The internet just got its first new TLD since 2022

There’s a new gTLD in the root, the first time ICANN has added a string in over four years.

Don’t get too excited though: it’s a dot-brand, kinda.

As of the weekend, .merck is live and resolving, though only the mandatory nic.merck registry domain exists right now.

The gTLD is interesting because it seems to be a rare example of two companies with the same name sharing a dot-brand.

The only other such arrangement I’m aware of is .sas, which is shared by the SAS Institute and SAS Airline, neither of which actually use it.

.merck seems to be jointly controlled by two pharmaceutical companies, one American and one German, both called Merck, which were under common ownership until World War I split them apart.

After they both applied for .merck in ICANN’s 2012 application round, over a decade of lawyering followed before they finally came to an arrangement.

There’s no Specification 13 in the .merck Registry Agreement, so it’s not technically an exclusive-use dot-brand at this time.

The back-end registry services provider, perhaps surprisingly, is South Africa-based DNS Africa, in what seems to be the company’s first deal outside its home continent.

1 Comment Tagged: delegation, dns africa, ICANN, merck, new gTLDs

Kid-friendly domains could be reborn

With governments around the world increasingly looking at reducing the harmful effects on the internet on children, it seems child-friendly domain name projects may see a resurgence.

The US government’s new hunt for a registry operator for .us, launched this week, contains a fairly explicit call for whichever company wins the contract to “revitalize” the long-dormant .kids.us space.

And I’m aware of one potential new gTLD applicant that wants to apply for a regulated kid-friendly gTLD when ICANN opens up its application window at the end of the month.

The US National Telecommunications and Information Administration said in its .us RFP:

The Contractor shall offer one or more innovative approaches to revitalize the use of the kids.us domain that are consistent with its objective of providing a safe space on the internet for children age 13 or younger, as intended by the Dot Kids Act. In the event a decision is made to reactivate the kids.us domain without any changes to the Dot Kids Act or selection of alternative uses, the Contractor shall be prepared to maintain and operate the second-level kids.us domain as specified by the Dot Kids Act.

It’s not the first time NTIA has tried to get the .us registry operator — now GoDaddy, formerly Neustar — to exhume the .kids.us project, which was closed down in 2012 after fewer than 1,000 registrations and half a dozen active web sites. Prior attempts were unsuccessful.

.kids.us was created by US legislation in 2002, largely as a way for legislators could feel good about themselves in an era when the web was still quite new and frightening and a lot wilder than it is today.

But that was before the dawn of social media and smartphones, the two technology trends driving much of the political focus on child online safety in the 2020s.

At least one new gTLD applicant intends to apply for a child-friendly gTLD this year, known as The Reservoir Project or (preliminarily) the Child Online Safety Association, run by lawyer S Harrison Knudson. The gTLD in question would be .haven.

The early-stage concept would see the registry work patent-pending technology and with ISPs, which would charge customers service fees and split the profit with the registry.

There are already two kid-oriented gTLDs out there — .kids itself and the Russian-language .дети (“.children”).

DotKids launched .kids in late 2022 and has so far accumulated 6,368 domains in its zone file. That’s actually not bad for a niche new gTLD, and based on some of the most uncomfortable Google searches I’ve ever done it looks like the registry is doing a pretty good job of keeping the namespace clean.

.дети has been around longer but has sold fewer domains, with just 1,358 names in its zone file today.

Comment Tagged: .haven, .kids, .kids.us, .us, .ДЕТИ, godaddy, new gTLDs, ntia

Shrinking .us TLD is up for grabs

The .us ccTLD may change registry operators in the not too distant future, but the domain is currently on a fairly steep downward trajectory in terms of registrations.

There’s also no guarantee that a new operator, should one be selected, would necessarily lead to lower prices for registrants.

The US National Telecommunications and Information Administration yesterday put the .us registry contract out for bidding, with a May 18 due date for offers.

Only the bigger players need apply — NTIA said it will only entertain offers from companies currently managing over two million domains in a single TLD.

That narrows the field quite a lot — only 27 TLDs I have numbers for clock in over two million. Incumbent GoDaddy qualifies, as does Verisign, Identity Digital, and Public Interest Registry.

CentralNic, Tucows, and a handful of non-US ccTLD operators also would be technically eligible, but the NTIA has ruled out any provider that is majority foreign-owned. The successful RSP would have to be fully based on US turf.

But .us has seen its DUM decline in recent months. As of January, it stood at 2,175,340, according to NTIA documents. That’s down from a peak of 2,575,574 just six months earlier, a not-insignificant dip.

On the upside, this is a different type of ccTLD contract to the likes of .ai or .co — the US government doesn’t want a cut of registration fees. The registry gets to pocket the lot.

How much “the lot” is isn’t exactly clear. Prior to 2019, GoDaddy predecessor Neustar was charging $6.50 a year wholesale, but references to pricing are redacted from the current NTIA contract.

