Price increase on .io on January 21, 2021 | Hacker News Reader

Price increase on .io on January 21, 2021

news.gandi.net

139 pointswilsonfiifi144 comments

I don't mind the price increases if it helps to deter squatters (i.e. GoDaddy).

It was hell trying to find a reasonable domain for our new company (i.e. one that we would like to have in our email addresses forever). Only 5-10% of the domains we attempted were legitimately in use by some other business or individual. Everything else is a fucking godaddy parking page offering their domain realtor scam experience.

A domain I'd pay upwards of $300 to buy is behind a GoDaddy parked page, and I'd have to pay $70 just to message the owner to begin negotiating. The chances that person would be unreasonable is pretty damn high too, so I haven't been able to justify it.

Edit: Looks like it's $120 to pay for a "broker" now to contact the owner and then a 20% commission on top.

Do a whois query and email the owner directly. For low amount offers going through a broker is definitely the wrong approach in my opinion.

GoDaddy has a free monitoring service [1] where you add the domain(s) you are interested in and it will email you each time that domain WHOIS data is updated. This is very useful to get notified when a domain name is about to expire and then get deleted (redemptionPeriod, pendingDelete). Over a 5+ year time period, quite a few domain names I was monitoring were eventually dropped by their previous owners. These weren't highly sought after, but your local insignificant city .com, some rather unique first/last name...these type of domain names.

[1] https://www.godaddy.com/help/setting-up-domain-monitoring-57... (not affiliated with GoDaddy; not even using them as a registrar, but this tool proved useful for me)

GoDaddy have been caught doing some dodgy things in the past. Like taking your money for brokerage and not doing any work afterwards. Or registering domains and parking them if lot of people search for them e.g. via who is or the registration form.

Hopefully they've turned it around and actually working on useful services nowadays...

Most data in WHOIS is a dead end. Try looking up a few sites, apparently everyone lives in Panama now.

Gandi at least actually forwards these emails, I tested it with my own domains recently. But generally you're probably right...

> GoDaddy has a free monitoring service [1] ...

Does anyone other than GoDaddy have such a service? I would use this, but wouldn't trust GoDaddy not to steal the domain out from under me and then try to extort me for money. (Or just be obnoxious and try to advertise to me left and right.)

> Does anyone other than GoDaddy have such a service?

I've been using DomainTools's monitoring service [1] for years. I wouldn't trust GoDaddy with anything domain-related either.

[1] https://research.domaintools.com/monitor/domain-monitor/

I had a six letter dotcom name back in the mid-2000s I sold for $10k to an Irish company. At the time it was a lot of money and I paid off what was left of my student loans. I then dumped what was left and my savings into my car loan and was totally debt free ... then I lost my job

The website on it had a ton of content too, which I never re-hosted anywhere else. Part of me wishes I had just hung on to it. milk.com is another one of those old holdouts where they guy is unwilling to sell it for less than 7 figures.

The person sitting on milk.com should definitely hold out. That's a multi-million dollar domain for the lobby & media obsessed milk industry. I'm surprised they haven't long since acquired it.

Actually he wants minimum 8 figures.

https://milk.com/value/

Dan's emails and milk-related content are also pretty interesting: https://milk.com/experiments/

GoDaddy is a big scam. You pay, and they never contact you again. Support is a black hole

I wonder if this changed after they sold to VCs. I worked there quite a few years ago and 3/4 of the employees were customer support. There was 24 hour support in multiple languages. They used to pride themselves on support. It's sad to hear that it's gone downhill.

My bad experience with them was like 5 years ago. I don't know what their support is doing but I never received an answer, they just don't care and are happy to take my money in exchange of absolutely no service (I never got the domain name)

That's fine if only companies are renting domain names. But some of us are individuals running hobby webpages or trying to take control of our email domains.

What's stopping a gTLD owner, .foo to get a bunch of customers onboard with $1.99/year deal and then 5 years later, increase that to $49.99/year? Surely, people who've built businesses on top of their .foo domains will fork up. Any laws preventing this?

> What's stopping a gTLD owner...

Nothing, absent a provision in the registration contract to the contrary, except the risk of everyone fleeing.

> Any laws preventing this?

No. Remember that [ccTLD - I originally wrote gTLD but those are a different thing, as corrected below] are assigned to the countries that they represent (or, in this case, the country that holds sovereignty over the named territory) so subject to their jurisdiction and there’s no real motivation for a country to pass such a law.

Minor correction...that's ccTLD, which .io is. And you're right about the rest. But gTLDs are basically every other TLD that's not a country code.

