universe was going to have to get patched.”

That is what happened. Quietly, with the vendors — then all at once, on July 8. Kaminsky called it the first synchronized multi-vendor patch release the industry had ever carried out.

The patch did not fix the flaw.

It could not. The 16-bit field sits in the protocol itself; replacing it means replacing DNS. So the patch added a second number to guess — the source port of every query was randomized, roughly sixteen more bits in front of the same design. CERT’s advisory said it openly: without changes to the protocol, these mitigations cannot completely prevent cache poisoning.

An attack that once needed tens of thousands of packets now needs billions. The flaw remains. It just costs more to hit.

The patch was a price increase, not a fix.

The plan gave the world thirty days to patch before Kaminsky explained the technique at Black Hat. It got thirteen — on July 21, a security firm’s blog post spelled the attack out. The post came down quickly. The mirrors did not.

The protocol-level repair exists: DNSSEC. Sign the answers cryptographically, and a forged one fails no matter how many packets the attacker sends.

Geoff Huston, APNIC’s chief scientist, ran the adoption numbers in 2023. 4.3 percent of .com domains were signed. google.com, amazon.com and microsoft.com were not among them. When weighted by traffic, about one percent of the world’s DNS queries ended in a cryptographically validated answer.

Eighteen years after the one-day patch, the price increase is still doing most of the protecting.

If your company’s domain is unsigned — more than 95 percent of .com was at the 2023 count — the barrier between your customers and a forged answer is a guessing game whose odds were last raised in 2008. Signing is a checkbox at your DNS provider and one change-control ticket. In most organizations it is nobody’s job.

In 2010, ICANN selected seven people to hold recovery shares of the key that signs the root of the DNS. Kaminsky was one of the seven. He died in 2021.

The internet gave the man who proved its answers could lie a piece of the key that makes them provable — and kept running on the stopgap.

Magyar változat: [zona.hu/tizennyolc-eve-egy-ideiglenes-megoldas-vedi-az-internetet/]

You let it lapse for a week.

You went back for it. Gone.

Wasn’ a person who bought it.

A machine caught it in the second it came free.

A dropping domain goes to whoever holds the most connections to the registry — and you hold none.

The schedule is public and fixed. After a .com expires, the owner gets up to several weeks of grace, then a 30-day redemption window where restoring the name can cost around $100, then a five-day “pending delete” lock. Only at the end does the name release to anyone.

That release is the whole game.

Registries cap how many registration attempts a single registrar can fire each second. And the direct connection to the registry — the EPP channel — exists only for ICANN-accredited registrars. A registrar has to reach it for you.

The drop happens on a schedule the catchers track, so their systems are already waiting when the name clears.

So the catchers became registrars. By the thousand.

By Domain Name Wire’s 2024 analysis of Verisign’s ICANN filings, DropCatch.com — operated by TurnCommerce — ran 1,201 registrars on top of its main accreditation, around 45% of ICANN’s variable registrar fees, which gives it more connections to attempt at the instant a name drops.

Whoever owns the most registrars wins the drop.

When the name finally releases, a flood of automated requests hits the registry in the same second. The firm with the most registrars wins by arithmetic. A backorder runs from $13 to $59 — but when two of that firm’s customers want the same name, neither gets it at that price. It goes to a private auction between them.

TurnCommerce both runs drop-catching for customers and, by Domain Name Wire’s reporting, stocks its own HugeDomains resale inventory from expired names. Catching and reselling can therefore sit within one company.

For anyone whose brand or product rides on a domain, the exposure begins the moment a name you need reaches the drop. By then it is already gone — taken by software in the instant it cleared. What is left is buying it back, at the catcher’s price.

The open market for a deleted domain is open to everyone and winnable by almost no one.

The schedule is fixed and the registry connections are gated, so the outcome is set before the name comes free.

You were never slow. You were never in the race.

The name left your hands the second you stopped paying, and the only thing still open was which automated system would reach it first.

Magyar változat: [zona.hu/a-domain-amit-elfelejtettel-meghosszabbitani-mar-mase-elkaptak/]

September 2010.

A two-letter domain vanishes from a registry in Tripoli.

No court order. No billing dispute. According to its owners, no warning either.

The reason, when it finally came: the site had violated the law of a country neither owner had ever visited.

vb.ly was a URL shortener owned by the tech consultant Ben Metcalfe and the American journalist Violet Blue.

The name worked because of the suffix — the same trick that makes bit.ly read as a word.

.ly is the country code of Libya.

On or around September 23rd, 2010, NIC.ly, the Libyan registry, deleted the domain.

The first explanation Metcalfe published cited “text referring to adult content and offensive imagery” on the landing page.

When he escalated, an official in the registry’s web services department pointed to clause 3.5 of the registration terms — the applicant certifies the domain serves no purpose “not permitted under Libyan law” — and closed the case in one sentence:

“Pornography and adult material aren’t allowed under Libyan Law, therefore we removed the domain.”

The owners said the site carried no pornography at all.

The domain stayed deleted.

Jurisdiction doesn’t follow your server. It follows the dot.

Every country-code domain is national infrastructure.

ICANN delegates it to a local operator and steps back; everything after that is domestic policy.

The .ly terms in force at the time barred names that were “obscene, scandalous, indecent, or contrary to Libyan law or Islamic morality” — a clause every registrant accepted at checkout, buried in the one contract in the digital stack that nobody reads.

And there is no appeals body above a country-code registry.

A gTLD dispute has the UDRP. A ccTLD content decision is a domestic administrative act.

The appeal goes to the office that deleted you.

Then there is the calendar.

Three months earlier, NIC.ly had restricted domains shorter than four characters to registrants with a presence in Libya.

The deletion notice Metcalfe published said vb.ly would become “available for re-registration for locals.”

He read that line as motive — a two-letter .ly, once deleted, could never return to a foreign owner. The reading is his; the policy and the sentence are documented.

A country-code domain is national territory, leased.

The lease prices in a legal system, a political mood, and a registry’s reading of morality — none of which the tenant controls, all of which can change without notice. The June 2010 rule change arrived unannounced.

The same lease sits under .ai, .tv, .io — under every clever name built on someone else’s country code.

If your brand or your growth funnel lives on a domain hack, a foreign registry’s policy office holds your kill switch.

Sixteen years on, the world’s best-known short links still end in the country code of Libya.

The bet is still open. vb.ly is what losing it looked like.

Magyar változat: [zona.hu/a-linkroviditod-egy-olyan-orszag-torvenye-alatt-all-ahol-sosem-jartal/]

You have typed it a thousand times.

The name on your business card. The address bar. The text after the @.

You treat it as a place. Somewhere your site lives, like a building at a street number.

It is not.

Your domain name is a question.

Every time someone reaches you, their machine asks it out loud — and waits for a stranger to answer. The browser does not know where your site lives. It asks a resolver, usually one run by the visitor’s internet provider or by a public service. The resolver, knowing nothing yet, asks a root server: who handles names ending in this extension? There are thirteen root identities, run by twelve organizations across more than a thousand machines, and one of them answers with a referral. The resolver then asks the registry that operates your extension — the organization behind .com, or .hu, or whichever you chose. The registry points to your nameserver. Only at the end of that chain does an answer come back: here is the number, go there.

This runs on every single visit. Most of the links in the chain belong to someone else.

You did not build the root. You do not run the registry. The resolver belongs to your visitor, not to you. You control, at most, the last link — the nameserver — and even that you usually rent from a provider. The system has asked, since its earliest days, that you publish at least two nameservers so the last link is never a single machine. Almost nobody checks whether their two sit in the same building, on the same network, behind the same single account.

Redundancy that shares a single failure is not redundancy.

Then there is what the chain remembers.

Change where your name points, and nothing travels outward. There is no signal that fans across the internet, no master switch that updates the world at once. Each resolver simply keeps the last answer it was handed until the clock on that answer runs out. The clock is the TTL — time to live, a number in seconds that you publish in advance. Set it to a day, and a mistake you make at noon is still being served at midnight. Set it to five minutes, and you can move your whole presence in the time it takes to drink a coffee. The reach of a change is decided before you ever make it.

Nothing propagates — the old answer simply expires.

This is why the careful engineer lowers the TTL days before a migration, long before touching anything that matters. The lever only works if you pull it early.

The stranger your visitor asks is not even one you picked.

Most people now reach the internet through a handful of public resolvers — Google’s 8.8.8.8, Cloudflare’s 1.1.1.1, whatever their device or provider sets by default.

Your visitor’s speed, the freshness of the answer they get, even whether they reach you at all, depend on a machine you have no contract with and cannot see.

When the chain works, none of this is visible. When it breaks, it tends to break for everyone at once.

It has broken, in public, in ways worth remembering.

On 21 October 2016 attackers aimed a botnet of hijacked cameras and baby monitors at a single DNS provider, Dyn. For hours, users across Europe and North America could not reach Twitter, Spotify, Reddit, PayPal, Netflix, or GitHub. Those companies were fine. Their servers never went down. The question simply went unanswered, because the machine whose job was to answer it had been buried under junk traffic.

Five years later the failure ran the other way. On 4 October 2021 a routine maintenance command inside Facebook accidentally cut its data centers off from its own backbone network. Facebook’s nameservers, by design, withdrew themselves from the internet’s routing map the moment they could no longer reach home. In Facebook’s own words, the servers “became unreachable even though they were still operational.” Facebook, WhatsApp and Instagram vanished for roughly six hours — not because the answerers were attacked, but because they took themselves off the map and no one could find them to ask. The same failure locked Facebook’s own engineers out of the internal tools they needed to fix it, and sent a global flood of retries at the public resolvers, which saw DNS traffic spike many times over.

One answerer drowned. The other disappeared. The names behind some of the largest companies on earth went silent either way.

And the answer does not even have to be true.

A resolver believes what it is told.

The original protocol protected each question with a number only sixteen bits wide — about sixty-five thousand possibilities, few enough to guess at speed. In 2008 the researcher Dan Kaminsky showed how an attacker could exploit that narrow gap to slip a forged answer into a resolver’s cache and make it stick — pointing a perfectly valid name at a server the attacker controlled. The industry shipped a fix on a single coordinated day, but it widened the guessing game rather than ending it.

The real repair is DNSSEC, which signs answers cryptographically so a resolver can tell a real one from a forgery.

More than fifteen years on, most of the names you use every day are still unsigned. For those, the chain runs on trust: whoever answers first, and convincingly enough, is believed.

