Onchain top-level domains: the complete guide

A top-level domain, or TLD, is the label at the far right of a name, after the last dot. For most of the internet’s history, those labels were the concern of ICANN and of the registries it authorizes. Running a TLD meant an application, an evaluation, a contract and continuing obligations. In practice, it was open to well-funded organizations prepared to commit to a long process.

Onchain TLDs work on a different footing. A TLD can be registered, held and transferred as a token on a public blockchain, with no application to ICANN. The holder decides who receives names under it and on what terms. The tradeoff is that an onchain TLD sits outside the DNS root that ICANN coordinates, which limits where and how its names resolve.

This guide builds the subject from the ground up, in the order a careful newcomer would ask the questions: what an onchain TLD is, how it compares with its DNS counterpart, what a holder actually has, how names under a TLD work, where they resolve, what organizations do with these assets, and which limits to weigh. It then covers how TLDs change hands and where to go next depending on your role.

1,616applications going forward in the 2026 ICANN new gTLD round

USD 227,000evaluation fee ICANN expects for each application, with advisers and registry operations still to pay on top

Noneannual renewal fee on a Freename onchain TLD

The number of applications is the one reported by the trade press covering the round, the evaluation fee is the one given on ICANN's new gTLD program pages, and the absence of a renewal fee is as stated by the Freename registry.

What an onchain TLD is, in plain terms

An onchain TLD is a namespace label recorded as a token on a public blockchain. A token, in this sense, is an entry in a shared ledger that says which wallet controls a given asset. When the token sits in your wallet, you hold the TLD. The record is public: anyone can look it up on a block explorer, a website that displays what the blockchain contains.

The label itself is the string that appears after the dot in the names issued under it. If the label is yourbrand, names under it look like pay.yourbrand or team.yourbrand. The holder decides which names exist and whether they are handed out to anyone who asks or only to chosen parties.

This guide takes the Freename registry as its reference, because the facts about it are documented. On that registry, the TLD exists as a token that a wallet holds, and keeping it does not involve an annual renewal fee. The token carries the ability to issue names under the TLD. Other registries exist and their rules differ, so a statement made here about Freename should not be read as a statement about every onchain naming system.

You will also meet the phrases “Web3 domain”, “blockchain TLD” and “crypto TLD”. They describe the same structure: a top-level label controlled through a wallet instead of through a registry agreement with ICANN.

How an onchain TLD differs from a DNS TLD

The DNS, the Domain Name System, is the global, hierarchical directory that translates human-readable names into the addresses computers use. ICANN is the nonprofit that coordinates the DNS root, the top of that hierarchy. A TLD that ICANN has delegated resolves in every ordinary browser. A label that is not in the DNS root does not, unless the software in use has been built to look elsewhere.

An onchain TLD and a DNS TLD share one concept, a label under which other names are organized. Their operational, legal and economic structures have little else in common.

The ICANN route offers global resolution: any browser opens a name under a DNS TLD with no plugin and no configuration. It also comes with a recognized dispute procedure. The Uniform Domain-Name Dispute-Resolution Policy, the UDRP, binds registrants through the contracts they sign with ICANN-accredited registrars. An onchain TLD has neither that breadth of resolution nor that procedure. What it offers instead is direct control, a short path to holding the label, and no renewal fee on the registry discussed here.

The two routes are not open on the same schedule. ICANN opened an application round for new generic TLDs in 2026, the first in more than a decade, and its window closed on August 12, 2026. An onchain TLD is not tied to rounds of that kind. That difference in timing explains much of the interest from organizations that did not apply, but it does not make the two assets equivalent.

Organizations weighing both routes for a brand will find a criterion-by-criterion comparison in the page on an ICANN dotBrand against an onchain TLD.

Who holds a TLD and what holding means

Holding an onchain TLD means holding the token that represents it. The token sits in a wallet, the software or hardware that stores the private keys needed to authorize transactions on the blockchain. Whoever controls those keys controls the TLD.