There are also sponsored TLDs(.edu, .gov), generic restricted(.biz), and the single infrastructure TLD .arpa.

https://www.iana.org/domains/root/db

At least for the old TLDs, the ICANN contract specified the max it could be raised each year. I want to say it was 10 or 15 percent anually. Not sure about the new gTLDs but I'd imagine they have similar provisions.

No, the new ones do not have such a provision and even some of the old ones (.org, .biz, .info) have renegotiated their contracts to eliminate that requirement

Thanks for the info. It's been a while since I've been in the biz.

> What's stopping a gTLD owner, .foo to get a bunch of customers onboard with $1.99/year deal and then 5 years later, increase that to $49.99/year?

Bad image and massively losing the original customers.

>Any laws preventing this?

No, the gTLDs are allocated by ICANN which is a non-profit based in the US. As a whole, the domain name market follows very economically liberal rules.

What exactly do you mean by liberal rules? Is lobbying part of that?

I just remember that ICANN board was part of a recent .org story [1].

[1]: https://news.ycombinator.com/item?id=23878508

I meant "economically liberal" as in "governed by capital, companies and other entities (such as reselling platform) that follow market dynamics rather than state rules", in the european sense.

It probably doesn't make too much sense from a business perspective.

Domains are dominated by the long tail. Some people have built multi-million dollar brands off the TLD, but how do you raise prices to take advantage of that without losing the 100,000 other registrations that will just churn away?

In your example there's a fair bet they'd lose 99% of their existing user base, and kill any new use acquisition.

> Some people have built multi-million dollar brands off the TLD, but how do you raise prices to take advantage of that without losing the 100,000 other registrations that will just churn away?

Is there anything to stop them from raising prices on the most established domains while keeping the long tail at the same price?

E.g., some of the new TLDs already have "premium" pricing for dictionary word domains, is there anything stopping them from raising the price on dictionary domains after someone has started using them?

I’ve been trying to find an example of someone having a domain reclassified to premium while it’s registered and haven’t been able to. I think that would signal the end of that TLD. I know I’d never buy one after hearing about that.

We pre-registered a dictionary .london domain we had a trademark on for £200 as a potential switch from the longer .co.uk we were using. When it came to sunrise, our registrar told us that .london told them there was an error and our domain hadn't actually been pre-registered but was now available for £5000. I consider it fortunate that we got the early warning before investing money in rebranding.

I think this is already common, especially on the new wave of gTLDs.

I registered a ".plus" domain for $2 a year for two years. It made a decent domain hack for a project.

After two years, the renewal price became $20-ish. The project had a new name by then, so I didn't renew.

The same happened for a personal Chinese domain (.网站 I think) that I had for a couple of years while I was learning Chinese.

Nothing really. Even ccTLDs can freely change the pricing scheme.

You are pretty much bound to what the registry can do. Take it away, hike the price up, etc.

To put an example to the other comments, look up the history of the XYZ domain - in a nutshell, they had a fire sale selling domains for pennies to gain market share. Besides normal people, three groups descended upon it: spammers, squatters and hackers. 6 years later and the entire .xyz space is blocked in Enterprise firewalls (source: my workplace) due to that behaviour, preventing me from getting to valid tech sites on the TLD. The XYZ image is still tarnished from cheap domain fire sales at the beginning of it's life - I'd never pay $50 for anything in .xyz today.

To contrast, the .io space entered at what, $50 USD? and continues to be expensive to maintain year over year, providing a natural monetary resistance barrier to the same three groups of people (spammers, squatters and hackers) and seems to enjoy a healthy respect amongst internet users; most consider it a tech-type domain space with tech worker dollars buying the domains for real sites, I even owned one for a brief period when they came out.

Same thing happened to me but with an .icu domain, it’s always better to buy an expensive domain extension than a cheap one https://ruky.me/2020/12/15/dont-buy-a-icu-domain/

While I only named .xyz above, my (enterprise) company blocks several other TLDs as well like .info, I'll check .icu when I'm back after holiday but would not doubt it's blocked. Corporate IT subscribes to some sort of hosted service, I would not doubt other companies are using this same service (name-brand).

Any idea why .info is blocked? I always considered it to be ok since it’s an ogTLD.

I think it's just part of some generic category of strict blocking used by the hosted service - there's a lot of other stuff blocked, we generally don't get reasons as users other than it being the corporate security posture. We are a business partner of many firms (some have high security due to their needs) so our company trends in that direction - maintaining compliance is a big deal, entire team(s) manage it at various levels.

Do you know the name of the service? Blocking .xyz names as a whole would cut your company's employees off from accessing sites like Engine.xyz, ABC.xyz, and Starship.xyz.