That is the quiet danger. A stranger can answer in your name, and the visitor has no way to tell.

There is one link deeper than all of these.

Every answer in the chain begins as a record someone set — in an account, at a registrar, under a registry. Control that account, and you do not need to attack anything.

You change the answer at its source, and the whole internet, dutifully, begins handing out your new one. In 2019 ICANN warned of exactly this: a campaign that rewrote the records behind targeted names to reroute their traffic. No servers were breached. The answer was simply changed where it is written.

Your reachability is a chain of answers, and you hold almost none of the links.

Decision-makers buy redundancy for the things they can see. Two power feeds. Two data centers. Spare bandwidth. The name that points to all of it usually runs through one provider, on one account, secured by one password, handing out one answer with no spare. The single most load-bearing object in the company sits in the one place no one was asked to defend.

The work, once you see the chain, is unglamorous and specific.

Use more than one DNS provider, so that one provider’s bad day is not automatically your own.

Guard the registrar and registry account harder than you guard the servers, because that account is the source of every answer the world will give about you.

Turn on every lock the registrar offers, put that account behind multi-factor authentication, and tie it to a contact address that won’t walk out the door when someone leaves.

Watch the expiry date the way you watch payroll, because a name allowed to lapse is answered, within minutes, by whoever was waiting for it to fall.

Lower the TTL before you move, not after. Know which stranger speaks for you — and know who is allowed to change what they say.

None of it is exotic. It is just ownership.

The name on your card was never the place you live.

It is a promise that when a stranger asks for you, someone will answer in your name.

The only thing worth knowing is who you have trusted to speak for you — and whether, on the day that voice is drowned, withdrawn, forged, or quietly rewritten, anyone is left who can still answer.

Magyar változat: [zona.hu/a-domainnev-egy-kerdes/]

The most-trafficked domain on the internet went up for sale.

Twelve dollars.

At the checkout, like any other domain name.

In September 2015, Sanmay Ved was awake late, clicking around Google Domains — Google’s own registrar.

He typed google.com out of habit.

He had worked at Google for five and a half years; poking at the product was reflex.

The interface showed a green icon, not the gray one that means a domain name is taken.

Available.

He added the world’s busiest web address to a shopping cart, entered his card, and the charge went through. Twelve dollars.

Then the confirmations started — not a generic receipt, but owner notifications.

His Google Search Console filled with messages meant for whoever controlled google.com.

Internal emails arrived.

For about a minute, the webmaster controls for Google’s flagship domain answered to a graduate student’s account.

Nobody broke in.

There was no exploit, no stolen credential, no clever payload.

The thing protecting google.com was its registration — the quiet assumption that the domain name stays yours because someone, somewhere, keeps the record current. No firewall sits in that path. There is nothing there to hack.

That assumption is the whole security model. And it runs on a clerical task.

A domain is not property you own. It is a lease you renew. Miss the renewal, or let the registrar’s internal state slip, and the asset does not degrade slowly — it becomes available. Purchasable. By anyone at the checkout, in the same flow that sells a hobbyist a blog address.

The last line of defense is a renewal — and renewals are clerical.

What matters for a decision-maker is where this mistake lived: in the administration, not the engineering.

Most companies guard the things that feel dangerous: the servers, the endpoints, the logins. The domain sits in a registrar account that often has no named owner, no audit trail, no multi-factor, and no line in the security policy. It renews on a credit card that expires. It depends on an email address belonging to someone who left two years ago.

The most expensive loss in your infrastructure can come from your own renewal calendar — no attacker required.

Ved reported it. Google paid him $6,006.13 — a number that reads as “Google” if you squint — then doubled it to over twelve thousand dollars when he asked that it go to charity.

He could have just kept clicking.

What kept the world’s most valuable domain safe was a renewal, not a firewall, nor multi-factor protection.

And that renewal almost didn’t happen.

Magyar változat: [zona.hu/a-vilag-legertekesebb-domainjet-nem-loptak-el/]

You chose the extension for how it reads.

.com because it sounds established. .io because it sounds clever. A country code because it sounds like home.

A branding call. A matter of taste.

It was neither.

The extension is the legal system your name lives under.

Every other decision about your domain name can be undone. You can switch registrar, move host, rewrite the content, sell the company that holds it. The one thing you fixed the day you registered was the body that runs the zone — and the country whose law that body answers to. That choice does not appear on any invoice, and you cannot reverse it without giving up the name.

Behind every extension stands a state

A registry is the organization that operates a top-level domain and keeps the master record tying each name to its holder. You never buy a name from it. You hold a renewable entry in its database. Change the entry and the name moves. Lock the entry and the name is gone.

Behind every registry sits one legal system. The .com and .net zones are run by Verisign, a company incorporated in the United States. The newer endings each answer to a registry that sits somewhere specific as well. And every country-code ending — .de, .cn, .ir, .io — is operated under the law of the territory whose code it carries.

You did not register a name. You registered into a jurisdiction.

And the jurisdiction is not the one where you live, bill, or keep your servers. It is the one stamped on the last letters of your address — chosen, almost always, for how those letters looked.

The .com is a doorway into American law

Start with the ending that feels safest, because it feels like nowhere. A .com reads as global, neutral, unowned. It is none of those things. It is United States infrastructure, and a U.S. court can reach anyone who registers one.

