.io domain names

What .io is

.io is the country-code top-level domain (ccTLD) assigned to the British Indian Ocean Territory - the Chagos Archipelago, in the central Indian Ocean. Delegated on 16 September 1997, its IANA type is country-code rather than generic - a distinction with real consequences for policy, privacy, and long-term risk.

The territory has no permanent civilian population. Its Chagossian inhabitants were forcibly removed in the late 1960s and early 1970s for the joint UK/US military base on Diego Garcia, whose address still appears as administrative contact on the IANA record. That history is why the domain is contested.

Commercially, .io owes almost everything to a pun: I/O reads as input/output to anyone with a computing background, and that coincidence turned a remote territory's code into the default startup and developer namespace from the mid-2010s onward. Trade press put the zone at over a million registrations as of mid-2025, vanishingly few connected to the Indian Ocean.

Operation has changed hands repeatedly: Internet Computer Bureau Ltd from 1997, Afilias from April 2017, then Donuts, which bought Afilias in December 2020 and rebranded as Identity Digital. It runs .io today, though IANA still records Internet Computer Bureau Limited as sponsoring organization, in an entry updated 18 January 2023.

Who can register .io

At the second level - the part you actually buy, as in example.io - .io is open to anyone, anywhere: no local presence requirement, no nexus declaration, no identity or credential check beyond ordinary registrar verification. Third-level registrations historically required residency in the territory, which given the absence of a permanent civilian population made them unobtainable - a curiosity rather than a real restriction.

The policy that does bite concerns content: registry policy has historically prohibited sexual or pornographic material and content violating the statutory laws of any nation. That second clause is unusually broad - read literally, it makes a registrant answerable to every jurisdiction on earth rather than to one. Enforcement is discretionary rather than systematic, but if your business sits in a legal gray area anywhere, the clause is a handle for a complaint that a generic TLD's agreement does not offer.

What .io costs to own

.io is a premium-priced namespace by design: wholesale cost sits far above legacy generic TLDs and there has never been a cheap-forever tier. What matters most is that renewals are not discounted. Registrars often run a modest first-year promotion, but the standing renewal is the real cost of ownership - the largest single source of registrant surprise here.

The registry has raised wholesale prices repeatedly and scheduled more: Identity Digital announced a 12% increase effective 19 January 2027, applying to renewals as well as new registrations. It fits a pattern: the same operator repriced 231 TLDs effective 6 October 2025 - increases from 6% to 220%, median 12% - letting registrants pre-renew up to ten years at old rates. Pre-renewing ahead of an announced increase is the only reliable hedge.

A premium tier exists for short, dictionary, and registry-reserved names, and the registry has released held inventory by auction, including a round in May 2025. Premium classification usually attaches permanently, so the elevated price recurs every year rather than acting as a one-time uplift. The advice is arithmetic: multiply the renewal by your intended holding period, add a plausible increase or two, and decide before committing.

Registration terms, renewals, and transfers

.io supports registration terms of one to ten years, though some stale documentation still claims a five-year maximum; current registrar specifications support ten; confirm at purchase if a decade-long registration matters.

Transfers use the standard EPP authorization code: unlock at the losing registrar, retrieve the code, submit it at the gaining registrar. There is no tag change, no registry-specific form, no manual approval step. A transfer adds one year to the term. Two locks matter - a newly registered .io cannot be transferred for 60 days, and one just transferred cannot move again for another 60 - so consolidation must be sequenced rather than done in one sweep.

After expiry, a .io can typically be renewed for around 45 days at the ordinary price, then enters a roughly 30-day redemption or quarantine period - the window in which only the original registrant may restore it, on payment of a restore fee well above a renewal - before moving to pending delete. At this price level a lapse is expensive to reverse.

WHOIS, RDAP, and privacy

The authoritative WHOIS server is whois.nic.io, and RDAP - the Registration Data Access Protocol, the structured successor to WHOIS - is available through Identity Digital's service. Registrar of record, status, and key dates remain public; registrant contact data is redacted broadly, in line with contemporary practice.

A structural nuance is routinely missed. Because .io is a ccTLD rather than a generic TLD, it is not bound by ICANN's gTLD registration-data consensus policies: the redaction you see is applied at the operator's discretion, not because ICANN mandates it. The output resembles a .com record day to day, but the guarantee is contractual rather than policy-mandated, and could in principle be varied in a way a gTLD's could not. Privacy and proxy services are generally available through registrars.

DNSSEC - cryptographic signing of DNS responses so resolvers can detect tampering - is supported, as are internationalized domain names, so accented and non-ASCII labels are available.