> To put an example to the other comments, look up the history of the XYZ domain - in a nutshell, they had a fire sale selling domains for pennies to gain market share. Besides normal people, three groups descended upon it: spammers, squatters and hackers. (...)

I don't know which point you were trying to make, but as far as I could tell that's the business model that's being followed by all vanity gTLDs.

The only nuance I've noticed is that there are a bunch of domains being sold for peanuts with the caveat that after a year or two it's price is hiked to somewhere in the range of 30-50$.

Nothing, and .space did pretty much exactly this: $1.99 first year, $9.99 renewal, now yanked up to $20+/year. Existing domains were grandfathered to the old pricing if and only if you noticed and complained about the bait and switch.

You can buy [x] years in advance, no?

I am the owner of a premium gTLD (.dev), which I pay $1,000 per year for. Google runs .dev.

I read the contract carefully, there is nothing preventing Google from increasing the price to 10,000 or 100,0000. It’s my biggest fear.

My only hope is that Google wouldn’t do it from a PR perspective, which I think is a safe and fair assumption.

The real worry is they sell the rights to .dev to GoDaddy or somebody else, because then I am screwed.

Google is one of the best things to happen to domain registrations. I highly recommend them. Even though I’m contractually exposed, to date, Google have been conducting themselves very well in the domain registration market.

One of the great things about .com is that there is a contractual cap on price increases. However the domain I bought would cost in the 10s of millions if it was a .com; so at 1,000 per year, it’s a good deal for the .dev version as long as they don’t significantly increase it (I’m okay with 10% per year increases).

> In a sea of unscrupulous players (who track what names you search and grab them before you do in case they are any good)

Not really… There are many reputable ones. Gandi, namecheap and cloudflare are ones I can immediately think of. It’s just that some shady ones like GoDaddy do a lot of marketing.

Fair point. A lot of the dodgy stuff happens in the secondary market, which biased my original note, I’ll edit it if I can

I’ve been with Namecheap for years and they’ve been great. No complaints.

Gandi has started locking some TLDs away behind a 'corporate membership' subscription at €60 per month.

> Google is one of the best things to happen to domain registrations.

Thats Google lobbying laterally through other industries but you just can't see it

Could you expand please? It affects me a lot so definitely want to know as much as about this area as possible.

I see Google Domains as a strategic division that supports their cloud services and Google Suites (note how Amazon also sells domains now, I think and hope they both see it as a necessity and don’t kill it like other Google projects they have abandoned).

Google being "Google" a/k/a using Ad-net Integration Model (Ads&Network) heads towards buying out all competition and then killing it forcefully (if it stands in a way); this way they [Google] stay on top of the every industry line on the www (which crazy enough, includes domain registers). It's basically lobbying for the company greater good, see: Entrepreneurship 101 =) There are many reputable domain registers like NameCheap and alike, that offers so much for less price. But, try typing domain registration in the Google and see what is the first URL offered to you (ta-da: it's Google Domain Registrant and GCM integration).

Thanks, that helps :)

How do google justify charging £1000 a year in the first place though? It's so much higher than most other domains.

The parent said it was a premium domain. Think cars.dev or similar.

Certain domain names are in high demand. What more justification is needed?

Is money and we like money lol -- Google

Google gets more money, and a domain name investor would have bought up all common words instantly if they were normal priced. Like a lot of people have held on to .com domains for decades with no intention of doing anything except selling them as an investment.

> the domain I bought would cost in the 10s of millions if it was a .com

I don't know much about the pricing of domains, so please excuse my ignorance.

Isn't that just due to the fact that your name was already taken on .com so you had to use a TLD, where is was still free? The 10s of millions you don't have to pay to registrar, you have to pay it the current owner of the domain, who like an owner of anything can dictate the price.

If that is correct, then how is 'google one of the best things to happen to domain registrations'? I guess this is not refering to pricing, because 1k$/a sounds like a lot of money for a domain.

An individual can sell the transfer rights for as much as they like, but that is separate from the registrar fees.

You are right - it relates less to pricing and more to having a trustworthy registrant to partner with. And it’s very easy to adjust various DNS setting with Google, the whole process is very well done. Highly recommend them here and many others do too.

Re pricing, I’ve noticed a few others bringing it up on 1,000 per year. This is a premium domain and instead of some scalper grabbing it up, by setting the annual price high, an actual end user like myself gets to buy one. In a perfect world we will be the first to snag up a domain, but this model of charging premium prices for domains, as long as it’s not exorbitant, works better for both end users and registrants.

1,000 sounds a lot per year, but when the .com is in the millions, it’s much fairer.

> (...) but this model of charging premium prices for domains, as long as it’s not exorbitant, works better for both end users and registrants.

