Become a TechRadar Insider
Despite advances in cybersecurity technology, billions of dollars in harm each year is being caused by criminals penetrating companies, internal systems and scamming their customers with surprisingly low-tech methods, such as typo-squatting domains, spoofed email addresses, and lookalike websites..
To protect businesses and their customers from such attacks, a new option being embraced by CISOs is brand-owned top-level domains, or “dotBrand TLDs,” becoming available for the first time in fourteen years during a short window ending in August this year.
CEO of Markmonitor Group.
Domains explained
A top-level domain (TLD) is the part of a web address that appears to the right of the dot—such as .com, .org, or .net. Traditionally, these domains are shared spaces, where individuals and organizations can register names on a first-come, first-served basis.
A dotBrand TLD, by contrast, is a dedicated namespace owned and operated by a single organization. Instead of relying on a shared extension like .com, a company can operate websites and services directly under its own branded TLD, registering domain names at will.
Examples of websites already using dotBrand TLDs obtained in the 2012 round include cloud.microsoft, sidewalk.amazom and swoosh.nike. In a shared domain environment like .com or .uk, attackers can register lookalike domains and email addresses to impersonate a brand.
With a dotBrand, that dynamic changes: only the brand itself can create and manage domains within its TLD, so every domain ending in that brand becomes a high-signal indicator of authenticity.
Where trust is critical
In financial services, where trust is critical, institutions like Barclays, JP Morgan Chase and BNP Paribas have leveraged their own TLDs since 2012 to create secure, branded environments. BNP Paribas describe their dotBrand domain as, “a guarantee of trustworthiness for its customers, partners and business lines.”
But the Paris-based bank uses its dotBrand for far more than providing its customers with ultra-secure account access. These include marketing activation websites such as wearetennis.bnpparibas and welovecinema.bnpparibas, the website of the bank’s charitable foundation fondation.bnpparibas, and the site dedicated to the financial institution’s heritage, histoire.bnpparibas. In some less obvious cases, dotBrand TLDs are used for infrastructure, internal systems, or email.
Companies such as Microsoft, Canon, and GoDaddy have incorporated their TLDs into backend operations, where they can enhance control and reduce reliance on external suppliers such as the registries for generic and country code domain names. These larger tech companies typically have very high standards for their own security posture, and the end-to-end visibility and control that an in-house TLD provides is an exact match to their requirements.
There have also been more innovative applications of dotBrand TLDs. Corporations like Google, Zara, Audi, Citi, and Philips have used their dotBrand TLDs for URL shorteners, giving social media users the comfort of knowing they are clicking on a link truly affiliated with the brand they follow, rather than using a generic shortener where the brand, or destination of the link is masked
Broad support
DotBrand TLDs can also support broader efforts to rationalize domain name portfolios. Many large organizations manage hundreds or thousands of domains, often accumulated over time for different purposes. This sprawl can create blind spots, with forgotten or poorly configured domains becoming targets for attackers.
A dotBrand initiative can act as a forcing function to consolidate and standardize these assets, aligning security, legal, and marketing teams around a unified strategy. Despite these examples of their many uses, dotBrand TLDs have remained on the periphery of most security strategies, as only a small number of early adopter companies were able to acquire theirs in 2012.
The 2026 application round, which the domain name regulator ICANN will close at the end of August this year, introduces an opportunity for thousands of additional trust-focused businesses to add a dotBrand TLD to their security arsenal. Unlike traditional domain registration, obtaining a dotBrand TLD is not a first-come, first-served online purchase. Organizations must complete an extensive application process, meet specific criteria, and work with accredited providers to operate their TLDs.
While this creates a higher barrier to entry, it also ensures that no bad actor can end up controlling a dotBrand TLD. Of course, dotBrand TLDs may still be hotly contested between brands that share a name. In the 2012 round, both the insurance company Guardian Life and The Guardian newspaper applied for the dotBrand TLD .guardian. Companies typically bring in specialized consultants to help them with the arcane dispute resolution mechanisms in such cases.
Specialized consultants are also generally employed for operating dotBrand TLDs, which requires meeting ongoing compliance requirements, specialist technical solutions, and cross-functional coordination. In addition to established brands, new dotBrand TLD participants expected to emerge in the 2026 round include many digitally native companies—including those in the crypto and Web3 space, where control over identity and infrastructure is often a core principle.
Not a complete solution
Despite its many advantages, a dotBrand TLD is not a complete security solution. As organizations plan their cybersecurity investments, the question is not whether to adopt any single approach, but how to balance different layers of defense. In combination with AI-driven threat detection, a controlled namespace can also improve signal quality. Automated systems can treat any use of the brand outside the authorized TLD as a higher-risk indicator, enabling faster and more accurate responses.
However, attackers can still operate from unrelated domains, compromise legitimate infrastructure, or exploit social engineering tactics across platforms. A dedicated namespace narrows one attack surface but does not eliminate the broader threat landscape. Its effectiveness also depends on consistent use. For a dotBrand to function as a trust anchor, customers and partners must encounter it regularly in legitimate interactions.
Without this visibility, it is unlikely to become a meaningful signal. AI tools will continue to play an important role in detecting and responding to threats. However, they operate within the constraints of the existing system. A dotBrand TLD, by contrast, offers a way to modify the system itself—changing how identity is structured and communicated.
With a limited application window approaching and no indication of if or when the next opportunity will arise, large organizations have an opportunity to consider whether this approach aligns with their long-term strategy.
We've rated and ranked the best website builders.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit