# What a dotBrand is, and what it obliges its owner to do > A dotBrand is a top-level domain in the DNS run by a company for its own use. What that means in practice, and what it costs in obligations. Source: https://hush.partners/what-a-dotbrand-is Category: Market & ICANN Published by Hush Partners. --- The term "dotBrand" circulates in brand strategy and legal teams faster than a precise understanding of it. A team will ask whether the company needs one. A director will ask what one costs. Outside counsel will ask whether the trademark covers it. All three questions are reasonable, but each assumes a clear starting point that is often missing. This article supplies that starting point. It defines what a dotBrand is, explains the structure it creates, and walks through what owning one requires, from the application fee to the continuing technical obligations that come with operating a registry. It also sets out what a dotBrand does not give you, and why the same string may exist on a separate, parallel system that sits outside ICANN's authority. After reading, you will be able to hold a precise conversation with a trademark attorney, a registry provider or a board-level sponsor about whether a dotBrand makes sense for your organization, what the commitment involves, and what sits beside it.
1,616applications still moving forward in ICANN's 2026 round, all types of TLD together
USD 227,000evaluation fee expected for each application, advisers and registry operations not included
August 12, 2026day the application window of the round closed

Application count as reported by the trade press; evaluation fee from ICANN's new gTLD program pages; closing day of the window from ICANN.

## What a dotBrand is, precisely A dotBrand is a generic top-level domain in the DNS whose string is a brand name, operated by the owner of that brand for its own use. To unpack that sentence usefully, it helps to separate three layers. The first layer is what it is in the DNS. A top-level domain, or TLD, is the last label of a domain name, the part after the final dot. Most people know the endings used for commercial sites and the two-letter endings used for countries. A dotBrand is an entry at that same level, but the string is neither a common word nor a country code. It is a brand name: a string that matches a trademark owned by the applicant. The names issued under it, such as `pay.yourbrand`, `careers.yourbrand` or `app.yourbrand`, sit one level below it, exactly as an ordinary domain name sits one level below the open TLD it was registered in. The second layer is what separates it from other generic TLDs. Most generic TLDs are open: any member of the public can register a name under them through a registrar, the retailer accredited to sell names. A dotBrand is closed. Names are not offered to the public. They are reserved for the brand owner, the companies of its group and, in outline, the licensees of its trademark. This exclusivity is not a commercial choice the operator makes after launch. It is a condition of the TLD's classification, written into the contract with ICANN. The third layer is the legal basis. The model rests on a registered trademark that corresponds to the string, held and used by the applicant or its group in a business other than selling domain names. A dotBrand is not a defensive registration that can be obtained on a weak or unregistered mark. The trademark has to exist, be valid and be verifiable before the application can be treated as a brand application. Put the three layers together and the difference with a generic TLD is clear. A generic TLD is a business of selling names to others. A dotBrand is a private namespace, a set of names under one ending, in which the only customer is the owner. ## Who can have one Eligibility follows from the trademark requirement. In outline, an organization that wants a dotBrand needs three things: a registered trademark that matches the string it applies for, the legal form of an organization and not of a private individual, and the financial and technical capacity to operate a registry over the long term. The precise criteria are set by ICANN for each round and are assessed during evaluation, so your own counsel reads the current rules before any decision. ### A question of timing as much as eligibility A dotBrand cannot be requested at any moment. ICANN accepts applications for new generic TLDs only in rounds. The round opened in 2026 was the first in more than a decade, and its window for filing closed on August 12, 2026. The trade press reports 1,616 applications going forward, a figure that covers every type of TLD and not brands alone. The consequence for a brand director is simple. An organization that filed in the round is in the evaluation process. An organization that did not must wait for a later round, and nothing in this article lets you date one. That is why the question "should we have one" is often asked at the wrong time: either long before a window, when nobody is ready to decide, or just after one, when the answer no longer changes anything. ### Which entity applies Large groups hold their trademarks in one entity, run their technology from another and sign contracts through a third. A dotBrand ties these together, because the entity that operates the registry must be able to rely on the trademark and must carry the contract with ICANN. Deciding which entity applies is therefore an early structural decision that involves legal, tax and IT. It is also a decision that is awkward to revisit later, which is one more reason to leave it to counsel who know the group. ## The owner runs a registry, not a domain This distinction is the one most often glossed over, and it is the source of most budget surprises. When a