I don't understand how it can be argued that arbitrary price hikes works better for those who have to pay those arbitrary price hikes, specially if it's under a scheme where anyone can swipe your domain out of your hands regardless of how much you've invested in it without you being fairly compensated for it if their pockets run deeper.

You make a valid point - my underlying assumption is that this would not be done. I am hopeful for brand name registrars like Google they will not do this.

Also it would kill their brand equity and the overall value of the extension, so I am hopefully for considerable price increases of 10% per year but not 50% or 100% etc.

In the eyes of someone else you are now "some scalper" when it comes to this .dev domain. It's a matter of perspective after all.

Presumably the OP is actually using the domain for something rather than just sitting on it awaiting a buyer.

I actually wouldn't see them as a scalper. I don't think it's just an equivalence. I've always been fine when looking around for a domain and one is taken but it's being used productively. The thing that feels annoying is finding a domain where the only thing it's being used for is as an advertisement for itself. It feels kinda like coming across a billboard that says "advertise here!".

The economist in me had to struggle to remember that if the prices are smart, it will lead to allocative efficiency. But it still feels a little ugly.

How do you determine that the domain is being used for something productive? Is my personal email domain up for grabs because I don't have an http presence?

No. That's something productive. If your domain were just advertising that you'll sell it for $xxx and doing nothing else, that's what is at issue here.

The differentiating factor is that I will lose money on the domain by itself. Paying 1,000 per year on registration fees on a domain that can potentially have an unlimited price increase means the value of the domain in any sale will very rarely compensate for the money I invest into it.

The key thing about .com is that once you buy the domain, the annual registration fees are more or less nominal — that’s what allows for very high sale prices. If I could buy my .dev name in .com for even 10,000 I would do it. Alas it is easily in the millions, IMO at least 10m+ as apart from protection for future material hikes in registration fees, .com is still THE gold standard.

For me, it made sense because I am actually using the domain, and I can make it my brand name, eg “Name.Dev” incorporated. This helps me from a trademark perspective as well, so for a small time guy with an idea, it’s a great feeling to get a chance to get a good name that I can put to use.

I wouldn't fear Google imposing price increases, I would fear Google eventually jettisoning their registry business because it doesn't make Google-scale money or serve a strategic purpose.

Yep that’s my fear! Oh well, nothing in life is certain.

However I am hopeful it has a strategic purpose - for anyone using Google Cloud Services, it would be more convenient to have the domain registration bundled in. Similarly, Google sell you you@yourdomain.com as an add on in Google Suites.

I would fear Google introducing a new product or five, then sunsetting two, letting one old product hang on while they only add new functionality to another before deprecating both to resurrect an older product, then deciding they have put enough pressure on others to accomplish their goal (competition lower prices or introduces new features) so they can kill all their domain products now.

FYI, TLDs cannot be killed off (for good reason; dropping a bunch of domain names would be harmful to the Internet). The worst that can happen is that they're transferred to another registry operator. ICANN requires daily escrow deposits as a condition of running a TLD, which allows emergency registry operators to step in and ensure TLD operation continuity if that becomes necessary.

https://www.icann.org/resources/pages/ebero-2013-04-02-en

I think that's unlikely. It can't cost them that much to run and it does serve an important strategic purpose of preventing anyone else from gaining control of a key piece of infrastructure that their whole business depends on.

Google is unnecessarily expensive than namecheap.com.

As a user of both domains.google and namecheap, I'd recommend namecheap.

Usually, in both the cases, I immediately move registration to Cloudflare-run registrar.

I'm not sure I understand your last sentence. If you're going to move the registration to Cloudflare, why not start on Cloudflare?

They don't offer new registration

The ease of use with Google is pretty good. Yes I pay a bit extra, but the overall package is very well done.

I’ve heard good things about namecheap too.

> Google have been conducting themselves very well in the domain registration market.

Except, of course, for the lies they used to enter the market[1].

Repeated throughout: "Members of the public will not be able to register domain names in this new gTLD."

1. https://gtldresult.icann.org/applicationstatus/applicationde...

Interesting. Looking over that, it seems you're right.

Wonder why this isn't more widely known?

Curious what your domain is?

Secret for now :) Need a good 1-2 years before it’s ready to launch.

Got an alert from namecheap saying my `.pro` domain renewal will cost 16.98$ starting Jan 5, also price increases for 15 other that I don't really care about.

My first thought was, I should pre-pay for the next 9 years now to lock it in cheap... then I looked at the price I pay now, 15.88$ and I paid about 4$ initial registration.