Three consequences follow.

First, custody matters. A TLD held in one person’s everyday wallet is more exposed than one held in a multisignature wallet, a wallet that requires several key-holders to approve any transaction. An organization should give a TLD the same custody discipline it gives any material digital asset: named signers, a documented procedure, and a plan for the day a signer leaves.

Second, the public record is the reference. The holder is the wallet that the registry record shows, and anyone can check that record on a block explorer. This is useful in a transaction, because neither side has to take the other’s word for who holds the asset. It also means that internal arrangements, such as a TLD held by an employee’s wallet on behalf of the company, are invisible onchain and need to be documented off it.

Third, control is direct. There is no registrar account between the holder and the asset, and no renewal date to miss on a Freename TLD. The other side of that directness is that there is no help desk to restore access if the keys are lost.

Holding a TLD does not confer trademark rights. Trademark rights arise from registration with a national or regional office, from use in commerce, or from both, depending on the country. A holder who also owns a registered trademark for the same string is in a stronger position than one who does not, but the TLD itself is a technical asset, not a trademark registration. How the two interact varies by country, and your own counsel decides.

Holding also creates operational responsibility. Once names are issued under the TLD, the holder is in practice running a small registry. That means setting an issuance policy, deciding what is refused, keeping records of who received which name, and planning for an exit. Accounting and tax treatment of the token is a further question with no uniform answer across countries.

Names under a TLD: who issues them and what they are for

On the Freename registry, issuing names under a TLD is reserved to whoever holds that TLD. Nobody else can create pay.yourbrand. This is the feature that makes a TLD different from an ordinary name: it is the right to decide what exists beneath it.

A name under a TLD is often called a subname. Once pay.yourbrand is issued, it can be attached to records: a wallet address, a website, or nothing yet. This guide uses “name” and “subname” for the same thing.

Names serve four broad purposes.

Identity

A name is a readable identifier tied to a wallet. Instead of sharing a long string of letters and digits, a person or an entity shares team.yourbrand. A wallet that supports the registry translates the name into the underlying address when it prepares a transaction. The benefit is fewer copying errors and an identifier that says who issued it.

Payment routing

A name can be the destination of an onchain payment. One example of infrastructure built for this is shaka, an onchain payment router. With it, a payment link can pay out to a name where a raw address would otherwise be needed, and the parties agree and sign the split between them onchain before any funds move. The router directs funds and never holds them. The page on payments to a name follows this use further.

Websites

A name can point to content published on IPFS, a peer-to-peer storage network in which a file is addressed by a fingerprint of its content instead of by the server that hosts it. Freename offers a website builder with which a holder assembles pages and publishes them to IPFS. Visitors then reach the site through the onchain name, in browsers that support it.

Identities for AI agents

ERC-8004, titled “Trustless Agents”, is a draft Ethereum standard. It describes three registries for software agents. The identity registry represents each agent as an ERC-721 token that points to its agent card. The reputation registry collects feedback from the parties an agent has worked with. The third, the validation registry, is where checks carried out independently on an agent’s work are recorded. Because it is a draft, it may change, and the way naming registries connect to it is still evolving. Treat this use as a direction to follow, not as something to build a plan on.

Open or closed issuance

How names are issued, and to whom, is the holder’s decision. A holder can run a closed namespace, issuing names only to known parties such as subsidiaries, staff or partners. A holder can also open registration to the public. For the open model, Freename runs a royalty program: each time a name is registered under a TLD, part of the registration fee goes to that TLD’s holder. The program advertises a share of up to half, and what a holder actually receives depends on the terms the registry applies and on its activation conditions. Read those terms before building a revenue forecast on them. The forecast also needs a cost line: holding a Freename TLD involves no annual renewal fee, but taking part in the royalty program carries an annual cost that the registry sets. Some TLDs were registered under earlier terms that include the program for life, and anyone acquiring such a TLD should confirm with the registry, before closing, whether those terms carry over to a new holder.