company registers an ordinary domain name under an open TLD, it pays a recurring registration fee to a registrar. Everything else is handled by others: the registry behind the TLD runs the DNS infrastructure, keeps the registration data and deals with abuse reports at the level of the TLD. The company's obligation is, in substance, to renew. A dotBrand reverses the roles. The registry operator is the organization that runs a TLD under contract with ICANN, and for a dotBrand that organization is the brand itself. A registry is the authoritative database of every name that exists under a TLD, together with the service that publishes those names to the rest of the DNS so that they resolve, meaning that software can find where each name points. Running one is running a piece of internet infrastructure, with contractual, technical, financial and compliance obligations attached. In general terms those obligations include keeping the TLD's name servers available at all times, signing the zone with DNSSEC (the mechanism that lets resolvers verify that DNS answers are authentic), publishing registration data in the form ICANN requires, depositing a copy of registry data with a third party so the TLD could be recovered if the operator failed, handling abuse reports, and reporting to ICANN. None of these is a one-time requirement. They last as long as the TLD does. ### What a back-end provider takes on, and what stays with you Few brand owners build this infrastructure themselves. Most contract a back-end registry provider, a specialized company that supplies the technical platform and runs it day to day. Choosing that provider belongs to the preparation of the application, not to the period after it. Outsourcing the platform does not outsource the accountability. The contract with ICANN is signed by the brand owner, so a failure of the provider is, toward ICANN, a failure of the operator. What stays in-house is everything that cannot be delegated: the policy on who may receive a name and for what purpose, the decision to create or withdraw each name, the supervision of the provider, the budget, and the relationship with ICANN. Someone in your organization has to own these, by name, for as long as the TLD exists. Where nobody does, the TLD tends to sit unused while its obligations keep running. ## The contract with ICANN, in outline Once an application succeeds, the organization signs a registry agreement with ICANN. It is a long-term contract that governs how the TLD is operated: the technical standards to meet, the data to publish and deposit, the reports to file, the recurring fees owed to ICANN and the circumstances in which the agreement can end. A brand TLD signs the same kind of agreement as any other generic TLD, with provisions added for its closed, trademark-based character. Those provisions work in two directions. On one side, they restrict. Names under the TLD are reserved for the operator, its affiliates and its trademark licensees, and the operator keeps control of how those names are used in the DNS. The TLD cannot be turned into an open business of selling names without leaving the brand model. On the other side, they relieve. Several rules of the standard agreement were written for registries that sell names to the public through competing registrars. Some of them make little sense when the only registrant is the owner. A priority period that lets trademark owners register their marks before the public is the clearest example: in a TLD where the public can never register, it protects no one. The brand provisions set aside rules of that kind. These accommodations matter for budget and compliance planning, but they leave the core operational obligations in place. Brand status is conditional. It depends on the trademark remaining valid and on the TLD continuing to be used as a closed, single-owner namespace. If those conditions stop being met, ICANN can withdraw the status. The organization would then still be bound by the agreement, but without the accommodations that made the model practical. One point deserves attention before signature. An ordinary domain name that is no longer wanted is simply not renewed. A TLD cannot be dropped that way. Ending a registry agreement is a process with its own steps, and the operator stays responsible for the TLD until that process is complete. The terms differ by version of the agreement and are a matter for your own counsel, but the general lesson holds: entering is a project, and leaving is one too. ## What it costs beyond the application fee The figure most often quoted for a dotBrand is the evaluation fee, expected at USD 227,000 per application according to ICANN's new gTLD program pages. That figure is only the first layer. It pays for ICANN's evaluation and for nothing else: neither the advisers who prepare the file nor the operation of the registry afterward. The layers that follow are harder to quote, and this article does not put numbers on them. They are worth listing because they are recurring, where the evaluation fee is paid once. - **Preparation.** Legal and technical advisers who assemble the application, answer questions during evaluation and negotiate the agreement. - **Back-end operation.** The registry provider's charges, which run for as long as the TLD exists. - **ICANN fees.** Registry operators pay recurring fees to ICANN under their agreement. - **Internal time.** The people who set the naming policy, supervise the provider, approve names and answer ICANN. - **Use.