A second-level domain (SLD) is the label that sits immediately to the left of the top-level domain in a fully qualified name, such as example in example.com or wikipedia in wikipedia.org. In the hierarchy of Domain names on the Internet, it is the level that organizations and individuals usually register through a registrar and the part that carries the brand or identity of a site.
Together with its TLD, the second-level domain forms the registrable domain that appears in contracts, WHOIS and RDAP data, and DNS delegation. Everything to the left of it is a subdomain under the holder’s own control, created without any further registration.
Where the second-level domain sits in the DNS hierarchy
DNS names are read from right to left, from the most general label to the most specific. The invisible root zone comes first, then the top-level domain, then the second-level domain and any further labels. Each dot marks a boundary where authority can be delegated to a different operator.
| Level | Label | Who controls it |
|---|---|---|
| Root | (empty) | Root zone operators under IANA coordination |
| Top-level domain | com | Registry operator of the TLD |
| Second-level domain | example | Registrant, through a registrar |
| Third level or subdomain | shop | Registrant or its DNS provider |
The TLD registry publishes NS records for each registered second-level domain, pointing to the name servers chosen by the holder. From that delegation point, the holder runs its own zone with its own SOA record and can create any number of subdomains.
Rules for second-level labels
A second-level label follows the LDH rule: letters, digits and hyphens only, with no hyphen at the start or end. Labels are case-insensitive, so Example.com and example.com resolve identically. Registries may add their own policies on top of these technical limits.
| Parameter | Limit | Note |
|---|---|---|
| Label length | 1 to 63 characters | Many registries require at least 2 or 3 |
| Full name length | Up to 253 characters | Includes all labels and dots |
| Allowed characters | a-z, 0-9, hyphen | Encoded form only |
| Hyphens in positions 3 and 4 | Reserved | Used by the xn-- prefix |
| Internationalized label | Punycode, prefix xn-- | Displayed in native script |
An internationalized domain name at the second level, such as a label in Cyrillic or Chinese characters, is stored in DNS as an ASCII-compatible xn-- string. Whether a script is accepted depends on the registry’s IDN tables, not on DNS itself.
Second-level domains under country-code TLDs
Several country-code TLDs reserve the second level for functional categories, so that the registrable name actually sits at the third level. In bbc.co.uk, the label co is a public second-level domain run by the registry, and bbc is the name the holder registered.
| Pattern | Example | Registrable part |
|---|---|---|
| Direct second-level registration | example.de, example.com | example.de, example.com |
| Category second level | example.co.uk, example.com.au | Third-level label plus category |
| Mixed model | example.uk and example.co.uk | Both forms coexist |
| Private suffix | project.github.io | Treated like a registrable domain |
Because the boundary varies, software uses the Public Suffix List to decide where the registrable domain begins. Browsers rely on it to scope cookies and security policies, so that example.co.uk cannot set a cookie for every name under co.uk.
How it differs from neighboring terms
The second-level domain is a position in the hierarchy, while several related terms describe roles or objects. Mixing them up leads to errors in contracts, certificate orders and analytics settings.
- Domain name refers to any full name, at any depth, such as
mail.shop.example.com. - TLD is the rightmost label, such as
com,orgor a country code likesk. - Subdomain is any name below the registrable domain, created freely by the holder.
- Apex or zone apex is the registrable domain itself, where a CNAME is not allowed.
- Registrable domain combines the second-level label with its public suffix.
Choosing and managing a second-level domain
A good second-level label is short, easy to spell aloud and free of ambiguity. Hyphens and digits are legal but cause errors in spoken recommendations. Checking trademark conflicts before registration matters, because a disputed name can be lost through the UDRP procedure.
Registration is a renewable lease, usually from 1 to 10 years, not ownership. Holders should enable auto-renewal and registrar lock, keep contact data current and store the EPP authorization code securely. An expired second-level domain passes through grace and redemption periods, typically 30 to 75 days in total, before it is released and can be taken by anyone.
Defensive registration of typographical variants and key country-code versions reduces phishing risk, but it adds cost; many organizations register only the variants that attackers are most likely to exploit.
Security risks tied to the second-level domain
Because every subdomain, certificate and mail policy depends on it, the second-level domain is a single point of failure for an organization’s online presence. Whoever controls the registrar account can change the name servers, and from that moment can redirect the website, receive the mail and obtain new certificates for every name below it.
The most common incidents follow a small number of patterns, and each has a straightforward countermeasure. The table below lists them in the order in which they are usually encountered by operators of smaller sites.
| Risk | How it happens | Countermeasure |
|---|---|---|
| Accidental expiry | Payment card expired, reminders ignored | Auto-renewal and several contacts |
| Registrar account takeover | Weak password, phishing | Multi-factor login and registry lock |
| Unauthorized transfer | Leaked authorization code | Transfer lock, code kept offline |
| Lookalike registration | Typo or homograph name | Monitoring and selective defensive registration |
| Dangling delegation | Old NS records point to unused servers | Regular audits of delegations |
Large organizations often add a registry lock, a manual safeguard operated by the registry itself, so that changes to name servers or contacts require out-of-band confirmation by phone or signed request. It is slower to use, but it closes the gap left by a compromised registrar account.
The idea in brief
A web address is read from right to left, like a postal address that starts with the country. The second-level domain is the name just before the ending, such as example in example.com. It is the part people actually rent and recognize as the brand.
Once someone holds it, they can add any names in front of it, such as shop or mail, without asking anyone else.
A practical scenario
A regional bakery chain plans an online ordering service. Its owners register the second-level domain breadhouse under .com and the national country-code TLD for five years with auto-renewal, and they also secure the hyphenated variant bread-house to reduce confusion.
The IT contractor then creates subdomains under the main name: order.breadhouse.com for the shop, mail.breadhouse.com for email and staff.breadhouse.com for the internal portal. No extra registration fees are needed for these names, and all of them share one renewal date and one transfer lock, which keeps administration simple.