How resolution works and where

Resolution is the step that turns a name into something a machine can act on: a wallet address, a server address, a content fingerprint. For DNS names, resolution starts from the DNS root that ICANN coordinates, and every connected device uses that system by default. An onchain TLD is not in the DNS root, so an ordinary browser, left as it is, will not open a name under it.

Freename names resolve where software has been built to read the registry. Support is documented in three environments:

• Bitcoin.com Wallet supports Freename names.
• MetaMask resolves them by way of Freename’s resolver.
• Desktop browsers open them once the Freename Web3 extension is installed.

Outside these environments, a name resolves only if the application concerned has added support. Coverage is partial and it changes: an integration can be added, and one can be withdrawn. A name that works in the wallet you tested may not work in the wallet your counterparty uses.

This shapes every practical decision. Before a name is printed on an invoice or handed to a customer, someone has to test it in the software the other party will actually use. The page on names that resolve in wallets keeps track of the wallet side of this question.

The honest comparison is simple. The DNS has near-universal coverage because it is the default everywhere. An onchain TLD has coverage only where an integration exists. For a public website that any visitor must reach without preparation, the DNS is simply the better tool. Onchain names are strongest where both parties already use compatible software, which is why wallet naming and payments are the most developed uses.

What organizations do with a TLD

The table below sets the main uses of an onchain TLD against their maturity. Maturity here means how dependable the supporting software is and how familiar the use is to the counterparties you are likely to deal with.

Two patterns account for most of what organizations do.

The first is control of a brand’s namespace. An organization that holds .yourbrand on a registry is the only party able to issue names under that label there. Often this begins as a defensive holding, with no names issued at all. Its limit is stated in the table: holding the label on one registry says nothing about other registries, and nothing about the DNS. A defensive holding is one layer of a brand protection program, not a substitute for trademark registrations and domain portfolios.

The second is an active namespace. A platform, a professional body or a company issues names under its TLD to members, customers or business units. Each receives a name that identifies it within that group and, where the software supports it, lets others pay it by name. The operator controls the issuance rules and can attach commercial terms to registration.

Between the two sits a gradual path that many organizations take: hold first, issue a handful of names for internal treasury or payment use, and widen issuance only once the resolution question has been tested with real counterparties. That order keeps the commitment proportionate to what has been verified.

Each use moves at its own pace. The page listing every capability that works, with its sources is the place to check before you rely on one of them.

Trademark TLDs and market TLDs

Onchain TLDs fall into two families that call for different assessments.

A trademark TLD is one whose string matches a brand, a trade name or another identifier in which an organization has rights. The string already means something: it points to that organization. For the organization, holding it extends its presence into a new naming system. Not holding it leaves a question open that the brand team should at least have examined.

A market TLD is one whose string is a generic or descriptive word, with value independent of any particular mark. Think of .yoursector, with names such as name.yoursector issued to firms or professionals in that field. The holder typically runs an open or semi-open namespace and treats royalties on registrations as the revenue model. A market TLD is closer to a business to be operated than to a brand protection instrument.

The distinction matters in three ways.

• Valuation. The value of a trademark TLD is tied to the organization it matches and to what that organization could do with it. The value of a market TLD depends on demand for names under it, on the royalty terms and on the alternatives available to registrants.
• Legal posture. A trademark owner looking at the TLD that matches its mark asks a different question from an investor looking at a generic word. The first is about rights and confusion. The second is about a revenue model and its risks.
• Motive for acquiring. An organization that wants the TLD matching its own name is the natural buyer for that one asset. A market TLD can interest any operator able to build a namespace on it.

The two legal systems stay separate throughout. An onchain TLD whose string matches a trademark gives its holder no trademark rights. A trademark registration, in turn, does not reserve the matching string in an onchain registry: the registry is a separate system, and the string may be held by someone else. A trademark owner who wants the matching TLD obtains it by registering it where it is available, or by a transfer from whoever holds it.