So there’s a different pricing dynamic here. Registries competing for the deal can’t rely on bribing the government with a bigger slice of the pie, and NTIA has let it be known that a lower fee is not necessarily a good thing.

The pricing model will have to be in the “public interest” according to the tender. The NTIA documentation states that it will have to balance “the accessibility of .us domains to qualified registrants” and “the safety and security of the usTLD”, adding:

Offerors are advised that the lowest registration fee for a .us domain may not necessarily be in the overall best interest of the administration of the usTLD. The Government may decide to award to a vendor with other than the lowest cost fee structure or other than the highest cost fee structure.

It’s quite possible that the US will choose to stick with GoDaddy, but it’s perhaps worth noting that the current contract still has one unexercised extension option that would let it run until 2029, rather than the current 2027 expiration date.

Comment Tagged: .us, godaddy, ntia

Namecheap saw 116,000 phishing attacks last year

Bad guys used Namecheap to register domains associated with over 116,000 confirmed phishing attacks in 2025, according to data released by the company this week.

Across Namecheap and sister registrar Spaceship there were 432,796 reports of phishing and 116,871 of them were confirmed to be phishing attacks, according to data shared to an ICANN policy mailing list.

The stats refer to the number of tickets in the registrars’ support system, not the number of abusive domains, which logically could be lower due to double-counting or higher due to multiple domains listed in the same ticket.

The numbers are low as a percentage of the company’s domains under management — it has over 27 million DUM across its accreditations — at less than half of one percent, but pretty steep in absolute numbers.

The data was shared as part of early-stage discussions about the next wave of ICANN policy on DNS abuse.

A community working group is working on potential new rules for registrars, forcing them to conduct “Associated Domain Checks”.

That’s the idea that when a registrar confirms a domain is abusive they should check the Bad Guy’s other domains for similar abuse and yank those too, particularly if they were part of a bulk registration.

One of the many factors playing into these policy discussions is the administrative burden, and cost, that this would place on registrars. With 116,000 confirmed cases of abuse, the work-hours for abuse staff (or a potentially unreliable AI) quickly adds up.

Namecheap was named in the Anti-Phishing Working Group’s Q4 2025 report as the number one registrar abused in business email compromise attacks, a subset of phishing, with 25% of the total.

3 Comments Tagged: associated domain checks, dns abuse, namecheap, phishing

.io safe for now as Trump puts Chagos deal on ice

The uncertainty surrounding the future of .io domains is set to continue after the UK government froze its plans to cede sovereignty of the Chagos Islands due to lack of US support.

The UK has run out of time to pass legislation approving the treaty that would give Chagos to Mauritius in the current parliamentary session, which ends about a month from now.

It is reported that there are no plans to make a successor bill part of the King’s Speech — in which the government sets out its legislative agenda for the next session — on May 13.

The delay is believed to have come because the Trump administration, which has been blowing hot and cold on the issue since it came into power last year, has so far withheld its formal written consent.

That’s necessary for the treaty to pass because the largest of the Chagos archipelago, Diego Garcia, is home to a US-UK military base strategically important for American bombing raids in the Middle East.

Chagos, officially the British Indian Ocean Territory, owns the ccTLD .io, popular among tech startups. It’s managed by a UK-based Identity Digital subsidiary that makes over $40 million a year from registrations.

The UK’s decision to cede control of BIOT, following international human rights rulings, raised the spectre of .io ultimately being replaced or retired under ICANN’s rules governing ccTLDs.

While UK ministers have denied over the weekend that the Chagos deal is fully dead, its future seems to be dependent on Donald Trump, or his successor, changing the US position on the treaty.

Comment Tagged: biot, chagos, identity digital, io

Amazon sells three gTLDs to Identity Digital

Amazon appears to have offloaded three of its dormant gTLDs to Identity Digital, judging by ICANN records.

While no formal notices of registry contract reassignment have yet been posted, elsewhere ICANN shows the official registry for .circle, .got, and .jot is now Jolly Host LLC.

Jolly Host is a new Identity Digital affiliate that appeared last year and already took over the .onl gTLD contract from iRegistry a couple months ago.

.circle, .got and .jot are all greenfield namespaces. Unlaunched, they have no registered names beyond the mandatory nic.example domain. They are unencumbered by legacy dot-brand restrictions, which should make for smoother launches.

Amazon appears to have originally intended .circle to play somehow with its Circle brand of home parental control technology, but the 2012 applications for .got and .jot don’t give much of a description of its plans beyond boilerplate text.

The transfers are likely slightly bad news for Nominet, which is Amazon’s primary back-end registry services provider. Identity Digital runs its own back-end (appropriately, on Amazon’s AWS).

3 Comments Tagged: .circle, .got, .jot, acquisition, amazon, identity digital, new gTLDs, nominet

.radio’s new owners might have a fight on their hands

Should gTLD registries that avoid costly auctions by promising to serve special limited communities be allowed to later change their business models to improve sales?

That’s the question being asked of .radio, which recently was taken over by a new owner and might be on track to liberalize its registration policies in the near future.