In 2012 a federal grand jury in Maryland indicted Bodog Entertainment Group, a sports-betting business run out of Canada and Costa Rica, for taking bets from gamblers in a state where sports betting was illegal. The operators were abroad. The money moved through Switzerland, England, and Malta. The company was charged, not convicted. None of it slowed the seizure. A Maryland court issued a warrant, and the .com registry handed control of bodog.com to U.S. Immigration and Customs Enforcement.

A year earlier the same program had reached a Spanish company that had done nothing wrong at home. ICE seized rojadirecta.com and rojadirecta.org from Puerto 80, a sports-streaming business a Spanish court had already examined and found legal. The domains stayed dark for a year and a half. Then, in 2012, the government returned them without explanation and let the case drop.

Read those two cases side by side. One holder was accused and lost the name. The other was cleared at home and lost it anyway, for eighteen months, with no charge that ever stood.

A .com puts your name within reach of a court you will never stand in.

The mechanism is the part outsiders never see. The seizure does not happen at your registrar, your host, or your office. It happens at the registry, on the order of the registry’s own government, and your provider simply watches the record change.

A domain name is not taken where you operate — it is taken where its extension is run.

A country code is a government you inherit

Choose a national ending and the knot pulls tighter. You do not just enter a legal system. You adopt a state — its politics, its morality code, its current mood.

In 2010 the Libyan registry deleted a .ly domain name because its content, in the registry’s reading of its own rules, fell outside Libyan law and Islamic morality. The holder had broken no law where he lived. He did not need to. The name sat under Tripoli’s rules, not his. The holder’s own complaint was that the registry judged the website’s content, not just the registration. Every ending tied to a country that filters speech or sits under sanctions carries the same freight: the regime travels with the letters, whether you meant to sign up for it or not.

The flag in your extension flies whether you salute it or not.

The ending can outlive — or outlast — its country

The deepest exposure is the one no contract mentions. A country-code domain rests on the country continuing to exist in the eyes of a list almost no one has read: ISO 3166-1, the standard that decides which two-letter codes are real. ICANN does not judge what is a country. It follows that list.

.io belongs to the British Indian Ocean Territory, whose sovereignty the United Kingdom agreed in 2024 to transfer to Mauritius. ICANN has said plainly that nothing is decided and much of the talk is speculation. But its own rule is on the record: should the IO code leave the standard, a five-year clock starts to retire the domain.

The graveyard is real, and so is the reprieve. When Yugoslavia dissolved, its .yu domain was removed from the internet’s root in 2010, the last of its kind switched off on schedule. Yet .su, the Soviet Union’s code, was dropped from the standard back in 1992 and still runs today — an extension that has outlived its own country by more than three decades, its retirement only now being set in motion.

A naming choice made in a boardroom can come to rest on a treaty, a standards committee, and the survival of a state.

None of those parties knows your company exists. All of them can decide whether your address keeps working.

Even the fight over your name follows the ending

There is a quieter version of the same rule. When someone challenges your right to a name, the forum is fixed by the extension, not by you.

Every gTLD — .com, .net, and every new ending — carries ICANN’s Uniform Domain-Name Dispute-Resolution Policy by default. Anyone in the world can file against your .com before a WIPO panel, and an arbitrator who never enters a courtroom can order the name transferred out from under you. Country codes are not bound by that policy. Each national registry sets its own: some adopt the global rules, many run their own variant, a few send the fight to local court.

So the same trademark dispute over the same brand can be decided under three different systems — chosen by nothing more than the letters after the dot.

What a decision-maker actually holds

Stand all of this up and the shape is plain. Your primary domain name is the one asset whose governing law you never negotiated. You chose it for the sound, and the law came attached: invisible, and impossible to change without giving up the name your whole identity runs on.

You can be flawlessly compliant in your own country and still lose the name — to a foreign court, a sanctions list, a content rule in a capital you have never visited, or a sovereignty deal you are not party to. None of that shows on the balance sheet. All of it shows the day the record changes.

So the extension belongs on the same risk register as the country where you incorporate — legal exposure, and it has been from the first day.

You can move your company, your servers, and your bank.

The one thing you cannot move is the law that arrived with the last letters of your name.

Magyar változat: [zona.hu/vegzodest-valasztottal-joghatosagot-is-valasztottal/]

Two firms merge.

The old name appears on the letterhead one last time, then disappears.

A year later someone registers the abandoned domain for the price of a coffee.

The firm’s mail starts arriving in a stranger’s inbox.

No one hacked anything.

Whoever owns the domain owns the mail.

A domain is the thing email runs on.

Its MX record tells every mail server on the internet where to deliver messages addressed to that domain.

Register the lapsed name, point the MX record at your own server, switch on a catch-all, and every message sent to anyone at the old address lands in your inbox. No password is involved.

You own the namespace, so you own everything addressed to it.

Then it gets worse.

The people who worked at the old firm used those addresses to sign up for things — Microsoft 365, Google Workspace, LinkedIn, the court filing portal, the practice-management software.

The accounts are still live.
Many of those people have since moved to new firms. And every one of those services has a button that says “forgot password.”

The reset link goes to whoever owns the domain.

An attacker does not even have to go looking.

Many TLD registries publish expiring names in daily drop lists. Cross-reference them against any week’s merger announcements, and the work is done for you.

