.auth
Is .auth a real TLD? Who’s applying to run it?
.auth is contested: 3 applications for it are on ICANN’s Reveal Day list, as of 7 October 2026. They are NextGEN TLDs, Codyssey and Link Freedom Group. XServer named .auth as a backup string for its .start application. ICANN deactivated it, because another applicant applied for the same string or named it as a backup. Verisign named .auth as a backup string for its .pki application. ICANN deactivated it, because another applicant applied for the same string or named it as a backup. Suffix named .auth as a backup string for its .btw application. ICANN deactivated it, because another applicant applied for the same string or named it as a backup.
Who is applying, and what they run today
None of the three runs a TLD today.
Will names sell?
A natural fit for login and identity tech brands, but narrow demand and phishing worries keep it a niche developer address.
Last round the AI scored the 2012 strings blind to their fate. Strings it scored 60 or more hold a median 27,168 names today; those under 30, a median of 30. .auth’s closest 2012 strings hold .secure 2, .security 931 and .dev 713K.
The nearest 2012 strings, and how many names each holds today
The closest 2012 string, .secure, held 2 names, June 2026. .security held 931; .dev held 712,600. Chosen by AI from every string in the 2012 round, without being told what happened to any of them.
Same bet as .auth: a short, un-ownable trust-function word that no single vendor can claim but every security/identity provider wants, whose value depends entirely on the registry policing who is allowed to stand behind it.
The category-noun form of the same wager — a functional trust word sold to the same buyer set (security and identity vendors putting primary product identity on it), differing from .auth only in being the industry label rather than the technical function.
Closest structural match for the clipped-developer-jargon shape: an abbreviation developers already type daily, bet on developer-infrastructure companies and their tooling namespaces rather than on a consumer audience, which is where .auth's actual registrants (identity/SDK vendors) live.
Where they meet elsewhere
XServer and Link Freedom Group face each other in 8 contests this round, .auth included.
- Link Freedom Group × XServer
- Link Freedom Group × Suffix
- Link Freedom Group × NextGEN TLDs
- XServer × Suffix
- Suffix × NextGEN TLDs
identity and access-management vendors, developer-tool startups building login/SSO/passkey products, and security teams wanting a semantic home for authentication endpoints
What a .auth domain is
.auth is not a TLD yet. It is a string on our record of the ICANN 2026 new gTLD round, in our AI & tech category. 3 applications for it are on ICANN’s Reveal Day list.
Is the .auth domain extension real yet?
.auth is not yet a domain extension you can register: nothing resolves under it, and no registrar sells names in it. It is a string applicants have put forward in the ICANN 2026 new gTLD round, the process that decides whether it becomes one.
When can you buy a .auth domain?
You can’t yet. A .auth name can only be registered once the string is delegated (added to the DNS root) and its registry opens. Last round's closest parallel to .auth was .secure, delegated on 10 August 2016.
Is .auth a real TLD?
Not yet. .auth is not in the DNS root, so nothing resolves under it. It’s here because .auth is on ICANN’s Reveal Day list of applied-for strings. Every entry on this page links to its source.
- 3 applicants · first recordedICANN
- 2 applicants · first recordedICANN
- Link Freedom Group · now confirmedICANN
- Link Freedom Group · first recordedLink Freedom Group
“CS2676T-T34770 · Codyssey SL · primary · contention set 2026-18 LFGL2683T-T31637 · Link Freedom Group Ltd · primary · contention set 2026-18 NTG2671T-T26730 · NextGEN TLDs GmbH · primary · contention set 2026-18”ICANN
The source’s 6 linesHide the lines
CS2676T-T34770 · Codyssey SL · primary · contention set 2026-18 LFGL2683T-T31637 · Link Freedom Group Ltd · primary · contention set 2026-18 NTG2671T-T26730 · NextGEN TLDs GmbH · primary · contention set 2026-18 SI2639T-T50366 · Suffix Inc. · replacement string of .btw · Deactivated VRSN2658T-T77256 · VeriSign Sàrl · replacement string of .pki · Deactivated XI2694T-T96618 · XRegistry Incorporated · replacement string of .start · Deactivated
“.auth · AI & Tech · “Protected by design.””Link Freedom Group
- Band: usable but limited (30-49), at its top. The string is a genuine high-value developer keyword: 'auth' is the standard shorthand for authentication across the software industry, and identity/login tooling is a large, durable product category, so a dev-tool brand plausibly using a .auth domain as its primary identity is credible over the next 5 years. It is not in the 50-69 strong-niche band because the realistic buyer pool is narrow (auth vendors and their subdomain-style endpoints rather than a broad category of businesses), and a TLD semantically tied to credentials invites phishing abuse, which tends to make enterprise security teams cautious and can depress mainstream brand adoption; sustained demand is therefore unproven rather than demonstrated. It is not in the 10-29 vanity band because, by analogy with developer-keyword TLDs that found real primary-identity use among technical audiences, the term has authentic end-use utility, not just novelty. Applicant facts: the string is announced by Link Freedom Group, which filed more than 300 strings in the ICANN 2026 round and published its catalog listing this string under 'AI & Tech' with the tagline 'Protected by design.'; a portfolio applicant of that breadth is a neutral adoption signal in itself. Main market uncertainty (launch assumed): whether security-conscious organizations treat .auth as a trust-enhancing home for identity products or preemptively block and avoid it as a credential-phishing surface, since that single dynamic swings both end-use adoption and aftermarket value.