Domain extensions (TLDs)

The extension is the last label of a domain name: the top-level domain (TLD). It decides which registry holds your name, what rules apply, and often what visitors expect.

Kinds of TLD

Generic (gTLD)

.com, .net, .org, .info, and since ICANN's 2012 program hundreds more: .app, .dev, .shop, .online. Open to anyone, unless the registry sets rules (.app and .dev work only over HTTPS).

Country code (ccTLD)

Two letters from ISO 3166: .in, .uk, .de, .jp. Each country sets its own rules. Some are sold as generic names: .io, .co, .ai, .tv, .me.

Sponsored and restricted

For a community: .gov, .edu, .mil, .int.

Brand

A TLD for one company's own use, such as .google.

IDN

TLDs in other scripts, such as .भारत (xn--h2brj9c).

Infrastructure

.arpa, used for reverse lookups (in-addr.arpa, ip6.arpa).

India: .in and .भारत

The .IN Registry, run by NIXI, operates .in and the IDN .भारत. You can register directly under .in (example.in) or under a second-level name: .co.in, .net.in, .org.in, .firm.in, .gen.in, .ind.in. .ac.in, .edu.in and .res.in are for education and research, and .gov.in and .mil.in are for government and defence only. Both .in and .भारत are signed, so a .in name can use DNSSEC. See how Indian sites do on our India list.

DNSSEC by extension

Our weekly check read all 1437 top-level domains in the root zone on 26 Oct 2026. 1351 of them (94%) have a DS record in the root, so they are signed and anchored. 86 are not. Search all extensions →

A TLD with a DS in the root is signed and anchored, so names under it can build a full chain of trust. Your own name still needs to be signed and to have its DS at the registrar: see how to enable DNSSEC.

Extensions that are not signed

These TLDs have no DS record in the root zone, so DNSSEC cannot validate for any name under them, even a signed one:

• .ae
• .ao
• .aq
• .ba
• .bb
• .bo
• .bs
• .cd
• .cf
• .cg
• .ck
• .cu
• .cv
• .cw
• .do
• .eg
• .fk
• .gb
• .gf
• .gh
• .gm
• .gp
• .gq
• .gt
• .gu
• .hm
• .im
• .iq
• .jm
• .jo
• .kh
• .km
• .kn
• .kp
• .mh
• .mk
• .mo
• .mp
• .mq
• .mt
• .mv
• .mw
• .mz
• .ne
• .ni
• .np
• .nr
• .om
• .pa
• .pf
• .pn
• .ps
• .qa
• .sd
• .sl
• .sm
• .so
• .st
• .sv
• .sy
• .sz
• .td
• .tg
• .tj
• .tk
• .to
• .va
• .vg
• .vi
• .мкд
• .ලංකා
• .укр
• .الجزائر
• .عمان
• .ایران
• .امارات
• .المغرب
• .سودان
• .عراق
• .澳門
• .გე
• .سورية
• .قطر
• .فلسطين
• .ye
• .zw

Choosing an extension

• Check that the TLD is signed (above) if DNSSEC matters to you.
• Read the registry's rules: residency, renewal prices, and what happens if the rules change.
• Prefer a registrar that accepts DS records (or CDS) and supports your DNS host's algorithm.

Check a domain →