.radio is what is called a “Community” or “Spec 12” gTLD, meaning it has Specification 12 — which imposes eligibility and content rules on registered domains — in its ICANN registry contract.

Four organizations applied for .radio in 2012, but the European Broadcasting Union prevailed, avoiding a potentially expensive auction, by filing a Community application and winning a Community Priority Evaluation.

Afilias, Donuts and BRS Media — all commercial, non-Community applicants — lost out on their chances to run .radio, or make money losing a private auction, because of this successful CPE.

While .radio launched in 2017, it’s never had more than about 3,000 domains under management and earlier this year the EBU sold its contract to Digity, an emerging registry operator with ties to Sav.com.

The suspicion is that Digity is planning to abandon .radio’s community roots and make it more of a mass-market proposition.

That concern was recently expressed by Craig Schwartz, president of fTLD Registry Services, which runs the Spec 12 gTLDs .bank and .insurance, in a letter (pdf) to ICANN’s chair.

Schwartz noted that Digity, unlike the EBU, “appears to have no existing relationship with the originally stated radio community” and said that registries should not be allowed “to game ICANN by preferentially acquiring these assets under one premise and then blindsiding Registrants at a later date.”

ICANN should audit Spec 12 registries for community compliance and open to public comment any attempt to transfer ownership of the contracts, he wrote.

Schwartz reiterated these concerns during a call of the ICANN At-Large community yesterday, adding that ICANN should come up with a way to “wind down” failing Spec 12 gTLDs, rather than transferring them to a liberalizing successor.

He — saying he is supported by other community registries — appears concerned that if ICANN allows registries to play fast and loose with their original commitments, it could not only enable gaming but also tarnish the reputation of other Spec 12s such as .bank.

Consultant Michael Palage, on the same At-Large call, said the the “cheat code” for registries is to get their Spec 12 removed during bilateral negotiations with ICANN Org at the time of contract renewal. He pointed to the liberalization of GoDaddy’s .xxx as an example.

Probably not coincidentally, the current 10-year .radio Registry Agreement is due to expire this July and is currently up for renewal.

ICANN has yet to publicly respond to Schwartz’s letter.

Comment Tagged: .bank, .radio, community, cpe, digity, ebu, ftld, ICANN, new gTLDs, spec 12

WIPO doubles the speed of UDRP cases

The World Intellectual Property Organization has introduced a new, more expensive tier of its UDRP service that can effectively halve the time each case takes to about 30 days.

WIPO said last month that it now offers an “expedited case processing” option, which reduces the time from filing to decision to one month, under certain circumstances, compared to the usual roughly 60 days.

The new option only applies to cases involving one to five domains registered to the same registrant, decided by a single-member UDRP panel, and relies upon third parties such as registrars sticking to their timing obligations under the policy.

The option costs complainants $4,000, compared to the usual $1,500. WIPO’s cut doubles from $500 to $1,000, with the remainder going to the panelist. Registrants are also able to request an expedited process for a cost of $2,500.

Because WIPO cannot unilaterally change the UDRP, registrants still get the standard 20 days to respond when their domains are targeted. They also still get to pay to demand a three-person panel, which effectively counteracts the expedited timeline.

The option means that UDRP could now only be a week or so slower than the Uniform Rapid Suspension service, for those trademark owners willing to pay the higher fee.

WIPO said that the expedited service will be managed by a dedicated team and a “special roster of panelists”, which may or may not turn out to be important depending on which panelists are selected for this limited pool.

Comment Tagged: udrp, wipo

Amazon joining GlobalBlock

Amazon Registry is planning to join the GlobalBlock trademark-blocking system, judging by ICANN records.

The company has filed a Registry Services Evaluation Process request asking for 33 of its gTLDs to be able to offer a “Label Blocking Service”.

That’s usually code for GlobalBlock, the GoDaddy-led service that allows trademark owners to block their marks across hundreds of TLDs, pseudo-TLDs and blockchain naming systems.

Indeed, the Amazon RSEP is pretty much a copy-paste of the usual documentation registries file when they’re gearing up to join GlobalBlock.

Adding Amazon’s portfolio would bring GlobalBlock’s coverage up to 813 extensions.

Some of the gTLDs Amazon wants to add are not actually live and on sale yet, which could lead to a weird and rather cheeky situation where the company is selling blocks but not domains in certain gTLDs.

Comment Tagged: amazon, globalblock

Unstoppable buys 10 new registrars

Unstoppable Domains has got 10 new registrar shell companies accredited by ICANN.

According to ICANN records, the companies UnstoppableUS1 LLC through UnstoppableUS10 LLC now have their official accreditations.

Starting off as a seller of strictly blockchain-based names, the company became a registrar of regular domains in 2024 and recently said the vast majority of its business is now in that space.

Buying up shell accreditations gives it more concurrent registry connections and is almost always a way for a registrar to become more competitive in the drop-catching services market.

Comment Tagged: unstoppable