** Moving websites, mail or applications to names under the TLD is a migration project with its own budget, distinct from running the registry. The last item is the one most often left out of the business case. Holding the TLD costs money whether or not a single name under it carries traffic. The value only appears when the organization uses the namespace, and that use is a second investment decided by different people, usually marketing and IT, on a different calendar. A sound budget therefore answers two questions separately: what it costs to hold the TLD in compliance each year, and what it costs to do something with it. A dotBrand approved on the first number alone is the usual origin of a TLD that exists and is not used. ## What a dotBrand is used for The strategic case for a dotBrand rests on control of a namespace. When an organization controls the TLD itself, every name under it is created by the organization, on its own terms, for parties it has chosen. No outsider can register `secure.yourbrand` or `pay.yourbrand`, because the operator is the only source of names. That control translates into several practical uses. The first is internal infrastructure organized under the brand string: applications, tools, development environments and service endpoints that all sit under `.yourbrand`. The namespace is clean, the names are short, and ownership is visible in the name itself. The second is communication with customers. A brand can publish `news.yourbrand` or `help.yourbrand`, and because nobody else can obtain a name there, a customer can treat any address in the TLD as coming from the brand. Defensive registrations in open TLDs cannot reproduce this property, because an open TLD stays open to new, similar names. The benefit is real only if customers learn the rule, which takes consistent use over time. The third is distribution inside a group. A parent company can give names under the TLD to subsidiaries, affiliates or qualified licensees while keeping control over issuance. A distributor can be given a name for the length of a contract and lose it when the contract ends, without any dispute over who owns the name. What organizations often find after launch is that the fixed overhead of the registry shapes how much the TLD is used. The infrastructure must be maintained and the obligations met whether a handful of names exist under the TLD or many thousands. For a different operating model to set against this one, see [what onchain TLDs can do in practice](/whats-live), with sources. ## What a dotBrand does not give A dotBrand is a DNS instrument. Its limits matter as much as its capabilities. It does not give trademark rights. Operating `.yourbrand` in the DNS does not create, extend or strengthen trademark protection. The trademark must exist first and stay valid. The dotBrand depends on it, not the other way around. The relation between a trademark and a TLD of the same string is covered on the page about [trademark TLDs](/trademark-tlds). It does not give control over the same string in other systems. The ICANN DNS and onchain naming systems are separate infrastructures. A company that holds `.yourbrand` in the ICANN root has no claim, by that fact alone, to `.yourbrand` in an onchain registry. The same string can exist in both, with different holders and different technical resolution. It does not protect neighboring strings. A dotBrand covers the exact string applied for. It does not prevent third parties from registering names that contain or resemble the brand in open TLDs. Ordinary brand protection in the DNS, including monitoring, selective registrations and dispute procedures such as the UDRP, continues beside it. It does not give priority in later rounds. Operating one dotBrand confers no automatic right to further strings, and it does not shield the organization from competition if another party applies for a similar string in a later round. And it does not give simplicity. A registry agreement is a long and technically demanding document, and the obligations under it are continuous. An organization that underestimates this can end up with a live TLD that it struggles to operate consistently. | What a dotBrand gives | What it obliges the owner to do | |---|---| | Sole control of the names created under the TLD | Operate a compliant registry, continuously | | A closed namespace for the group and its licensees | Keep the TLD's DNS service available and signed with DNSSEC | | Relief from some rules written for open registries | Deposit registry data with a third party and report to ICANN | | A DNS identity grounded in the trademark | Keep the trademark valid and the use of the TLD closed | | Names that resolve in ordinary browsers | Pay recurring fees to ICANN and to the back-end provider | ## The onchain TLD with the same string The string that matches your brand may also exist as a TLD in an onchain naming system. This is a separate matter from the ICANN dotBrand, and the two should not be confused. On an onchain registry such as Freename, a TLD is a token recorded on a blockchain and held in a wallet. Whoever holds the token controls the TLD in that system, and no one else can issue names under it. The record is public, and anyone can check it on a block explorer. No application goes to ICANN, no registry agreement is signed and no evaluation fee is paid. On Freename the TLD also carries no annual renewal fee. The limits are just as plain. An onchain TLD sits outside the ICANN DNS root, so an ordinary browser does not open its names without added support. Names resolve in some wallets and through some browser extensions. That coverage is partial and it changes. For a public website that must open everywhere, the DNS is simply the better instrument, and a dotBrand resolves in every browser the day it is delegated. The practical consequence for a brand is this. A company can hold `.yourbrand` in the DNS, or be in the process of obtaining it, while `.yourbrand` in an onchain registry is held by