This is most dangerous at the precise moment a domain gets dropped: a merger, an acquisition, a rebrand, a wind-up.

That is when the old name becomes nobody’s job to renew. In 2017 there were 102 mergers among top-tier US law firms alone; at the small-practice level the number runs into the thousands.

The exposure outlives the business.

The mail keeps arriving — from clients, banks, opposing counsel — to a firm that no longer exists. The outside world keeps trying to reach the former staff through the address they left behind.

Gabor Szathmari, an Australia-based security researcher, proved it.

Over three months in 2018, he re-registered six abandoned domains, several of them formerly belonging to Australian law firms, and pointed their mail at himself.

Without hacking anything, he received confidential client documents, bank correspondence, and invoices from other firms.

He showed he could reset the passwords on the firms’ Microsoft 365 and Google accounts and on former staff’s LinkedIn and Facebook profiles — then deliberately stopped short of logging in or taking any account over. (On one Microsoft 365 account, two-factor authentication blocked the reset.)

From past public data breaches, he recovered the real passwords of roughly thirty legal professionals.

The systems a company uses every day get a security budget — the firewall, the multi-factor prompts, the staff training.

The domain it stopped using gets a renewal notice nobody opens.

That unpaid fifteen dollars is the key to everything the other line items were bought to protect.

Magyar változat: [zona.hu/adatlopas-egyszeru-ujraregisztracioval-egy-elfelejtett-domain-ara/]

You bought your domain name.

It’s on the balance sheet. It’s in your brand, your email, every contract you sign.

But you don’t own a thing.

You hold a relationship.

What changed hands when you “bought” it was not the name. It was a renewable claim against a registry.

This is not a metaphor, and not the cynical line that you are “only renting.” It is what the courts of the major jurisdictions actually hold — and they do not agree with one another. The same object is property in one country and explicitly not property in the next.

A registry is the body that runs an extension — a TLD — and keeps the record that ties the name to you. You do not buy the name from it. You receive the use of it, for a fixed term, against a renewal fee. Let the fee lapse and the right ends — the name returns to the market, and someone else can take it.

Europe cannot agree

Germany has thought about it the hardest. Its Federal Constitutional Court ruled in 2004, in the “ad-acta.de” decision, that the holder of a domain name acquires neither ownership of the internet address nor any absolute right in it. What the holder has is a contractual right of use against the registry, DENIC. And the same court placed that contractual right under the property guarantee of Article 14 of the Basic Law. The logic is less strange than it sounds. What the constitution protects is not the address as a thing, but the value you build on the name — the position you paid for and depend on. Take that away arbitrarily and you have taken property, even though you never owned the address. A year later the Federal Court of Justice said what that means in practice: a domain name can be seized by a creditor — but the thing seized is not the name. It is the totality of the contractual claims the holder has against DENIC.

Austria reached the same destination. Its Supreme Court holds that what can be seized is not the string but the bundle of contractual claims the holder has against the registry, nic.at.

Strasbourg confirmed it from above. In 2007, in Paeffgen v Germany, the European Court of Human Rights held that the contractual right to use a domain is a possession protected by the European Convention on Human Rights. Across the continent, even read as a mere contract, the right ranks as property worth protecting.

The United Kingdom runs one of the oldest country-code registries, and it cannot make up its mind. Nominet’s own terms state plainly that a domain name is not property. In 2021 the High Court held the opposite: in Hanger Holdings v Perlake, fought over blackjack.com, an English court ruled for the first time that a domain name is intangible personal property. The court had to decide it because a buyer who had paid for the domain fell behind on the commission it owed, the seller wanted the name back — and to hand it back, a court first had to settle whether a domain can be owned at all. The registry says one thing; the court says the other, inside the same legal system.

Sweden went further. When the state moved against The Pirate Bay, a Stockholm court ruled in 2015 that the .se domain names were property that could be forfeited; an appeal court upheld it in 2016, and the names passed to the state.

The rest of the continent scatters across the same spectrum. Italy’s industrial-property code treats the domain name as a distinctive sign, the way it treats a trademark. France grants a renewable right of use, which its own practice then books as an intangible asset. Switzerland calls it a contractual right and protects it through name and unfair-competition law. The Netherlands frames it as a registration contract with the registry. Hungary’s .hu rules describe registration as a use-based legal relationship, and its case law has at times also read a domain name’s use through the lens of name and personality rights.

Outside Europe the picture stays just as split. In the United States it depends on the state: California courts call the domain name intangible property that can be bought, sold, even stolen — the sex.com case turned on a single forged letter — while Virginia’s highest court held it is the product of a service contract and cannot be garnished at all. Russia leaves it off the civil code’s list of intellectual property and calls the holder’s right an administration right. China’s Civil Code reaches it from yet another direction, under the heading of “network virtual property.”

The common truth

From inside the system, the confusion dissolves. The person the industry calls the registrant — never the owner — is a line in someone else’s database. The registrar you pay is only the intermediary; the registry keeps the record. What you have is a set of claims on that record: that the name appear in the DNS, that it resolve, that the details stay correct, that it transfer when you sell. Change the line, and the domain name moves. That is why it can be taken with a forged letter and returned by a court order: there is no object to hand over, only a record to correct.

Read together, these rulings say one thing.

Even where the law calls it property, what you hold is a bundle of contractual claims against a registry — never the name itself.