The page that explains what a trademark TLD is goes further into the first family, and it holds the free Trademark Name Check form.

Risks and limits, stated honestly

An accurate picture includes what onchain TLDs cannot do and where things can go wrong. Resolution, the first limit, was covered above. Four others deserve the same attention.

No dispute procedure comparable to the UDRP

The UDRP gives a trademark owner a recognized administrative path to challenge a domain name registered and used in bad faith. It works because registrants accept it in their contract with an ICANN-accredited registrar. Onchain names are issued outside that contractual chain, so the UDRP does not reach them. A trademark owner concerned about a matching onchain TLD is left with negotiation, acquisition, or whatever remedies the general law offers in the countries concerned. Those remedies vary widely and are less predictable than an established procedure.

Custody

If the private keys that control the wallet are lost, the TLD may be impossible to recover. If they are compromised, the TLD can be moved without the holder’s consent, and a blockchain transfer is not reversed by calling a support line. These risks apply to every onchain asset. They weigh more when the asset is a brand identifier, which is why multisignature custody and a written procedure are the baseline for an organization.

Dependence on the registry

The token persists on the blockchain, but its usefulness depends on the registry’s resolver, on its terms and on the integrations that wallets and browsers maintain. If any of these changes, names under the TLD may behave differently, or stop resolving in an environment that used to support them. A holder is therefore exposed to decisions it does not control. This is not a criticism of any registry. It is a dependency to record in a risk register, as you would for any supplier of critical infrastructure.

Unsettled law

The legal characterization of an onchain TLD is still developing in most countries: whether and how it counts as property, how it is treated in accounts and for tax, and how a conflict between a holder and a trademark owner would be decided. Answers differ from one country to another and some questions have no settled answer yet. Nothing in this guide is legal or tax advice, and an organization should take its own counsel’s view before making a material commitment.

How TLDs change hands

An onchain TLD changes hands when the token that represents it moves from one wallet to another. The move is a blockchain transaction, recorded onchain and visible to anyone. From the moment it is confirmed, the public record shows the new holder.

Between two organizations, a sale calls for more structure than a bare token transfer. The parties have to agree on a price, confirm that each side has the authority to commit, examine the TLD and the names issued under it, and exchange payment and asset in a way that protects both.

Onchain escrow answers the last point. In general terms, an escrow is a smart contract, a program deployed on a blockchain that runs as written, which holds the asset and releases it against the agreed payment. Neither party has to perform first and hope the other follows.

1. ConfidentialityThe parties put a non-disclosure agreement in place before they exchange anything sensitive, including the fact that they are talking.
2. VerificationThe buyer checks the registry record on a block explorer, the names already issued under the TLD and the seller's authority to transfer. The seller checks the buyer's authority to commit.
3. TermsPrice and conditions, such as statements about the names issued under the TLD, are agreed in writing.
4. EscrowThe transfer is set up in onchain escrow, so that the token and the payment are exchanged against each other.
5. ReleaseThe payment is made, the token moves to the buyer's wallet, and the public record shows the new holder.
6. ActivationThe buyer sets up custody, configures records and decides the issuance policy for names under the TLD.

What happens to names already issued

Names issued before a sale are the point most often overlooked. Third parties may hold names under the TLD and rely on them for payments or for a website. Before signing, a buyer should establish how many names exist, who received them and on what terms, and which of them the seller itself holds. The names a third party has bought remain that party’s when the TLD moves to a new holder, while the names the seller holds under the TLD can be transferred along with it if the two sides agree to that. The written terms should say what the buyer undertakes toward those name holders. A TLD with no names issued is simpler to transfer. One with an active namespace is worth more attention, and often more money, for the same reason.

Where an intermediary fits

Many sales are arranged through an intermediary, because the two sides rarely know each other and often prefer not to be identified early. Hush Partners is a private desk that does this work. A holder can mandate it to find a buyer, and an organization can mandate it to find and approach the holder of a TLD it wants. The desk never says who the seller of a given TLD is, and a standard mutual NDA applies to every exchange. When a file reaches closing, it goes through onchain escrow on an aftermarket, which is Freename’s unless the client would rather use another marketplace such as OpenSea. The page on escrow and transfer at closing describes that last stage.

