.us domain names

What .us is

.us is the country-code top-level domain (ccTLD) for the United States of America, assigned on the ISO 3166-1 alpha-2 code US. Delegated on 15 February 1985 and administered at first by Jon Postel at the University of Southern California, it is the oldest country-code domain in existence. Direct second-level registration opened on 24 April 2002; beneath it the older geographic hierarchy codified in RFC 1386 and RFC 1480, the ci.boulder.co.us style of name, still resolves.

The registry operator as of 2026 is Registry Services, LLC of Tempe, Arizona, better known as GoDaddy Registry. It runs .us under contract to the US Department of Commerce, through the National Telecommunications and Information Administration (NTIA), rather than under an ICANN registry agreement. The rules are written by a government department, and that explains nearly everything unusual about the extension.

Neustar held the contract from 26 October 2001 until GoDaddy acquired its registry business in the second quarter of 2020. On 17 January 2025 NTIA published a Request for Information on nexus policy enforcement, DNS abuse and privacy-respecting registration data access, to modernize a Statement of Work dating from 2019; no resulting change has been published.

Who can register .us

.us is restricted, and the restriction is formal. Every registration is governed by the usTLD Nexus Requirements Policy, which recognizes three ways to qualify. Category 1 is a natural person who is a United States citizen, a permanent resident of the United States or any of its possessions or territories, or whose primary place of domicile is in the United States. Category 2 is a US entity or organization incorporated within one of the fifty states, the District of Columbia or any US possession or territory, or organized or otherwise constituted under the laws of a state. Category 3 is a foreign entity or organization with a bona fide presence in the United States or any of its possessions or territories.

Bona fide presence is defined narrowly. The registrant must have real and substantial lawful connections with, or lawful activities in, the United States: either regular engagement in lawful activity, commercial or non-commercial, or the maintenance of an office or property in the country. The policy then closes the obvious loophole, stating that activities conducted solely or primarily to permit registration of a usTLD domain name do not qualify. Renting a mail-forwarding address to obtain a .us is outside the rule.

These categories reach your registrar as two mandatory fields transmitted with every registration: a nexus category and an application purpose. The nexus category codes, in the registry's own terms, are:

• C11 - a natural person who is a United States citizen.
• C12 - a natural person who is a permanent resident of the United States, or any of its possessions or territories.
• C21 - a US-based organization or company formed within one of the fifty states, the District of Columbia or any US possession or territory, or a US federal, state or local government entity.
• C31 - a foreign entity or organization with a bona fide presence in the United States that regularly engages in lawful activities, sales of goods or services, or other business, commercial or non-commercial, in the United States.
• C32 - a foreign entity that has an office or other facility in the United States.

For C31 and C32 the registrar must also submit a two-letter code identifying the registrant's home country, which is why registrar documentation writes these as C31/CC and C32/CC. The CC is the placeholder for the country, not part of the code.

The application purpose has five values: P1 business use for profit, P2 non-profit business, club, association or religious organization, P3 personal use, P4 educational purposes and P5 government purposes. The registry's published nexus codes document covers the categories only, so treat the wording of each purpose as paraphrase rather than quotation.

Both fields are declarations the registrant makes. Nobody checks a passport at checkout: the domain resolves immediately and verification comes later, sometimes years later, by which point a business has been built on the name. A false declaration is grounds for cancellation, through three mechanisms. Incomplete or missing nexus data at registration puts the domain on a 30-day hold for correction; if it is not remedied the registration is cancelled, the name returns to available status, and the fee is not refunded. Registry Services also conducts spot checks, and a selected registrant must supply documentary evidence: a US passport or birth certificate for C11, a green card for C12, a deed, lease, tax ID or official document showing the organization name and a US address current within two years for C21, and a bill of sale to a US buyer for C31 and C32.

Third, any party may file a complaint under the usTLD Nexus Dispute Policy. The complainant pays all provider fees, the domain is locked during proceedings, and if a panelist finds the holder does not meet nexus and cannot cure within 30 days, the name is deleted and returned to the list of available domains. That differs from the UDRP: the only remedy is cancellation. The complainant does not receive the domain; it drops to open availability. Separately, the usTLD Dispute Resolution Policy handles trademark abuse and a Rapid Suspension process exists for clear-cut abuse.

What .us costs to own

The registry fee is set under the NTIA contract rather than by a commercial pricing strategy: a low, flat wholesale fee per year with no history of meaningful registry-level increases. There is no registry-level split between first-year and renewal pricing, so any gap between the two is your registrar's margin, addressable by moving to a registrar whose renewal price you can live with.