Honestly there's no rush, it's a minor price increase, and I expect things to get more expensive as time flies anyway, that's what happens to literraly every subscription I pay (rent, watter, energy, council tax, internet, phone, email are all "subscriptions" I pay and all of them have increased in price, and will undoubtedly increase again). Not that there's anything you can do about it, it's the "cost of doing business".

I'll have to consider what's the lifetime of this domain, should I pay now, or am I going to throw it away in a few years/months for something else. I'll probably keep it as it's a good one, and I'll put an alarm for the 4th so I have enough time to think this through.

The `.io` price increase looks a bit bigger relatively speaking, but nothing earth shattering... so try following the same logic as I detailed above.

Now the question: how often do these increase?

It‘s a minor increase for you, but a business is making 3 times more money for not providing more to you than before.

> Now the question: how often do these increase?

With respect to .io renewal on Gandi.net based on personal records:

  US$35.00/yr through 2018
  US$38.00/yr (+8.6%) into 2019
  US$42.18/yr (+11%) into 2021

If I recall correctly, .io renewal was limited to something like 1- or 2-year intervals not too long ago; this appears to have changed, but I'm unsure when that happened.

Rent seeking behavior from a fallen empire that violently evicted the native people they called "Tarzans" from the very islands .io is supposed to serve? Tell me it ain't so!

History of British Indian Ocean Territories: http://citizen-ex.com/stories/io

Anyone building a brand atop a ccTLD with this kind of history is taking a huge risk.

BITO was uninhabited before it was settled by Europeans. It doesn't have "native people" according to Wikipedia. Unlike .us/au/ca etc. Are those tlds controlled by their native people?

> On 22 May 2019, the United Nations General Assembly adopted a resolution [...] demanding that the United Kingdom unconditionally withdraw its colonial administration from the area within six months.

https://en.wikipedia.org/wiki/Expulsion_of_the_Chagossians#2...

Any reason to downvote?

PS I think it could a good idea to require some reason when downvoting, otherwise sometimes the context for doing that is completely unclear.

Many communities have adopted the downvote reason functionality, as well as upvote reason.

> BITO was uninhabited before it was settled by Europeans.

This is completely wrong. BIOT includes these islands where the native people were forcibly removed and the story is terrible.

https://en.wikipedia.org/wiki/Chagossians

https://en.wikipedia.org/wiki/Expulsion_of_the_Chagossians

It's not like this hasn't been discussed many times on HN before. I own a .io but come on!

The Chagossians aren't a counter-example to that at all - they were moved to the islands by European colonialists as a slave labour force, which as I understand it were uninhabited before.

What, did you expect a new lineage of humans to evolve separately there or something?

Of course "native" can be arbitrarily limited to mean 1000s or 10,000s of years, but even after slavery those people lived there for at least five or six generations. So from the perspective of the people being forcibly removed, getting their pet dogs gassed by the military, it really wouldn't fucking matter.

And the Wikipedia article says they're "native", which you explicitly claimed was not the case.

That's not a relevant statement. It has people who were living there before the British controlled the islands.

On the subject of gTLD, ( I ask this every time when I get the chance )

What happened to .web ?

Verisign CEO said in their last investor conference that it will be coming soon but then all record of that was deleted from the web.

Lawsuits.

I find the answer myself [1], searching for ".Web" online is very hard as even google doesn't really take "." into account when searching. I had to go and read the Verisign Q3 investor notes and find a link mentioning it.

[1] https://news.ycombinator.com/item?id=25545130

Any time i buy a domain I buy 10 years worth. I only buy gTLD domains that are on sale though. I figure if I'm still using it after 10years then whatever the renewal is, it must be worth it.

Are there any "safe" gTLDs, i.e. those that are either unlikely or contractually obligated to not rent seek in a few years time?

I've been using the 'casa' gTLD (the only others I see that are relatively bargain bin are 'link', 'site', and maybe 'click').

I don't need a brand. I just need to type something in that's not the IP address of my VPS...

If you don't care about brand why do you want a gTLD? Just get somethingreallyobscure.com. It will stay cheap.

Good point. The gTLDs I listed are typically cheaper than .com registrations when I look on namecheap, but the governance of the original TLDs is definitely more regulated, except for that damn .org hijack attempt :(

However, if I want to have {my last name}.tld, is there any gTLD that would be unlikely to jack up the price? I actually have {my last name}.casa for this reason.

Unfortunately {my last name}.{com,org,net} were all registered when I was in diapers. I'm assuming that the land of gTLDs is the wild west of potential price shenanigans, but I'm wondering if I'm wrong.

A .com will cost < $100 for 10 years at most registrars and as you've noted, this is for personal use (not company branding, e.g.) so the name is not that important. I'll posit that most folks know how bad the name squatting business is around the internet and nobody really thinks hard about somethingreallyobscure.com so long as it's not confrontational in some way (religion, politics, swearing, etc.). But I will say "anything ending in .com has more implicit trust" - I'm always mentally questioning if any link from one of the new gTLDs is just a spammer/ne'er do well.

Been here, done what you're doing, there's a .com out there with a fun and interesting name which somehow resonates with your personality. Think long term - avoid trademark/copyright branded words in the name, avoid being too narrow in case your hobby changes, easy to type and spend some time really thinking about plurality - I've discarded a lot of ideas simply because it would lead to other people going "was that with or without an (s) on the end?" - same with double-letters in the middle, just avoid them. I try and focus on 5-6 syllables max which break on natural language barriers (English).

I recommend .dev. It’s owned by Google and a high quality domain extension (I did a lot of research before settling on it, although now I have a vested interest in its success :D).

For Google the bad PR would outweigh any benefits, so I think it’s the safest option.

However if you just want a name, .com is the best if you don’t care about a not so great name.

I was about 2 months late to someone snatching up {my last name}.dev :(

I do recommend .dev for developers if they can get a good one for their personal use / site, for the reasons you mention.

I’m sorry to hear :(

Go to Google domains, there’s an option to see all available domain endings with your chosen name, you can see if there is another that works better for you? Eg .xyz or.app etc

I was able to get $firstname.{dev,app}. My idea was to deploy my apps at $app.$firstname.{dev,app} for dev and prod stages respectively. Now I only need apps that I can deploy there. I am still a bit reluctant to use either one as my primary email address (still relying on .org) because I worry that certain sites will reject those fancy email addresses.

I should say that I am more attached to my first name than my last name because the former is slightly more special and thus more "unique" (also it sounds cute when people say it in English).

I'm using a .dev domain name as my primary email address and in the last few years of using it, I have only run into one website that did not support it properly. I ended up using my .com email alias for that website.

I went for firstname.dev :)

No, I went for https://firstname.dev

I also got https://lastname.dev too.

And lest you think you could just use your https://fullname.dev ... nope, already got it as well.

You're missing "steve.dev" on the first list - not me, though I have two steve-domains!

Reminds me of how I thought I was being clever by picking the facebook "shortname" of /forename.surename!

Lesser known fact about .dev: The registry software that runs it (and Google's other TLDs) is free and open source, and is developed in the open on GitHub: https://nomulus.foo

So if you really have thorny questions that need answering about how exactly certain complicated parts of the domain lifecycle work, you can just dive into the source.

Thanks! That’s a very interesting fact.

https://www.opennic.org might be useful to you.

No, that really isn't helpful unless you want a novelty domain name that nobody else (roughly speaking) can resolve. (And which, as a result, you can't send or receive email from, obtain an SSL certificate for, get indexed by search engines, etc.)

I still think it might meet OP's requirements: "I just need to type something in that's not the IP address of my VPS".

Sure, there might be other requirements, and it's not clear what the exact use case is, but it also might be useful.

I mean, if your only requirement is "I need it to work on computers that I've specifically configured to make it work on", you might as well make your "domain" an entry in /etc/hosts. It'd even work more reliably.

For sure there are also other use cases, where just putting entries in /etc/hosts is not enough and it's useful to add one more entry to DNS resolver on machines that should be able to reach specific and probably dynamic destinations.

That's actually a fun exercise to come up with these use cases.

I think .de is relatively safe.

Yes it is (and cheap!), but I think one needs to be a resident of (or business in) Germany for it. .eu is also cheap, but similar rules apply.

> but I think one needs to be a resident of (or business in) Germany for it.

Not quite, you just need somebody acting as a local point of contact, and a number of registrars will offer this as an additional service for a small fee.

That's probably because we have things like a mandatory imprint here in Germany.

Having owned many novelty TLDs, from my experience:

- TLDs with more than average marketing tend to not bring many surprises. .club, .blog, .co, .dev.

- TLDs run by companies with TLD portfolios tend to remain supported relatively as well. Donuts and Porkbun are examples.

- avoid abused TLDs such as .xyz. If a domain is sold at $0.80, that's a good sign of one. This 0.80 was registry pricing (not registrar eating costs), and companies behind them did very bad things to say the least. Alpnames for example was shut down by ICANN because if this. And you know how much ICANN doesn't care about people, judging by the .org scandal.

In my opinion, the safest ones are from your own country NIC, a generic TLD like .com or .net, or subdomains from an organization (js.org, eu.org, etc).

Donuts is a registry. Porkbun is only a registrar, right?

