What are TLDs? Top-Level Domains Explained

A Top-Level Domain (TLD) is the last segment of a domain name — the part after the final dot. In google.com, the TLD is .com. In bbc.co.uk, it is .uk. TLDs sit at the very top of the DNS hierarchy, directly below the invisible root, and they govern who can register names beneath them and who operates their authoritative name servers.

The DNS Hierarchy

DNS is a tree. At the root is a single dot (written as .), usually omitted in everyday usage. Below the root are the TLDs. Below each TLD are second-level domains (like google in google.com), and so on. A fully qualified domain name (FQDN) like www.github.com. ends with a trailing dot representing the root, though browsers and operating systems add it automatically.

Types of TLDs

IANA classifies TLDs into several categories:

• Generic TLDs (gTLDs) — The original set: .com, .org, .net, .edu, .gov, .mil, .int. After ICANN's 2012 New gTLD Program, over 1,200 new gTLDs were delegated, including .dev, .app, .bank, .shop, .xyz, and many city and brand TLDs like .london, .google, and .apple.
• Country Code TLDs (ccTLDs) — Two-letter codes assigned to each country and territory under ISO 3166-1: .us, .uk, .de, .jp, .cn, .ad. Each country's government or designated registry controls registration policy. Some ccTLDs — .io (British Indian Ocean Territory), .tv (Tuvalu), .ai (Anguilla) — are marketed globally for their abbreviations.
• Internationalized TLDs (IDN TLDs) — TLDs in non-Latin scripts, like .中国 (China) or .рф (Russia), encoded using Punycode in the DNS wire format.
• Infrastructure TLD — .arpa is reserved for internet infrastructure. in-addr.arpa is used for IPv4 reverse DNS; ip6.arpa for IPv6. These are not for public registration.
• Sponsored TLDs — Restricted to specific communities: .edu (US higher education, via Educause), .gov (US government, via CISA), .mil (US military, via DoD).

The Root Zone and Root Servers

At the very top of DNS sits the root zone — a file containing the NS records (name server delegations) for every TLD in existence. IANA, a function of ICANN, maintains this file. It is signed with DNSSEC and published to the 13 root server identities, labeled A through M:

These 13 identities actually correspond to over 1,700 physical instances worldwide, deployed using anycast. The same IP address is announced via BGP from data centers on every continent, so a root server query from Tokyo reaches a Tokyo machine, not a server in the United States. This is why the "13 root servers" can handle billions of queries per day — the actual fleet is enormous.

How TLD Resolution Works

When a recursive resolver receives a query for www.github.com and has no cached answer, it starts from the root:

1. The resolver queries a root server: "Who handles .com?" The root responds with NS records pointing to the .com TLD servers (Verisign's a.gtld-servers.net, etc.), along with their glue records (IP addresses).
2. The resolver queries a .com TLD server: "Who handles github.com?" The TLD server responds with GitHub's authoritative NS records (e.g., ns1.p16.dynect.net).
3. The resolver queries GitHub's authoritative server: "What is the address of www.github.com?" It receives the A or AAAA record with the actual IP address.

This iterative delegation is what makes DNS scalable without a central bottleneck. The root zone is tiny (under 2 MB as text); each TLD only needs to know its second-level domains; each registrant only manages their own zone.

TLD Registry vs. Registrar vs. Registrant

Three distinct entities are involved when you register a domain:

• Registry — The organization that operates the TLD's authoritative nameservers and maintains the database of registered names. Verisign operates .com and .net. RIPE NCC has nothing to do with .eu (that is EURid), but does operate several ccTLDs. Registries set pricing floors and registration rules.
• Registrar — An ICANN-accredited company (Namecheap, GoDaddy, Cloudflare Registrar, etc.) that sells domain registrations to the public. Registrars connect to registries via the Extensible Provisioning Protocol (EPP) over TLS to create, update, and delete registrations.
• Registrant — You, the domain owner.

TLD Infrastructure and BGP

TLD registries are critical internet infrastructure. Verisign's .com TLD alone handles over 100 billion DNS queries per day. To handle this load reliably, TLD operators run large, redundant, anycast-deployed DNS infrastructures with dedicated autonomous systems and heavy peering at major IXPs.

Verisign operates AS26415 for its root and TLD operations. You can look up its routing table to see how a critical piece of global DNS infrastructure peers with the internet.

Explore TLD Infrastructure

• 198.41.0.4 — A root server (Verisign), anycast
• 199.7.83.42 — L root server (ICANN)
• AS26415 — Verisign's autonomous system