The .name Termination: Domains Are Rentals

The #1 story on HN is the death of an entire TLD. Every domain is a revocable lease — and your account recovery hangs off it.

Dafallah Ibrahim

— 2 min read
Share

The top story on Hacker News right now is an obituary for a top-level domain. Neil Fraser, whose personal site lives on a .name address, reports that the entire .name TLD is being terminated. Fourteen hundred points later, half of HN is checking their registrar accounts.

You probably don't own a .name domain. Doesn't matter. This is a reminder that every domain is a lease on infrastructure you don't control — and your entire identity chain hangs off DNS.

Why this matters

Make a list of what a domain actually does for you. It receives password-reset mail. It's the verified identity behind your GitHub, npm, PyPI, and cloud accounts. It fronts docs, status pages, and short links. When a domain dies, none of that fails loudly. It fails silently, months later, at the worst possible moment.

And a terminated registry is the gentle scenario. When a domain merely expires and gets re-registered, your reset emails start arriving in a stranger's inbox. Now it's not a DNS problem. It's an account takeover.

How it works

The takeover chain is boring and reliable:

  • Registration lapses, or the registry itself sunsets.
  • A drop-catch service re-registers the domain within seconds.
  • The new owner stands up MX records; Let's Encrypt issues a valid cert in minutes.
  • Every "forgot password" flow that trusted the address now trusts the attacker.

Package registries are the high-value target. Publish rights on npm and PyPI anchor to an email address. Own the email, own the package, ship version 2.0 to fifty thousand dependents.

Registry termination is different but still nasty: mail just bounces. And if you ever sent HSTS headers, browsers cached them for max-age — even an emergency redirect page won't load over plain HTTP.

Where this helps

  • Personal domains doubling as recovery email for production cloud accounts.
  • Maintainer identity for open-source packages — the supply-chain flavor of the same attack.
  • Short-link and redirect domains baked into emails, QR codes, and printed docs. They rot invisibly.
  • Company domains on the long tail of the 2012 gTLD expansion. Several registries are on life support, and .name won't be the last to sunset.

Watch out

Registrar locks and auto-renew protect against expiry, not against a registry shutting down. ccTLDs add national policy risk on top. No TLD is immortal — though .arpa, run by IANA, comes closest; today's other front-page story explains how to get one free.

Decommission domains deliberately. You can't reliably un-set HSTS, so kill traffic before you drop the registration, not after.

Try it yourself

Run this against every domain your accounts depend on:

DOMAINS="yourmail.dev company.io oldproject.name"
for d in $DOMAINS; do
  echo "== $d"
  whois "$d" | grep -i expir | head -2
  echo "MX -> $(dig +short MX "$d" | head -2)"
done
# Crown jewels: any domain whose MX feeds a password-reset inbox

TL;DR

  • What changed: the .name gTLD is being terminated — proof that whole TLDs can sunset.
  • Why it matters: a domain you lose is an account-takeover and supply-chain path, not just a dead link.
  • Try today: audit expiry dates and recovery-email domains; move identity off fringe TLDs.

Read more