Porkbun is a wholly owned subsidiary of Top Level Design, which is a registry. https://toplevel.design/about-us

> Are there any "safe" gTLDs

AFAIK there are zero guarantees. I think .com might have some pricing obligations, but all the good .coms are taken.

Don’t rely on ICANN. They’ve proven they don’t care about registrants with the .org debacle and when they let Uniregistry raise the price of domains for _existing_ registrants.

Donuts reclassifies domains to premium, but I’ve only ever seen it after a domain expires. Donuts raised some prices a few years ago, but let existing registrants keep their pricing AFAIK.

Assume there’s strength in numbers. Any attempt to increase prices drastically on .com, .net, or .org should result in a lot of backlash.

I also consider .dev and .app safe, or at least safer than the rest, because I don’t think Google is looking to turn a huge profit with them. They’re some of the most reasonably priced too.

The new TLDs could have been awesome if the registries weren’t so short sighted. They’re priced way too high to foster wide adoption. They should all be ~$10/year IMO.

If you are in the EU (resident or business), you can legally buy a country level TLD from any member state. I have a 4 letter domain I use specifically for this (for internal stuff, so I can get SSL certs).

I was looking at getting a short gTLD for a website I'm starting, but I'm wondering how well they're supported (meaning will DNS resolve, can people send me email, will I get rejected for using the address for account creation on sites, etc). The com/net/org/etc and ccTLD's I know are almost universally supported, but if I had example.whatever, how likely am I to run into issues?

I use .tf

Apart from a few sites like ticketmaster (not resolved) and discord (now resolved) not recognizing the TD I've had no major issues.

Your email reputation will likely be lower rated and likely be thrown in spam with major providers(Microsoft/Google) but that may also be because I am hosting my own email server.

It's quite crazy how expensive the .io and .ai domains are, versus .com and .net and other vanilla domains.

With Everyday High Prices, these TLDs make “domain investing” uneconomical. This way, premium domain revenue is captured by the registrar and not a third-party speculator.

The Wikipedia page on the company that manages this domain is surprisingly short:

https://en.wikipedia.org/wiki/Internet_Computer_Bureau

Offtopic but related question: is there any TLD for which a first-level wildcard is allowed in SSL certs? (I mean "* .tld" instead of second-level such as "* .foo.tld").

TLDR; I feel like there should be a special dev-only TLD for certs that go on example code, which skipped all the certificate management limitations. Suggestions are welcome!

It is so cumbersome to provide WebRTC sample apps and tutorials that can be universally run for testing purposes. WebRTC requires HTTPS, and thankfully an untrusted self-signed cert will do for Firefox and Chrome (they will show a warning page that the user can accept); iOS further requires that the certificate is trusted (so no warning page is shown and the load silently hangs on an infinite reload loop, which is nasty if you ask me; to avoid this, you can manually install custom Root CAs to the device).

So, my WebRTC tutorials and demos need to include a self-signed cert that allows users to deploy in their LAN and do a quick test [0]. Browsers tend to accept "localhost" as a safe origin, but what happens with testing on LAN? I feel there should be some convention there, it's not very helpful to test a WebRTC application just on localhost.

To not assume any given LAN subnet, I create my self-signed certs for these domains [1]:

  127.0.0.1
  ::1
  localhost
  *.test.local

That way, users can create a quick DNS redirection from some .test.local domain to their server (e.g. using avahi-publish command), install the root cert in iOS, and test from an Apple device.

But I'd love if it was possible to just define a first level wildcard:

  *.test
  *.local

or similar.

Actually the .local domain would be perfect! Thanks to mDNS, when available, all hostnames automatically get their <hostname>.local address, which would be great for an easier than ever setup. Alas, MacOS seems to reject first-level wildcards.

To add to the problem, these demo self-signed certs were created for 10 years, which is fine because I want to drop then on the Git repo and forget about them. But now the maximum allowed longevity for newly created certs is enforced to be a measly 398 days.

Why does all this need to be so needlessly complicated? I guess people will tell me to put in place a cert-renewal scheme, using some CI for all repos that contain demo code or tutorials, but that's highly undesired... There are even people suggesting that certs should live for just days or hours, I guess they are not thinking on this simple use case, for which I don't know if there is an escape hatch.

As mentioned in the TLDR; suggestions are welcome!

[0]: https://github.com/Kurento/mediasoup-demos

[1]: https://doc-kurento.readthedocs.io/en/latest/features/securi...

> Offtopic but related question: is there any TLD for which a first-level wildcard is allowed in SSL certs?

Nope (unless you own "an entire gTLD").

