A TLD (top-level domain) is the highest level of the domain name hierarchy below the DNS root, written as the last label of a domain name, such as .com, .org, .de or .app. In domain names, the TLD determines which registry manages the name, which policies apply to registering it, and which name servers a resolver contacts first after the root.
Every TLD is delegated in the root zone, which is coordinated by IANA under ICANN’s policy framework. The root zone today contains well over a thousand TLDs, ranging from two-letter country codes to generic words, brand names and internationalized labels in non-Latin scripts.
How a TLD fits into the domain name hierarchy
DNS names are read from right to left. In shop.example.org, the empty root label sits at the far right, org is the TLD, example is the second-level domain registered by a customer, and shop is a subdomain chosen by that customer. Each level is a separately delegated zone with its own name servers.
The root zone contains NS records and DNSSEC data for every TLD, pointing resolvers to the servers that the TLD’s registry operates. The registry’s zone, in turn, delegates each registered second-level domain to the name servers chosen by the domain holder.
| Level | Example label | Managed by |
|---|---|---|
| Root | Empty label, written as a final dot | Root zone maintainer under IANA coordination |
| Top-level domain | org | TLD registry operator |
| Second-level domain | example | Registrant, through a registrar |
| Subdomain | shop | Registrant or their DNS provider |
Technically, a TLD is an ordinary DNS label of up to 63 characters, but current rules require ASCII TLDs to consist of letters only, and internationalized ones to use the xn-- Punycode form, so that a TLD can never be confused with an IP address. Most TLD zones are signed with DNSSEC, which lets validating resolvers build a chain of trust from the root down to individual domains.
Types of top-level domains
IANA groups TLDs into several categories that differ in purpose, eligibility and governance. The two largest groups are country-code TLDs and generic TLDs.
| Category | Examples | Key characteristic |
|---|---|---|
| Country-code TLD (ccTLD) | .de, .jp, .sk, .uk | Two letters based on ISO 3166-1, policies set locally |
| Generic TLD (gTLD) | .com, .net, .org, .info | Bound by ICANN contracts and policies |
| New gTLD | .app, .shop, .berlin | Added through ICANN’s application program after 2012 |
| Brand TLD | Company names as TLDs | Restricted to the owner and its affiliates |
| Sponsored TLD | .edu, .gov, .museum | Restricted to a defined community |
| Internationalized TLD (IDN) | Labels in Cyrillic, Chinese or Arabic script | Encoded as Punycode beginning with xn-- |
| Infrastructure TLD | .arpa | Used for technical purposes such as reverse DNS |
Some names are reserved and never delegated, including .test, .example, .invalid and .localhost, which are set aside for testing and documentation, and .local, used by multicast DNS on local networks.
Registries, registrars and TLD policies
Each TLD has exactly one registry operator that maintains the authoritative database of registrations, runs the TLD name servers and sets the wholesale price. Customers usually register names through accredited registrars, which sell domains to the public and send changes to the registry, commonly over the EPP protocol.
Registration data is published through RDAP, the structured successor of WHOIS, subject to privacy rules that vary by TLD. Policies differ considerably, as the table shows.
| Policy area | Typical gTLD | Typical ccTLD |
|---|---|---|
| Eligibility | Open to anyone | Sometimes requires local presence |
| Dispute resolution | UDRP applies | National or registry-specific procedure |
| Pricing control | Registry, under ICANN contract | Registry, often with local oversight |
| Data publication | ICANN registration data policy | National privacy law and registry rules |
Choosing a TLD for a website
The choice of TLD is mainly a question of audience, trust and eligibility, not of search ranking power. Search engines treat most generic TLDs neutrally, while ccTLDs act as a geographic targeting signal for the corresponding country.
| Situation | Suitable TLD | Reason |
|---|---|---|
| Business focused on one country | That country’s ccTLD | Local trust and geographic relevance |
| International product | .com or a relevant generic TLD | Neutral and widely recognized |
| Developer tool or web app | .app or .dev | HSTS preloaded, HTTPS is mandatory |
| Public institution | Restricted government TLD where available | Verifiable official status |
Some new gTLDs are included in the HSTS preload list as a whole, which forces browsers to use HTTPS for every domain under them. This improves security but requires a valid certificate before the site can be reached at all.
Common misconceptions and risks
Several widespread beliefs about TLDs are inaccurate or outdated. Understanding them prevents costly branding and security mistakes.
- A ccTLD is not always tied to its country: some, such as .io, .co or .tv, are marketed globally, yet their policies remain governed by the assigned country.
- Owning a name in one TLD does not protect others: typosquatters can register the same label in different TLDs.
- Internal names can collide with new TLDs: private networks that used invented suffixes saw conflicts when matching TLDs were delegated.
- TLD policy changes affect all registrants: price increases or eligibility rules apply to existing domains as well.
- Lapsed domains are re-registered quickly: expired names under popular TLDs are often caught and reused within days.
A plain-language summary
A TLD is the ending of a web address, the part after the last dot, like .com or .fr. It works a little like the country or category line on an envelope: it tells the system which large office is responsible for the rest of the address.
Each ending is run by one organization with its own rules. Picking an ending is about who your audience is and which rules you can meet, not about being found more easily.
An example from practice
A craft brewery in Austria sells mostly to customers within the country but also ships to Germany and Switzerland. It registers its name under the Austrian ccTLD as the main site, because local customers recognize it and it signals a domestic business.
To protect the brand, it also registers the same name under .de, .ch and .com and redirects them to the main site with permanent redirects. When an online shop is added later, the brewery keeps it on the same domain instead of buying a separate .shop name. The result is one trusted address, fewer phishing look-alikes and simpler certificate and DNS management.