If so why is the difference? I've tried to google it but nothing relevant was found.

  • Not a full answer, but tangentially relevant: It would be impossible to register the domain www.xn--pypal-4ve.info. The .info registrar would not allow it. – TRiG Jun 11 '13 at 14:46
  • Two TLDs come to mind: .mil and .cn. So, what was your question? – Deer Hunter Jun 11 '13 at 19:05
  • 2
    What do you mean by "security"? – Deer Hunter Jun 11 '13 at 19:06
  • @DeerHunter by security I mean lack of attack vectors which involve TLD specific features. – Moonwalker Jun 13 '13 at 11:28

In the general case probably not, although I'd imagine that the authorities running each TLD will have varying levels of technical and operational security, so your domain may be safer with some than others.

One specific case to note however is the prospective .secure TLD whose goal is specifically to provide a secure environment both in terms of their security and the security of sites within the .secure TLD

  • "I'd imagine that the authorities running each TLD will have varying levels of technical and operational security" Is is possible to have some comparisons here? – Moonwalker Jun 11 '13 at 16:13
  • @Moonwalker - policies aren't fixed, so what was a valid answer yesterday, won't be regarded as such tomorrow. – Deer Hunter Jun 11 '13 at 19:35
  • @Moonwalker Also it's very difficult to say, one of the problems of online reputation/security is that all companies will say that they do it well and rarely provide enough detail/assurance for a rational assessment.. – Rory McCune Jun 11 '13 at 20:39
  • In 2020, the last part may need updating. Your link is dead, and it seems like .secure is going nowhere, if it even ever had a formal definition. – Steve Sether Mar 30 '20 at 20:58

I noticed your question is tagged DNS. The significant difference in DNS is that some TLDs have DNSSEC enabled.


From the point of view of the specification for domain names, no. The TLD identifiers are arbitrary strings per the specification document for domain names, RFC 1034. There are security measures that can be taken to address specific services hosted from a domain, but nothing inherently secure or insecure about a given TLD.

There may be some empirical differences in which TLDs are hit by botnets (if they are in fact hitting domains rather than IPs), but this difference is going to be a moving target and I'm not aware of any frequency analysis that's been done on attacks on TLDs.

Edit: I should also note that the administrator of each TLD is able to enforce their own requirements for registering a domain within that TLD. This provides a certain level of authentication for names within that domain, but I am unaware of any requirements that address technical security requirements for registrants.


Yes. Some TLDs require HSTS, such as every Google TLD except .how, .soy, and .みんな. Using one of these TLDs, most notably .dev, will require that your website supports HTTPS. This prevents a MITM attack before the domain is redirected to HTTPS.

  • Google owns .soy? I'm sure there's a spicy joke to be made there. On a more serious note, the big difference is that these domains are technically all HSTS Preloaded. This doesn't mean that a different domain is less secure. It just also needs to manually add itself to the HSTS Preload list. – MechMK1 Mar 31 '20 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.