.xyz domain names

What .xyz is

.xyz is a generic top-level domain from ICANN's 2012 new gTLD round. It is not restricted, not sponsored and not geographic, and the string is deliberately meaningless - it was positioned from the outset as a general-purpose alternative to .com rather than as a category label. That neutrality is the point: .xyz carries no semantic obligation, so it fits anything.

The registry operator is XYZ.COM LLC, confirmed as the sponsoring organisation in the IANA root database, founded by Daniel Negari, who had built XYZ.com into an ICANN-accredited registrar before becoming a registry applicant. Back-end services come from CentralNic Ltd, now part of Team Internet, and there has been no change of registry operator or back-end provider in the extension's life - worth noting, because several close competitors have changed hands or migrated infrastructure.

The timeline is precise: the registry contract was signed on 5 December 2013, IANA registration followed on 6 February 2014 with delegation on 12 February 2014, and general availability opened on 2 June 2014.

Who can register .xyz

There are no eligibility restrictions. Any individual or organisation, anywhere, may register a .xyz for any lawful purpose - no nexus requirement, no documentation, no validation step and no registry verification.

The only universal check is the registrar-side obligation under ICANN's Registrar Accreditation Agreement to verify the registrant's contact email or telephone number, which applies to every gTLD. Ignoring that message can get a domain suspended.

What .xyz costs to own

The defining commercial characteristic of .xyz - and of the discount new gTLD cohort it leads - is the gap between what the domain costs to acquire and what it costs to keep. The registry sets a wholesale rate; registrars discount the first year only, frequently below their own cost, treating the registration as a customer-acquisition instrument, with the real margin in hosting, email and every renewal after the first. At least one major registrar gives the first year away entirely.

That gap is not a promotion that will normalise. It is the permanent business model of this segment. .xyz's renewal rate is materially higher than .com's renewal rate, which produces the outcome that catches people out: a .xyz is cheap once, then more expensive than a .com every year afterwards. On any holding period beyond roughly two years the total cost of ownership comes out above .com. Compare the renewal price multiplied by the years you expect to hold the name, at the registrar you intend to keep it with, because renewal pricing varies far more widely between registrars than promotional pricing does.

Premium names complicate this, because the registry runs two premium models at once and they are indistinguishable from the registration price alone. Variable-price premiums (Tiers 1 to 6) have registration, renewal and transfer prices identical, every year, indefinitely. Tier A, B and C premiums, introduced on 1 August 2018, carry a premium registration price followed by standard renewal. Two names can therefore cost the same to register and renew at wildly different rates forever. The one genuine exception to the whole pattern: in June 2017 the registry opened all 1.111 billion six- to nine-digit numeric combinations at a permanently flat annual rate, with no first-year to renewal gap at all.

There are no price caps, so increases are permitted subject to six months' notice and the right to renew up to ten years at the pre-increase price. After expiry there is an auto-renew grace period of around 35 days and a 30-day redemption grace period, during which restoring the name costs substantially more than a renewal.

Registration terms, renewals, and transfers

Registration periods are set in the registry's own policy: names may be registered for no less than one year and no more than ten. Individual registrars may cap this lower, and several do.

Transfers use the standard EPP authorization code, with one .xyz-specific quirk worth knowing before you generate one: the code must be 16 to 48 characters long and include at least two characters from each of the alphabetic, numeric and special-character classes. Codes that would pass elsewhere may be rejected here. Transfers auto-approve after five days if the losing registrar neither acknowledges nor rejects them.

Two sixty-day locks apply, and the first is enforced at the registry level rather than merely permitted by policy: sixty days after initial registration, and sixty days after a Change of Registrant, the latter with an opt-out available if exercised before the change. The reform adopted by the GNSO Council on 12 March 2025 would replace both with 720-hour locks, but no effective date has been published.

WHOIS, RDAP, and privacy

RDAP is the definitive source for .xyz registration data, as it has been for all gTLDs since 28 January 2025. The .xyz RDAP service runs through CentralNic and is registered in IANA's RDAP bootstrap file. The registry also documents a web WHOIS interface and a port-43 service with rate limiting, but neither is the contractual system of record.

Redaction follows ICANN's Registration Data Policy, in force since 21 August 2025: personal registrant fields are redacted, with a contact email address or web form published. Privacy and proxy services are permitted, and the evidence is affirmative rather than merely the absence of a ban - the registry sells its own ID Protection service directly.

DNSSEC is supported; the registry publishes a DNSSEC Practice Statement and defers to CentralNic's for operational detail. Internationalised domain names are supported, with registry policy requiring non-ASCII labels to use scripts offered by the registry. The registry's published script table could not be located, so treat any enumerated list with caution.