someone else or by no one. The two TLDs are technically distinct and resolve differently, but the public associates both with the same brand. ICANN's process has no effect on the onchain one, and an onchain token gives no standing in an ICANN round. The [side-by-side comparison of a dotBrand and an onchain TLD](/dotbrand-vs-onchain-tld) treats both instruments on the same criteria. An organization in this position has a choice to make, not an emergency to handle. It can decide that the onchain string does not matter to its business and simply watch it. It can decide that the string belongs in the same hands as the dotBrand and the trademark, in which case acquiring it is a transaction of its own, the subject of [brand namespace recovery](/brand-namespace-recovery). The dotBrand and the onchain TLD do not exclude each other: one covers the DNS, the other covers a system the DNS does not reach. ## Deciding whether you ever needed one The useful question for most organizations is not "how do we get one" but "is this the right instrument for what we need". A dotBrand makes clear sense for a narrow set of cases: large organizations that run complex digital infrastructure and want a dedicated, stable namespace for it; organizations that publish to customers and for which the brand in the ending of every address has real value; and organizations in regulated sectors where control over every issued name has a compliance justification. For others, the combination of cost, complexity and permanence does not match the use that follows. A long program that ends in a TLD with very few names under it is not a failure of execution. It is a sign that the instrument was out of proportion to the need. Before treating a dotBrand as a strategic priority, your team should establish whether exclusive control of a namespace is the specific property you need, or whether disciplined defensive registration in open TLDs would serve the same purpose with far less commitment. Three questions settle most cases: - **What would you put under it?** If the honest list is short, the registry will cost more attention than the names return. - **Who will own it internally?** A dotBrand without a named owner in the organization is run by its provider and used by no one. - **What happens if you stop?** If the answer is "we would wind it down", weigh the cost of entering and leaving against the years of use in between. For an organization that filed in the 2026 round, these questions now shape how the TLD will be used. For one that did not, they are the preparation for a later round, with time to answer them properly. In both cases the question of the onchain string is independent of ICANN's calendar and can be examined on its own. For [general counsel and brand protection teams](/brands-and-legal-teams), the concrete next step is a map: what exists under your brand string in the DNS and onchain, set against what your protection strategy requires. The [Namespace Exposure Score](/namespace-exposure-score) is a free tool that starts that map on the onchain side. Where the map shows an onchain TLD that matches the brand and that you would rather hold, Hush Partners can be mandated to find the holder and make the approach, with every exchange under a standard mutual NDA. The page on [how a file proceeds](/how-it-works) sets out the stages from mandate to transfer. ## Questions people ask ### Can a single organization hold more than one dotBrand? In principle, yes. An organization with several brands can apply for several strings, as long as each rests on its own trademark. Each application carries its own evaluation fee and leads to its own registry agreement, with its own obligations. The cost of holding therefore multiplies with the number of strings, which is a reason to apply only for the brands that will be used. ### What happens to a dotBrand if the underlying trademark lapses? If the trademark stops being valid, whether through abandonment, expiry or a successful cancellation action, the TLD may no longer meet the definition of a brand TLD. ICANN can then withdraw the status, and the registry would face the rules written for open TLDs. Keeping the trademark in good standing is therefore an operational requirement of the registry, not only a matter of portfolio housekeeping. Trademark rules vary by country, so your own counsel decides what "in good standing" requires. ### Is a back-end registry provider the same as a registrar? No. The back-end provider runs the technical platform of the TLD itself: its name servers, DNSSEC signing, registration data service and data deposits. A registrar is accredited by ICANN to register names on behalf of registrants. In a dotBrand the registrar's role still exists in the ICANN model, but it serves a single customer, the brand owner, and not the public. The [glossary](/glossary) defines the terms used here. ### How long before a dotBrand from the 2026 round is in operation? This article gives no duration, because none can be stated reliably. After the window closes, an application goes through evaluation, then contracting, then technical testing, and only then is the TLD delegated, meaning added to the DNS root so that its names can resolve. Each stage has its own conditions. An organization that applied should plan its use of the TLD around these stages and not around a date. ### Does a dotBrand replace the company's existing domain names? Not by itself. The existing names keep working for as long as they are renewed, and customers, search engines and mail systems know them. Moving to names under the dotBrand is a migration that the organization chooses to make, wholly, partly or not at all. Many uses of a dotBrand sit beside the existing names instead of replacing them.