That is the truth beneath the disagreement. The doctrine cannot settle the category; the economics never argued about it at all. In every one of these systems the domain name behaves like an asset — it is bought and sold, inherited through probate, taxed, reached by creditors. A thing you can lose to a creditor in Vienna, forfeit to the state in Stockholm, and carry as an intangible asset on a balance sheet in Paris is property in every way that pays. Its legal title is simply not a title to a thing. The distinction has consequences: it decides how the asset passes, how it can be seized, and what happens to it when the company behind it dies.

For a decision-maker, that gap is the whole point. The domain name sits on your balance sheet and in your estate. It passes to your heirs, like any asset. It can be seized by a creditor, moved in a merger, contested in a divorce. In an acquisition it is its own line of due diligence — because the title does not live where you assume it does: not at the company, but in a registry account, in a single record.

Its legal core is a renewable contractual position.

Kept in a register you do not run, that lapses the moment no one pays. And in most organizations it is the one asset of this value with no clear owner inside the company: too legal for IT, too technical for the lawyers, invisible to finance. The asset is real. The control is borrowed.

So the question of who renews it, and who holds the keys to the registry account, is not IT hygiene. It is asset stewardship.

It belongs on due-diligence checklists, in succession planning, in the same asset register as the trademarks it sits beside — the rarest kind of asset, the one whose worth your accountant can name to the cent and whose legal nature no court has ever managed to fix.

The balance sheet knows exactly what it is worth.

The law still does not know what it is.

Magyar változat: [zona.hu/egy-domain-egy-tucat-jogrendszer-egy-kozos-nevezo/]

Ask a chatbot where to log in to your bank.

One time in three, it names a domain the bank does not own.

No typo. No prompt injection. The default answer, delivered with full confidence.

And it gets it wrong the same way for everyone who asks.

In July 2025, Netcraft asked a model from OpenAI’s GPT-4.1 family for the login pages of 50 brands. It returned 131 hostnames. Two-thirds were correct. The rest were not: nearly thirty percent of the suggested domains were unregistered, parked, or dormant, and another five percent belonged to unrelated companies. A third of the answers pointed somewhere the brand did not control.

An unregistered domain is not a dead end. It is a vacancy.

This is where the domain problem starts.

A wrong answer that changes every time is noise.

A wrong answer that repeats is an address.

If a model reliably sends thousands of people to the same unowned domain, the cheapest operation in security is to register it and wait.

Ten dollars buys the door the machine keeps recommending.

It has already happened one namespace over.

In March 2024, the researcher Bar Lanyado noticed AI assistants repeatedly recommending a Python package that did not exist — huggingface-cli.

He registered the available domain name himself.

In three months it drew more than 30,000 genuine downloads.

A research repository published by Alibaba listed it in its install instructions.

The package was harmless; Lanyado built it to prove the point. An attacker would not have.

The model invents a domain name, enough people trust it, and whoever owns the domain owns the traffic.

A 2025 USENIX study ran 16 models across 576,000 code samples and catalogued 205,474 distinct hallucinated package names.

The same mechanism produces hallucinated domains.

The obvious defense — register every variant first — does not survive the arithmetic. The variations are unbounded, and AI answers strip away the signals users were trained to check: the visible URL, the age of the domain, its reputation.

Right now the wrong answer is only a suggestion, and a person can still override it.

That window is closing.

As AI agents move from suggesting to acting — registering domains, pulling packages, wiring payments inside automated workflows — the hallucinated name stops being a suggestion and becomes a transaction. With money behind it, and liability attached.

A domain has always been worth what a human would type.

Now a machine answers too, and it gives everyone who asks the same answer — the same right ones, and the same wrong ones.

Predictable is worse than random. An attacker can register the machine’s favorite mistake and wait.

Magyar változat: [zona.hu/az-ai-mindig-ugyanazt-a-rossz-domaint-ajanlja/]

Over 1.6 million people worldwide have registered an .io domain.

Yet, almost none of the owners have ever set foot in the territory the extension belongs to—in fact, most probably couldn’t even find it on a map.

.io is the country code for the British Indian Ocean Territory — a scatter of islands with no permanent population, where the only residents are military personnel on rotation.

In October 2024 the United Kingdom agreed to hand the Chagos Archipelago to Mauritius.

The treaty was signed on 22 May 2025.

Founders read the news as a countdown to the death of their domain.

Whether .io survives is not ICANN’s decision.

A two-letter domain exists only because the two letters exist first in ISO 3166-1, the international standard for country codes.

That standard is maintained by the ISO 3166 Maintenance Agency: fifteen voting members seated in Geneva, national standards bodies alongside the Universal Postal Union, the International Telecommunication Union, the International Atomic Energy Agency, the International Civil Aviation Organization, and ICANN.

ICANN is one voting member of fifteen.

The same code that points a browser to a .io site also sorts international mail, identifies a bank in a wire transfer, and appears in the machine-readable strip of a passport.

The internet is one user of that table among many.

Removal is not automatic even if “British Indian Ocean Territory” stops being a name.

The agency can move a retired code to an “exceptionally reserved” list.

SU outlived the Soviet Union there.

UK is on the list too, though Britain’s official code is GB — as is Ascension Island’s AC.

IO is an entry in a standards table the internet does not control.

A company built on .io has no one to lobby.

There is no ICANN petition that settles this.