Who .xyz suits, and who should avoid it

.xyz suits a narrower set of buyers than its registration numbers imply: crypto, Web3, AI and developer-tooling projects, where it is a recognised native convention rather than a visible compromise; short, memorable brandables where the .com is unobtainable and the audience is technically literate; redirects, campaign microsites and deliberately disposable projects, where the low acquisition cost is the point and renewal was never intended; and anyone who simply wants a short name, since availability is vastly better than in .com.

It is the wrong choice for:

• Businesses whose primary channel is email. The deliverability risk is the strongest of the discount new gTLDs - some anti-malware and mail-filtering vendors apply blanket or near-blanket blocks to .xyz.
• Financial services, healthcare, legal practices and any sector where the domain itself carries trust signalling to a non-technical audience.
• Businesses selling to older or less technical demographics, where an unfamiliar extension costs conversion.
• Anyone buying on the first-year price without checking the renewal.

On reputation, be specific rather than blanket. Interisle Consulting's Phishing Landscape 2025 ranks .xyz fourth globally by raw phishing domain count, at 73,509 domains, and links the pattern to price. Two counterweights belong alongside it: .xyz is not among the top five TLDs by phishing rate, and .com hosts roughly six times more phishing domains in absolute terms. There is also no Google ranking penalty for .xyz, and no benefit either.

Common mistakes with .xyz

Buying on the promotional first-year price without checking the renewal. The .xyz renewal rate exceeds .com's, so over any realistic holding period the .xyz is the more expensive domain. The advertised price is a one-time acquisition cost, not the cost of ownership.

Assuming a premium .xyz renews at the standard rate - or assuming it does not. Because of the coexisting Tier 1 to 6 and Tier A/B/C systems, the registration price of a premium .xyz tells you nothing about its renewal price.

Using .xyz as a primary business email domain without testing deliverability. Configure SPF, DKIM and DMARC fully, then send test mail to a major consumer provider, a Microsoft 365 tenant and a corporate filter before committing. Some recipients will never see your mail, and you will not find that out from your own outbox.

Reading the registration count as a measure of adoption. It is not, for the reasons below.

The volume argument: what a registration count actually measures

.xyz has been the most argued-about extension of the new gTLD era since the week it launched, and the argument has always been about the same thing: whether its registration numbers describe adoption or describe a promotion.

The 2014 launch numbers were substantially artificial. In June 2014 Network Solutions added .xyz domains matching customers' existing .com names to those customers' accounts on an opt-out basis. By 10 June 2014, 80,904 of the 96,246 total .xyz registrations in existence sat at Network Solutions - a registrar that normally held well under 5% of new gTLD registrations. Verisign publicly challenged the figures, NameStat.org added a toggle between raw zone-file numbers and what it called real numbers, and ICANN was criticised for declining to intervene. .xyz nonetheless became the first new gTLD to pass 750,000 registrations, on 16 December 2014.

The mechanism in 2026 differs in form and matches in effect. .xyz is the fourth-largest gTLD and seventh-largest TLD overall, and ICANN's March 2026 transaction report gives a verified floor of 7,659,470 domains across the top twelve registrars. The distribution is the story: GMO Internet's Onamae.com went from 234,121 .xyz domains in March 2024 to 827,035 in March 2025 to 4,774,437 in March 2026, roughly 62% of that floor. Onamae gives .xyz away free for the first year, one per customer, and analysis found all of its registrations on one-year terms; in March 2026 it renewed 1,491 of those 4.77 million domains, while GoDaddy renewed 15,905 of 646,740. Those ratios carry a caveat - ICANN's renewal field appears to exclude auto-renewals - so the published rate is the one to cite: Verisign's second-quarter 2026 brief puts .xyz at 17.5%, the lowest of any top-ten TLD by size, against 31.0% for new gTLDs as a group and 75.2% for .com and .net combined. The extension is shrinking, with 286,525 creates against 349,816 deletes in March 2026.

The fair conclusion is narrower than either side usually allows. A registration count measures how many names are in the zone on a given day, not how many people chose the extension, paid for it, or will still be there next year - and when a majority of a zone sits at one registrar giving the product away, the count describes the promotion more than the market. Equally, dismissing .xyz on those numbers would be its own error: beyond the dominant registrar the base looks normal, with Namecheap at 677,381 and GoDaddy at 646,740, so millions of .xyz domains are held by ordinary paying registrants - and Alphabet Inc. launched at abc.xyz in August 2015. .xyz is at once one of the largest gTLDs in the world, a real home to real projects, and a zone whose headline number is inflated by a giveaway.