Who .io suits, and who should avoid it

.io suits products whose audience reads the two letters as input/output and attaches no geography to them: developer tools, APIs, SaaS platforms, open-source projects, games, technical infrastructure. It suits early-stage startups where a short, available name matters more than twenty-year certainty, and anyone able to migrate cheaply - a business with an app-store presence, a sales-led motion, or customers who do not arrive by search.

Two groups should avoid it. The first is anyone who cannot absorb a forced migration. The risk is not that .io disappears next year; it is that in some future year you receive five years' notice to move a brand you spent a decade building. Content and affiliate businesses on organic rankings would fare worst: their principal asset is exactly what does not transfer cleanly. The second group is defined by permanence and scrutiny - regulated industries, financial institutions, healthcare, government suppliers, anyone whose domain appears in long-lived contracts or in print. Budget-sensitive projects and large portfolios should think twice too, since renewal cost compounds at volume. Organizations with human-rights procurement policies have a further consideration, given the Chagossian displacement and the 2021 OECD complaint.

Underneath all of it is a point common to every country code sold generically, and .io is its sharpest example: you are building on a foreign territory's two-letter allocation, under rules set by a sovereign process in which you have no standing. That is not a reason to rule .io out - many substantial, well-advised companies chose it deliberately and remain there. It is a reason to know you are renting, not owning, and to price the lease honestly.

Common mistakes with .io

Four errors account for most .io regret.

• Budgeting .io like .com. Buyers anchor on a discounted first year, then meet the standing renewal, then a scheduled increase. A five-year projection is the minimum honest way to evaluate cost.
• Building the brand on .io and never acquiring the matching .com. When the company works, the .com holder names their price - usually a large multiple of the original cost. It is the most expensive mistake here, and it has nothing to do with Chagos.
• Reacting to headlines rather than facts, in both directions. Some dumped .io portfolios after October 2024 coverage describing imminent deletion; others read ICANN's not a foregone conclusion as a guarantee. Neither survives contact with the policy.
• Buying a premium .io without checking the renewal tier. Premium status follows the domain for life, so the elevated price recurs every year.

The Chagos question: what is established, and what is not

This is the most misreported topic in the industry, so separate documented fact from inference. On 3 October 2024 the United Kingdom announced its intention to cede sovereignty over the Chagos Archipelago to Mauritius while retaining Diego Garcia under a long lease, and on 22 May 2025 the two governments signed a treaty to that effect, the UK holding rights over Diego Garcia for an initial 99 years. It gives Mauritius full ITU representation and control over the regulation of commercial activities, including electronic communications, unrelated to the base. UK implementing legislation completed its Commons and Lords stages, with the Commons due to consider Lords amendments on 20 January 2026.

Two things are not established. It is unconfirmed that the treaty has been ratified and entered into force, so the handover should not be called complete. And IO has not been removed from ISO 3166-1, the standard list of country codes.

That second point decides everything: ICANN and IANA do not determine which countries exist. A ccTLD becomes eligible for retirement when its code leaves ISO 3166-1, not when sovereignty changes or a treaty is signed. ICANN said so in November 2024: IO persists in the standard, a sovereignty change is likely to trigger an evaluation by the committee that maintains it, and if IO were removed, "a five-year time window will commence during which time usage of the domain will need to be phased out" - a window that "might be extended." Its summary is the fairest available: it is "not a foregone conclusion that a change in sovereignty will result in a change to the .io domain," and if it does, "ICANN policy provides a great deal of time for the community to adapt."

Precedent supports that reading. IANA's process opens with a Notice of Removal and a default five-year phase-out, extendable by five further years on documented justification, with the manager required to plan successor domains and registrant communication. Practice has been slower still: Yugoslavia's .yu was removed in 2010, roughly eighteen years after the country began dissolving, its registrants migrating to .rs and .me; the Netherlands Antilles' .an was reallocated to .cw, .sx, and .bq over roughly five. The strongest case is .su, whose code left ISO 3166-1 in 1992: ICANN took no retirement action for more than three decades, sent a pre-notice letter on 6 February 2025, targets 2030, and left roughly 100,000 .su domains registered with the TLD still open to new ones.

The reasonable conclusion in 2026 is narrow. Nothing has happened to .io: it is fully operational and actively sold, and its operator has scheduled a wholesale increase for January 2027 - not how a business behaves when it expects to lose a namespace. Either the IO code survives a change of territory name and registrants are unaffected, or it is withdrawn and .io enters a five-to-ten-year phase-out alongside a successor. Which cannot be known now. What can be said is that no ccTLD has ever been switched off abruptly, that the pattern is drift followed by a five-year minimum wind-down, and that no end date exists for .io because none has been set.