Expert discussions on domain name registration, ICANN policies, DNS, and domain management.
ICANN itself does not impose a hard cap on the number of domain names an individual or company can register across generic top-level domains (gTLDs). However, individual domain registrars may impose their own limits—often in the hundreds or thousands—as a fraud-prevention measure, and some country-code TLDs (ccTLDs) restrict registrations to residents or businesses. A few registry operators set limits at the registry level to prevent hoarding in premium new gTLDs. In practice, large domain portfolio companies own hundreds of thousands of names across multiple registrars, operating within registrar terms of service rather than any universal ICANN rule.
ICANN's rules require that all gTLD registrations be for a minimum of one year, with a maximum registration term of ten years per registration cycle. Registrars typically offer registration periods from 1 to 10 years, with multi-year registrations often discounted. Domains can be renewed before expiry, effectively allowing indefinite ownership as long as renewal fees are paid. Some registrars offer auto-renew services that charge the registered payment method automatically 30-60 days before expiry to prevent accidental lapse.
When a domain enters the expired state after the registrant fails to renew, it passes through a 'grace period' and then a 'redemption period' before being deleted and returned to the registry. Many registrars partner with auction platforms like GoDaddy Auctions, NameJet, or Sedo to auction expired domains during the deletion process, giving buyers a chance to acquire names with existing backlinks and traffic. The auction typically begins when the domain enters a pending-delete status and runs for several days, with the highest bidder securing the right to register the name at deletion. Buyers should verify the domain's backlink profile and any historical spam associations using tools like Majestic or Ahrefs before bidding.
ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP) provides a streamlined mechanism for trademark holders to challenge domain registrations that were made in bad faith with the intent to profit from the trademark's value. To prevail under a UDRP complaint, the complainant must prove three elements: that the domain is identical or confusingly similar to their mark, that the registrant has no legitimate rights, and that the domain was registered and used in bad faith. Registration of large portfolios of generic keyword domains is generally permitted, but registering names that incorporate specific trademarks constitutes cybersquatting under the U.S. Anti-Cybersquatting Consumer Protection Act. ICANN's rights protection mechanisms for new gTLDs include Trademark Clearinghouses and Sunrise periods that give trademark holders priority registration before public launch.
Country-code top-level domains (ccTLDs) like .de, .fr, and .jp are administered by national registry operators who set their own registration requirements, often requiring a local presence or nationality. Germany's .de is one of the most open ccTLDs, requiring only a local administrative contact rather than residency. Australia's .com.au requires registrants to hold a matching Australian Business Number (ABN) or trademark. Japan's .jp has relatively strict requirements favoring residents and businesses established in Japan. The United Kingdom's .co.uk is managed by Nominet and has historically been open to international registrants, though local presence rules apply for some second-level variants.
WHOIS privacy, also called proxy or privacy registration, replaces the registrant's personal contact information in the public WHOIS database with the contact details of the registrar's privacy service. This service was standardized and extended under ICANN's GDPR-compliant Registration Data Access Protocol (RDAP), which replaced the traditional WHOIS system starting in 2023. However, law enforcement agencies and accredited IP rights holders can request access to the underlying registrant data through ICANN's standardized request process. Some ccTLD registries maintain entirely private WHOIS records by default, while others require public disclosure regardless of privacy preferences.
When a domain registration lapses, it passes through several status phases: active, expired (30-day grace period for free renewal), redemption grace period (30 days, renewal possible with a penalty fee), and pending delete (5 days before registry deletion). After deletion, the domain typically re-enters the general registration pool and becomes available to anyone on a first-come, first-served basis within 24-48 hours. High-value expired domains are frequently caught by automated drop-catching services operated by large domain registrars, meaning desirable names may be acquired milliseconds after deletion. Some registries use delayed release mechanisms or public auctions for high-demand names to prevent drop-catching.
Domain front-running is the alleged practice by which a registrar or registry with privileged access to domain lookup data registers names that users search for but don't immediately purchase. ICANN's 2008 amendments to the Registrar Accreditation Agreement explicitly prohibit registrars from using WHOIS lookup or registration query data to front-run domains, with potential accreditation revocation as a penalty. Documented cases of front-running are rare partly because the practice is difficult to prove—it requires showing that registration coincided systematically with search queries. Registrars implement data isolation policies to ensure that their registry access system (RAS) teams cannot see customer search data.
ICANN launched its new gTLD program in 2012, accepting applications for new domain extensions beyond the original set (.com, .net, .org, etc.) in order to expand the namespace and increase competition in the domain registration market. Applicants paid a $185,000 evaluation fee and underwent a rigorous technical, financial, and string contention review process. The program added over 1,200 new extensions, ranging from geographic names (.london, .tokyo) to industry terms (.bank, .health) and brand names (.google, .apple). A second round of new gTLD applications was approved in 2024, with the application window opening in 2026, expected to add hundreds more extensions.
A comprehensive brand domain protection strategy starts with registering your core trademark as a .com and as many relevant gTLDs and ccTLDs as budget allows, particularly in markets where your brand has significant presence. Setting up Google Alerts and services like MarkMonitor or CSC Digital Brand Services automates monitoring for new registrations that incorporate your brand terms. Filing for Trademark Clearinghouse (TMCH) registration through ICANN gives your brand priority during Sunrise periods for new gTLD launches and triggers notification when someone attempts to register a name matching your mark. When infringement is detected, the UDRP process is typically faster and less expensive than litigation for recovering cybersquatted domains.