A top level domain is the last part of a domain name, the letters after the final dot. In dnaccess.com, the top-level domain is .com. That short suffix decides more than most people realize: which company runs the master database for the name, which rules govern who may register it, which dispute policy applies if someone else claims it, and how attackers are likely to imitate it. This guide explains what a TLD is, how the major categories differ, and how a business should choose among domain extensions. It is part of our domain name basics series.
What is a TLD?
A TLD (top-level domain) is the highest level of the Domain Name System (DNS, the distributed directory that maps names to the numeric addresses computers use). Every TLD is operated by a registry, the organization that keeps the authoritative list of every name registered under it. The registry for .com, for example, records which registrar (the retail company that sells registrations) manages each .com name and which nameservers each name points to. You never buy a name from the registry directly. You buy it through a registrar, which relays your registration to the registry. Our introduction to what a domain name is covers how those pieces fit together.
Reading a domain from right to left shows the hierarchy. The top level domain sits at the far right. The second-level domain, the part you choose, sits to its left. Anything further left, such as www or mail, is a subdomain that the owner creates freely.
People use “domain extension” and “top-level domain” to mean the same thing. The industry divides domain extensions into two broad families, generic and country-code, with several important subtypes inside each.
Legacy generic TLDs
A gTLD (generic top-level domain) is an extension that is not tied to a country. The oldest and best known are the legacy gTLDs: .com, .net, and .org, along with a few others created in the early years of the internet. They are governed by ICANN (the Internet Corporation for Assigned Names and Numbers, the nonprofit that coordinates the domain system) through contracts with each registry and with every accredited registrar. That contractual chain is why ICANN policies, such as the Transfer Policy and the expiration rules, apply uniformly across them.
Legacy gTLDs are open: anyone, anywhere, can register an available name. They are also covered by the UDRP (Uniform Domain-Name Dispute-Resolution Policy), the arbitration process trademark owners use to recover names registered in bad faith.
Sponsored and restricted gTLDs
Some generic extensions limit who may register. Sponsored TLDs such as .gov, .edu, and .mil are reserved for specific communities, with eligibility checked before registration. Others, such as .bank, require proof that the registrant is a regulated institution. A restricted extension is harder to impersonate because a thief or squatter cannot simply buy a lookalike, and for that reason restrictions are a meaningful security feature rather than just bureaucracy.
Country-code TLDs
A ccTLD (country-code top-level domain) is a two-letter extension assigned to a country or territory, such as .uk, .de, .ca, or .us. Each ccTLD is run under rules set locally, by the country’s own registry or a government-designated operator, rather than under ICANN’s registrar contracts. That difference has practical consequences.
Many ccTLDs impose residency or local-presence rules. Some require that the registrant be a citizen, resident, or registered business in the country, and others allow foreign owners only through a local trustee. A business that registers a ccTLD without meeting the requirement can lose the name if the registry audits it.
Dispute policies also differ. Some ccTLDs have adopted the UDRP. Many use their own procedures with different standards and filing rules, and a few have no administrative process at all, which leaves court action as the only route. Our guide to domain name disputes explains how those routes compare.
Transfer and expiration rules can differ as well. ICANN’s 60-day transfer locks and 30-day redemption period apply to gTLDs, not automatically to country-code domains. Some ccTLD registries move names between registrars with their own tag or code system rather than a standard authorization code, and grace periods after expiration range from generous to almost none. An owner who assumes .com rules apply to a ccTLD can miss a renewal or a transfer deadline that the local registry enforces strictly. Before relying on any country-code domain for a business, read the registry’s published policy, not just the registrar’s sales page.
Several ccTLDs are marketed as if they were generic. The .co extension belongs to Colombia, .io to the British Indian Ocean Territory, .ai to Anguilla, and .tv to Tuvalu. Startups adopted them because the names read well in English and short names were still available. They remain country-code domains, governed by that country’s registry rules and policy choices, which can change.
The new gTLD program
Starting in 2012, ICANN opened applications for new generic extensions, and hundreds of new gTLDs launched over the following years, from .shop and .app to .law and .nyc. The scale is easy to underestimate. By the end of 2016, 522 new gTLDs had completed their Sunrise periods (the window in which trademark owners may register first), and over 1,200 new gTLDs had been delegated by 2021, with new gTLD registrations at about 29 million, down from 32 million, according to WIPO’s 2025 report to the Standing Committee on Trademarks, which also cites ICANN’s 2017 SADAG study.
IDN TLDs
An IDN (internationalized domain name) TLD is an extension written in a non-Latin script, such as Arabic, Chinese, Cyrillic, or Devanagari. IDN extensions let users type an entire address in their own language. They also introduce lookalike risk, because some characters in one script look identical to Latin letters.
Brand TLDs
A brand TLD is an extension owned by a single company and used only for its own names, such as a bank or automaker running its own extension. Because only the owner can register under it, every address on a brand TLD is authentic by definition. Brand TLDs are expensive to obtain and operate, and they are available only during ICANN application rounds.
How many domains are registered under each type
Generic and country-code domains now account for most of the world’s registrations. There were 386.9 million domain name registrations across all top-level domains at the end of the fourth quarter of 2025, including 161.0 million .com names, 12.5 million .net names, and 145.6 million ccTLD names, according to Verisign’s Domain Name Industry Brief release for the fourth quarter of 2025. Put another way, .com alone holds more than four in ten of all registered domain names, and country-code domains hold most of the rest.
Choosing a domain extension for a business
For most businesses that sell in the United States or internationally, .com remains the default. Customers assume it, email recipients trust it, and people who mishear an address usually type .com. If the .com is taken, our guide to getting a custom domain name walks through the alternatives.
A business that operates mainly in one country should consider that country’s ccTLD, provided it meets the residency rules and understands the local dispute policy. A new gTLD can work well when the extension describes the business, such as a law firm on .law, but the owner should still secure the matching .com if possible, because customers will try it.
The mistakes we see most in the cases we handle are predictable. A company builds its brand on a country-code extension without reading the registry’s rules, then discovers it has no UDRP option when a dispute arises. A company registers only one extension, leaving the .com or a common misspelling to a third party who later uses it for phishing. A company lets a secondary extension lapse, and someone re-registers it and inherits the trust and email traffic that came with it.
Security: why extension choice affects phishing risk
Attackers register domains where registration is cheap and quick. Interisle Consulting Group found that new gTLDs hold 11% of the domain market but 51% of phishing domains, and that 87% of phishing domains in new gTLDs were maliciously registered rather than compromised, in its 2025 phishing study covering May 2024 to April 2025. The same study found .com led all extensions with 455,297 phishing domains, which is a reminder that no top level domain is immune.
That pattern tells brand owners where impersonators will appear: across dozens of extensions they have never registered, using their trademark or a close misspelling. This is the core of typosquatting, the registration of domains that differ from a real brand by a typo or a swapped extension.
Registering a brand in every extension is not practical. There are well over a thousand, and each registration renews every year. Most brand owners instead use domain blocking, a registry-level service that reserves a trademark across many extensions at once so that no one can register it. Blocking covers breadth, while selective registration covers the few extensions that customers will actually type.
How DNAccess helps with top-level domains
The top level domain you choose shapes your rules, your dispute options, and your exposure to impersonation. DNAccess helps businesses decide which domain extensions to register, which to block, and which to watch. Our online brand protection service combines blocking with monitoring of new registrations across gTLDs and ccTLDs, and it acts on infringing domains when they appear. To review your current extension coverage, contact us.