Whether the registry operates a premium or reserved-name tier is not confirmed; if a name returns an unusual price, ask whether that is a registry premium or a broker listing. Restoring a domain from the Redemption Grace Period, the window after deletion during which only the original registrant may restore it, costs substantially more than a renewal.

Registration terms, renewals, and transfers

Terms run from one year to ten, with renewals in one-year increments.

Transfers are the most conventional thing about .us: the extension uses the standard EPP AuthInfo model, a unique per-domain authorization code, under the usTLD Transfer Policy. The losing registrar must supply that code within five calendar days and may not withhold it over a payment dispute. A Form of Authorization is mandatory in both directions, transmitted within 24 hours and expiring after 60 days, although in practice the registrant must answer it within five days or the request cancels. The losing registrar then has five calendar days to respond, and silence is treated as approval.

Two 60-day locks apply: transfers are denied within 60 days of creation, and a further 60-day lock follows both a completed transfer and a Change of Registrant, with an opt-out available beforehand. A transfer does not trigger a nexus review, because the transfer policy contains no revalidation requirement.

WHOIS, RDAP, and privacy

WHOIS privacy and proxy registration are prohibited in .us. This catches buyers out more than anything else about the extension, and it is not a default you can change. The usTLD Privacy Services Policy, updated 29 August 2019, states that neither a registrar nor any of its resellers, affiliates, partners or contractors shall be permitted to offer anonymous or proxy domain name registration services which prevent the registry from having or displaying the true and accurate data elements. The prohibition traces to a 2005 NTIA ruling.

Your registrant name, postal address, email address and telephone number are published, alongside registrar, nameservers, dates and status. Enforcement is active: the registry employs an algorithm to detect proxy and private registrations and enforces the registrar's obligation not to offer them. Some registrars still show a privacy upsell at checkout on .us; it does not survive.

Journalists identified the operator of LibsofTikTok partly through the public WHOIS of a .us domain, and registrants routinely report a spike in spam calls and texts within about 48 hours of registering. The mitigations concern which accurate details you publish: a role-based address, a business number, and a business address rather than a home one. Inaccurate data is itself a cancellable breach.

Reform has been discussed and has not landed: NTIA's Federal Register notice of 1 May 2023, proposing an authenticated Accountable WHOIS Gateway System, stated explicitly that privacy and proxy services would remain prohibited. Treat the ban as current. .us is fully DNSSEC signed, with a DS record in the root and a published DNSSEC Practice Statement, but the IANA record lists no RDAP server, so treat RDAP as unconfirmed. IDN support is inconsistent across registrars: assume ASCII only.

Who .us suits, and who should avoid it

.us suits US small businesses, local and regional services, US-based personal brands, government and civic bodies, and anyone building an explicitly American site who wants a short name that is still available. It is also good for domain hacks, a genre it effectively invented.

Avoid it if you are not eligible and are tempted to fudge the declaration, because the cure notice arrives years later and the outcome is cancellation. Avoid it if you want WHOIS privacy: a home-based sole trader publishing a home address and personal mobile number is the classic bad outcome. And treat C31 with caution if your only US connection is that Americans can buy from your website.

Common mistakes with .us

• Buying WHOIS privacy at checkout and assuming it applies. The registry detects and unwinds proxy registrations, and the data is published regardless of what you paid.
• Selecting C31 or C32 on a thin US connection. Having US customers, or renting a mail-forwarding address, is not a bona fide presence. Declare what you could document.
• Mismatching the application purpose and the nexus category. A US corporation registering under C21 with P3 for personal use, or an individual under C11 declaring P1 for a hobby site, produces a record that contradicts itself.
• Treating registration as the end of the obligation. Revalidation can arrive years later, and the cure window is 30 days from a notice sent to the WHOIS email, which must be one you still read.

The first ccTLD, and the seventeen years you could not use it

For the first seventeen years of its life you could not register a plain name in .us. Under RFC 1480 the namespace was strictly geographic: names were built downward through locality and state, so a Boulder city government site lived at ci.boulder.co.us. Oversight moved from the National Science Foundation to NTIA on 1 October 1998, the month Postel died, and second-level registration finally opened on 24 April 2002. Nine days later someone registered del.icio.us, and the domain hack became a genre.

Two later episodes show what happens when a government department writes registry policy. The Dot Kids Implementation Act of 2002 created kids.us, a children's namespace with content restrictions written into federal law; it was suspended on 27 July 2012 for lack of use. And since 31 March 2019 the registry's Acceptable Use Policy has banned online opioid sales outright. The pattern, including the privacy ban, is the same: because .us runs on a Commerce Department contract rather than an ICANN agreement, US policy priorities land directly in registry rules.