Short vocabulary

Aftermarket. A marketplace where assets that already exist are resold, as opposed to the registry where they are first registered.

Block explorer. A public website that reads a blockchain and displays its transactions and records. It is where anyone can check the registry record of a TLD.

DNS root. The top of the DNS hierarchy, coordinated by ICANN. A TLD delegated there resolves by default on every connected device.

ERC-721. An Ethereum token standard for unique tokens, each distinct from every other. The draft ERC-8004 standard uses it to represent an agent.

ICANN. The Internet Corporation for Assigned Names and Numbers. The nonprofit that coordinates the DNS root and sets the policies that bind the registries and registrars it accredits.

IPFS. The InterPlanetary File System. A peer-to-peer storage network in which content is identified by a fingerprint of the content itself, not by a server address.

Multisignature wallet. A wallet that requires approval from several keys before a transaction goes through. Organizations use it so that no single person controls an asset.

Resolver. The component that translates a name into the record it points to: a wallet address, a content fingerprint or another value. For onchain names, it reads the registry’s records.

Smart contract. A program deployed on a blockchain that executes as written when its conditions are met. Onchain escrow is one application.

Subname. A name issued under a TLD. If the TLD is .yourbrand, then pay.yourbrand is a subname.

TLD. Top-level domain. The label at the rightmost position in a name, after the final dot. Onchain, it is the string held as a token.

Token. An entry on a blockchain that records which wallet controls an asset. An onchain TLD is held as one.

UDRP. Uniform Domain-Name Dispute-Resolution Policy. The dispute procedure that registrants of generic DNS domain names accept through their registrar. It does not extend to onchain TLDs.

Wallet. Software or hardware that stores the private keys used to authorize blockchain transactions. Whoever controls the keys controls the assets, a TLD included.

The site’s glossary defines the further terms you will meet in other Journal articles.

Where to go next, by role

The right next step depends on what you are trying to do.

General counsel or brand protection team. Start with an inventory, not with a purchase. List the marks that matter most, decide whether an onchain presence is something the organization wants to hold, use or simply monitor, and write the conclusion down so that the question does not come back unowned. The Trademark Name Check and the Namespace Exposure Score are free tools on the site that help frame that inventory. The page written for brands and legal teams sets out the options from there, including the case where the TLD matching your name is one you decide to acquire.

TLD holder. Settle three things before anything else: custody, the issuance policy, and whether you intend to operate the TLD, sell it, or operate it for a time and then sell. The TLD Readiness Score and the Subname Revenue Calculator, both free on the site, help test the second and third. The page for holders explains the paths open to you, including a private valuation request and a mandate to find a buyer.

Operator of a namespace. Your work is policy and adoption: who may register, at what price, in which wallets the names resolve for your users, and how you will support them. Test resolution with real users before you announce anything. The site has a page for operators and a Launch Roadmap tool for a newly acquired TLD.

Lawyer or adviser. If a client is considering holding, buying or selling a TLD, the points to bring to the first meeting are the ones in this guide: what the token is and is not, the separation from trademark rights, custody, the names already issued, and escrow at closing. The site has a page for advisers who refer a file.

Fund or family office. Treat a TLD as an illiquid asset whose return depends on operations. The questions are custody, the reliability of the royalty terms, the realistic pool of buyers at exit, and the legal characterization in your jurisdiction. The site has a page for funds and family offices.

If your next step involves another party, a word on how Hush Partners works. From the first note until the file closes, it stays with one partner, whose name the client knows. The fee is a fixed amount, never a percentage, and only the client who mandates the desk pays it. A party that answers a note, or that buys a TLD the desk offers, pays the price of the TLD and no fee. The desk is reached through the contact form on the site, and through no other channel.