The question moves through postal and telecom delegates on a timeline measured in years, and the registry’s overseers have already signaled no change within five years.

The force most likely to keep .io alive is financial.

.io is run by Identity Digital, a registry owned by the private-equity firm Ethos Capital, and industry estimates put a live .io’s annual renewal revenue in the tens of millions.

That number predicts the next few years better than the treaty does.

The territory itself never saw that money.

The UK government says it has no agreement with the registry and takes no revenue from the domain.

A British businessman operated .io privately from 1997, then sold the company that ran it for about $70 million in 2017.

The Chagossians, the islanders Britain expelled in the early 1970s, filed a complaint in 2021 to take the domain back.

They lost the islands first.

The two letters that built a fortune were never theirs to lose.

Magyar változat: [zona.hu/az-io-eletben-maradasa-egy-genfi-bizottsag-kezeben-van/]

It is the cheapest line on your invoice.

A few dollars a year, filed under software subscriptions.

At most companies, no one can say from memory whose name it is registered under.

And it is the one line that can erase the company.

The foundation everything stands on

Start with what the domain name actually carries.

Your email runs on it. Your website resolves through it. Your single sign-on, your VPN, your customer logins, the certificates that tell a browser you are really you — all of it hangs from the same domain name.

It sits below the layer everyone watches. No dashboard tracks it, because a working domain produces no signal. It resolves, every millisecond, until it doesn’t.

Ask who renews it, and the honest answer is often a credit card that belonged to someone who left two years ago.

When the domain name stops, nothing degrades gracefully. Email stops. Logins break. Certificates turn invalid. All at once — because all of it was keyed to one name.

This is not hypothetical. In February 2019, ICANN, the body that coordinates the name system, warned of an “ongoing and significant risk” to key parts of the DNS infrastructure — an active campaign of attackers rerouting traffic by altering the records that sit beneath the name.

NIS2 elevates DNS providers and top-level domain registries to the EU’s highest tier of critical infrastructure oversight — alongside energy and banking — and extends cybersecurity obligations across the wider domain name ecosystem, including domain registration providers.

The domain is the foundation the building stands on, not the sign above the door.

The asset someone else can buy

Now look at the same name from the outside.

That cheap invoice line trades on a live, global market. At the end of 2025 there were 386.9 million domain names registered worldwide — a deep, liquid market where names are bought, sold, brokered, and parked. The number is enormous, but the scarcity that drives price sits in the few names that matter: the short, the memorable, or the one that is exactly yours.

In 2019 a single name, voice.com, changed hands for $30 million — the highest price ever publicly disclosed for a domain name.

The asymmetry is the whole point. The name costs almost nothing to hold and can be ruinous to lose.

Its value is not fixed to you. It is whatever the market — or a competitor, or an attacker — decides it is worth the moment you let go.

And letting go is not abstract. A missed renewal frees the name, and specialised firms watch the expiry queues to register the ones worth money the instant they drop, faster than any human could react.

You never sold the name. You let it lapse — and that difference is invisible until someone else is holding it.

The identity that is you

The third face turns a nuisance into a crisis.

The domain is not only what you run on and what you could sell. It is who you are.

To your customers, it is your brand. To a mail server, it is the proof that a message is really from you. To a login system, it is the authority that says an account belongs to you.

Control the domain, and you can be the company.

The password-reset link is the quiet one. Hold the name, receive its mail, and the reset links for everything else begin arriving in your inbox.

This is measured. In its 2024 Domain Security Report, the corporate registrar CSC found that 107 of the world’s largest public companies scored zero on the basic protection of their own domains.

Not weak. Zero.

And taking over your domain is only the direct route. The same report found that 80% of registered domains resembling a Forbes Global 2000 brand do not belong to that brand — and 42% of those lookalikes carry mail records. To send mail as you, an attacker often does not need your name at all. A close enough copy will do.

The blind spot on the org chart

Stack the three faces, and the real problem appears.

The infrastructure belongs to IT. The asset belongs to finance, or to legal, or to whoever signs the acquisition paperwork. The identity belongs to marketing and brand. One object, three natures, three different owners — each quietly assuming one of the others is watching it.

So it falls into the gap between them.

This is the part the industry itself admits. Authentic Web, a company that sells corporate domain management, describes the typical large enterprise plainly: domains handled across siloed departments, with “single-point accountability for the end-to-end domain management lifecycle” simply missing. Organisations, it notes, cannot clearly say who internally is responsible.

There is a whole industry of tools to close this gap. Mature, capable, and sold to exactly these companies — the best-resourced buyers on earth. And 107 of them still score zero, not because the fix is unaffordable, but because the job belongs to no one.

Which tells you the missing piece was never a tool.

The blind spot is on the org chart.

Who holds the key?

So this is what the cheapest line on your invoice actually is. The foundation your operation runs on. An asset someone else can take the instant you forget it. The identity that lets the world believe you are you. One name carrying all three, defended by no one in particular.

A tool can manage that name. It cannot decide who is responsible for it.

A tool is the second question. The first one is simpler, and harder.

In your company, who holds the key?

Magyar változat: [zona.hu/infrastruktura-vagyonelem-identitas-harom-szerep-egy-domain-nulla-felelos/]

Yugoslavia no longer exists. Neither does its domain, .yu.

The Soviet Union dissolved in 1991. Its domain, .su, lives on.

Iraq still exists. But a single federal criminal case — Hamas financing charges, Texas, 2002 — was enough to paralyze .iq, Iraq’s entire internet namespace, for years.

The real danger is not a country vanishing from the map. It is a country that is perfectly fine — and gets erased from the internet anyway.

Because the weak point is not geopolitics. It is a bad contract, an operator subject to a foreign jurisdiction, or a court ruling from another country.

The next ccTLD crisis will not come from a country breaking apart.

It will come from a Registry, a foreign Registry Services Provider (RSP), or a TLD nameserver operator — headquartered somewhere near Washington, London, or Brussels.

One morning, updated OFAC, OFSI, or EU sanctions guidance lands, and suspending a national namespace becomes that operator’s safest legal option. No war. No dissolved country. No ICANN resolution — just a contractual decision, taken under legal pressure, that can be executed in hours.

In 2022, this nearly happened — at significant scale.

Ukraine’s Deputy Prime Minister asked ICANN to remove .ru, .su, and .рф from the DNS root zone. ICANN declined the request, stating that it had neither the mandate nor the authority to impose sanctions.

But what about the actors deeper in the contractual chain? ICANN has no authority over them either.

Switzerland-based SITA — operator of the .aero TLD — refused to renew approximately 400 .aero domains registered by Russian organizations. Why? Because the actual contracting entity was a US-based subsidiary operating under OFAC jurisdiction. The DNS root zone remained intact. The domains disappeared anyway.

The real risk is not in the IANA delegation, and not in the root zone. It is in the underlying operational contracts.

Many small and mid-sized countries run their national domains on American or British infrastructure — under contracts that include governing law clauses and sanctions compliance obligations.

The naming right belongs to the country — the IANA delegation. The technology belongs to a foreign company — the database, the DNS servers.

.sk is the textbook example of this structure. The IANA-delegated operator, SK-NIC, a.s., is a Bratislava-registered company; since 2017 it has been owned by Team Internet Group, a British firm listed on London’s AIM market. The naming right stays with Slovakia; the company that runs the namespace answers to a foreign parent under foreign law.

The .co ccTLD follows the same pattern. Since October 2025, after a MinTIC tender, Colombia’s ccTLD has been run by a consortium of the London-listed Team Internet Group and a Colombian partner. Again: the naming right is national, the operating company sits under a foreign jurisdiction.

That separation — a national naming right resting on foreign-jurisdiction infrastructure — is the structural risk.

Wherever it exists, a sanctions instruction — or a compliance decision an operator has little room to refuse — can take the technical infrastructure of a national namespace offline in hours, before the local IANA delegate can even find a lawyer.

OFAC formally exempts domain registration services, but Iraq required no new regulation. A single federal criminal case was enough to take an entire country’s namespace offline for more than two years.

The national operators who understood this have already acted: they run their own software, keep infrastructure under their own control, and contract with providers outside sanctions jurisdiction.

The rest are sitting inside someone else’s compliance framework.

Exposed.

No war required. A compliance letter will do.

Magyar változat: [zona.hu/egy-teljes-orszag-eltunhet-az-internetrol]

Tuvalu is going under.

About 11,000 people on a handful of islands, a meter or two above the Pacific. The country’s own finance minister says the science points to the place being uninhabitable by 2050.

And in 2019, 8.4% of the entire government’s revenue came from a single domain.

.tv — the suffix streaming made famous. Under GoDaddy, it pays Tuvalu around $10 million a year.

That money sinks with Tuvalu’s statehood.

.tv exists because “TV” sits in ISO 3166-1, the international list of countries and their two-letter codes. The code is there because Tuvalu is a recognized state — not because the islands are above water, but because the country still counts as a country. Let the statehood lapse, and the entry becomes removable. Once the code goes, the domain is eligible for retirement and a five-year shutdown clock starts. That is ICANN’s own stated position.

The $10 million is not really a contract with GoDaddy.

It is a bet on Tuvalu still being a country.

This is why the 2023 constitution reads the way it does.

Tuvalu’s 2023 constitutional reform declares that the state “shall remain in perpetuity in the future, notwithstanding the impacts of climate change or other causes resulting in loss to the physical territory.” It froze its maritime baselines against any future shoreline. It is pressing other governments to recognize that statehood as permanent — land or no land.

Tuvalu frames this as climate survival and national dignity. Read against the domain, it is also asset protection.

Because the loop closes. The .tv royalties fund the national project that pays for climate defenses and maritime boundaries — and, in its own line items, for keeping the domain’s registration active. The asset pays to defend the conditions of its own existence.

The lifeboat is lashed to the ship.

For anyone who treats a ccTLD as a stable asset, Tuvalu makes the fine print literal.

GoDaddy is paying roughly $10 million a year for a revenue stream whose legal basis can expire — not on a contract date, but on a question of statehood settled in a standards committee rather than a boardroom. It is the same dependency that has founders watching .io this year.

A country-code domain is not property. It is a permission that lasts exactly as long as the country does.

The islands may still go under.

Tuvalu is making sure the country does not — in part so that two letters in a database stay eligible to be sold.

The asset used to depend on the nation. Now the nation is being rewritten to protect the asset.

Magyar változat: [zona.hu/tuvalu-es-a-vele-sullyedo-domain/]