From the CA/Browser Forum's Baseline Requirements (v1.7.3) [0] (with a few links/references added):

  3.2.2.6 Wildcard Domain Validation

  Before issuing a certificate with a wildcard character (*)
  in a CN or subjectAltName of type DNS-ID, the CA MUST
  establish and follow a documented procedure that determines
  if the wildcard character occurs in the first label position
  to the left of a “registry-controlled” label or “public
  suffix” (e.g. “*.com”, “*.co.uk”, see RFC 6454 Section 8.2 [1]
  for further explanation).

  If a wildcard would fall within the label immediately to
  the left of a registry-controlled /1 or public suffix, CAs
  MUST refuse issuance unless the applicant proves its rightful
  control of the entire Domain Namespace. (e.g. CAs MUST NOT
  issue “*.co.uk” or “*.local”, but MAY issue “*.example.com”
  to Example Co.).

  Determination of what is “registry-controlled” versus the
  registerable portion of a Country Code Top-Level Domain
  Namespace is not standardized at the time of writing and
  is not a property of the DNS itself. Current best practice
  is to consult a “public suffix list” such as the Public
  Suffix List (PSL) [2,3, and to retrieve a fresh copy regularly.

  If using the PSL, a CA SHOULD consult the “ICANN DOMAINS”
  section only, not the “PRIVATE DOMAINS” section. The PSL is
  updated regularly to contain new gTLDs delegated by ICANN,
  which are listed in the “ICANN DOMAINS” section. A CA is not
  prohibited from issuing a Wildcard Certificate to the Registrant
  of an entire gTLD, provided that control of the entire namespace
  is demonstrated in an appropriate way.

[0]: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-... (PDF)

[1]: https://tools.ietf.org/html/rfc6454#section-8.2

[2]: https://publicsuffix.org/

[3]: https://publicsuffix.org/list/public_suffix_list.dat

Thanks. So the CA/Browser Forum has given space for this in their definitions, but lack establishing one of those TLD for the use case I mention.

Which surprises me. We even have IP address ranges defined for usage in examples in documentation... How come no TLD has been assigned for development purposes with relaxed requirements. Everybody needs to develop, as a first step before using an actual TLD. Just use .lan or similar!

> ... but lack establishing one of those TLD for the use case I mention.

Presumably, they didn't establish one because 1) that's outside of the scope of the BRs and 2) that's someone else's job, not theirs.

Regardless, as I pointed out in a comment [0] a few days ago on another thread, there are several such "special-use" domain names, although none specifically "for development purposes".

You won't be able to get a certificate signed by a PKIX CA for them, though; you'll just have to make your own.

[0]: https://news.ycombinator.com/item?id=25531515

Can somebody fill me in on the security status of the .io registrar now?

In 2017, a Google security researcher took over the registrar, meaning he could update the zone files externally.

It was best practice to stop using .io at the time.

I heard a rumor that a more professional registrar got involved after that, but don't know the details.

Anybody know the story today?

How is a $4.18 price increase worthy of millions of HN readers’ attention on Christmas? This post is currently #3 on the homepage. Hm, times are tough, people are losing it.

Because this indicative of the direction things are heading. The prices of many TLDs are inching upwards. It's not just gTLDs doing it, but also the ccTLDs.

The .org takeover attempt was recent. We've had bad .com leadership with Verisign. Domain registrars themselves can be pretty scummy.

In an effort to outperform the squatters, many gTLDs are pre-allocating "premium domains" and charging $500, $2500/yr for them.

There's lots of greed in domain names. Or opportunity. Depends upon what your perspective is.

Google charging higher for shorter domains or hey.com charging higher for shorter email handles is still way better than having to buy it from a squatter or lost-for-ever to a squatter who is unwilling to sell

Agreed - as long as Google doesn’t become the squatter themselves and charge exorbitant prices.

I got my dream domain because I paid a premium for it to Google. I have to pay the premium every year, which I am fine with unless it increases too much, but I can imagine squatters said no to it because it’s hard to make a profit when you have shell out so much each year for the domain (whereas with .com it is just the starting price + nominal reg fees each year).

> How is a $4.18 price increase worthy of millions of HN readers’ attention on Christmas?

Because, personally, I was already bit in the ass by these price hikes from a gTLD. I started a personal website with a gTLD (.site) that I registered for about $1, and when it was close to expire suddenly the registrar demanded about $30 for it. I decided to jump ship to another gTLD and let the old one expire, to not support this kind of extorsion.

Since then I've been monitoring the state of the old domain name. Oddly enough my old domain name was parked as a premium domain, being on the market for close to $22, while other domain names from the same gTLD are sold for about $1.55.

In my opinion these gTLDs have been managed through extortion tactics, and I welcome any chance of discussing the subject.

Reply on news.ycombinator.com