.io: 13.2 Million Domains, Zero Residents, and the Tech Industry's Most Precarious TLD

The British Indian Ocean Territory is a US-UK military installation on Diego Garcia, a flat coral atoll in the central Indian Ocean. It has no permanent civilian population, no tourism, no independently filed GDP. Its total land area — 60 square kilometers of reef scattered across 54,400 square kilometers of ocean — makes it less a country and more a restricted-access coordinate. In every conventional measure of national standing, BIOT does not register.

It has 13.2 million domain records.

The .io country-code TLD was delegated to BIOT when ISO 3166 assigned two-letter codes based on geography, not demographics. For a decade it was bureaucratic inventory — the first recorded .io registration was Levi Strauss & Co. securing levi.io in 1998. Then, sometime in the mid-2000s, software developers noticed that "I/O" — input/output — is the most fundamental abstraction in computer science. You read from disk with I/O. You push to an API with I/O. The entire discipline of programming is, at the lowest level, a sequence of I/O operations. A TLD that happened to spell the most universal shorthand in tech was not just available — it was on-brand in a way no marketing budget could manufacture.

The timing coincided with the first wave of Silicon Valley SaaS startups that could not get .com and would not settle for .net. By 2012, choosing .io was a signal: you were technical, you were building developer tools, and you understood the joke. GitHub Pages made github.io ubiquitous in developer portfolios. Heroku deployments used .io subdomains. By 2015, the .io games genre — Agar.io drew 192 million visits in 2017 — gave the extension mainstream visibility. Among 1,587 funded Y Combinator startups analyzed in one survey, .io was the #1 alternative TLD with 80 companies (5.2% share) — more than .co and .ai combined. We analyzed 13,234,503 total records across 1,592,882 unique base domains in the DomainsProject .io dataset and cross-referenced our findings with Internet Computer Bureau Ltd (ICB) financial filings, ICANN ccTLD retirement policy, the UK government's Chagos Islands treaty announcement, Cloudflare Registrar at-cost pricing, and the Interisle Consulting Group phishing landscape data. Our earlier post, Tiny Islands, Massive TLDs, covered .io in the cross-TLD scorecard; this post goes into the internals.

The headline: .io is not a uniform namespace — it is two systems coexisting under one TLD. A platform layer of 6,144 domains hosts 50% of all 13.2 million records, while a long tail of 335,802 domains exists as a single DNS entry each. The tech industry has built genuine infrastructure on .io — github.io alone accounts for more than 1 million records — but that infrastructure sits on a geopolitical fault line. The UK's 2024 agreement to transfer sovereignty of the Chagos Islands to Mauritius triggers an unresolved chain: when a territory ceases to exist, its ISO 3166 code can be retired, and when a code is retired, ICANN policy gives the ccTLD a maximum of 10 years before deletion from the DNS root zone. The treaty has not been ratified. The clock has not started. But for a $42-million-per-year registry built on a colonial artifact, the question is no longer "if" but "under what terms."

The Data

DomainsProject continuously crawls and indexes domains across every delegated TLD in the IANA root zone. Here is what we observe for .io and comparable tech-oriented TLDs:

Dataset figures reflect observed DNS records — including all subdomains at every depth — not registry-reported registration counts. The distinction matters for .io more than for any other tech TLD: .io shows 13.2 million total records but only 1.59 million unique base domains, an 8.3x multiplier explained by the platform concentration analysis below. Registry-reported .io registrations stand at approximately 1.6 million as of early 2026, consistent with our unique base domain count.

ICB Ltd filed £31.6 million ($42.4 million) in 2024 revenue with UK Companies House — up 93% since 2021 — though ICB operates as a pass-through entity with approximately 4% gross margins, funneling most revenue to its US parent, Identity Digital (an Ethos Capital portfolio company). Paul Kane sold ICB to Afilias (now Identity Digital) in April 2017 for $70.17 million in cash. At $45 wholesale per domain and 1.6 million registrations, .io generates roughly $72 million per year in wholesale registration fees alone — before retail markup — making it one of the highest-revenue ccTLDs per domain in the world.

Methodology

Definitions

• Record: Any hostname observed via active DNS crawling in the DomainsProject dataset, at any subdomain depth. A single base domain may produce hundreds or thousands of records if it serves subdomains.
• Base domain (unique domain): The registrant-held apex — the direct child of .io in the zone hierarchy (e.g., company.io). This is the unit that corresponds to a registry registration.
• Platform domain: A base domain with 100 or more observed records. At this threshold, a domain is operating subdomain-based infrastructure — SaaS tenant routing, user-generated pages, device provisioning, or API versioning — rather than a simple website. The 100-record threshold is a structural proxy, not a content classification.
• Single-record domain: A base domain with exactly one observed record (typically the apex itself with no subdomains).
• "ai-containing" domain: Any base domain whose label includes the substring "ai." This is a conservative overcount — domains like "email," "train," and "availability" all qualify. Treat as an upper bound on AI-branded .io domains.
• "Crypto/web3-related" domain: Domains matching a keyword list including "crypto," "chain," "block," "web3," "defi," "nft," "token," "coin," "swap," "dao," "wallet," and similar terms. The same substring-matching caveat applies.

Dataset Scope

• All records reflect active DNS resolution observed during the DomainsProject Q1 2026 crawl cycle.
• .io zone file data is not publicly available through ICANN's Centralized Zone Data Service (CZDS), as .io is a ccTLD. Our dataset is constructed through active crawling, not zone file ingestion.
• No longitudinal registration history is available for .io from the registry. Growth claims reference third-party estimates from Hostinger domain statistics, Domain Incite reporting, and DomainMetaData zone analysis.

Known Limitations

• Snapshot data: This analysis represents a single crawl cycle. Without historical zone data, claims about trends (e.g., crypto domain growth timing) are contextual inferences, not confirmed time-series findings.
• Platform identification by subdomain count is a structural proxy: keenetic.io's 2.56 million records are router firmware subdomains, not user websites. The "platform" label describes DNS behavior, not business model.
• Keyword-based thematic counts have non-trivial false positive rates: "ai-containing" captures "email," "chair," "available"; crypto keywords capture "blockchain" in non-crypto contexts.
• Registration counts from external sources are estimates: Identity Digital does not publish official .io zone file statistics.

The full .io dataset is available for independent analysis at /dataset.

The Scorecard

Top-Level Metrics

The average of 8.3 records per domain is nearly meaningless as a summary statistic — it is the average of a power-law distribution where 0.4% of domains hold 50% of all records, and 21.1% of domains hold exactly one record each. The median .io domain has roughly 2 records (the apex and www). This is the structural signature of a namespace that has been colonized by platform operators — the typical .io domain is a small company website, but the .io record count is dominated by a handful of multi-tenant infrastructure providers.

Concentration by Tier

Seven mega-platforms — each with more than 100,000 records — account for 34.4% of the entire .io namespace. The bottom 91.5% of .io domains (the single-record and small tiers combined) account for 27.6% of records. This is not the distribution of a namespace where each domain is equally important — it is the distribution of an infrastructure layer with a consumer veneer.

Top 15 Domains by Record Count

keenetic.io alone — a domain used by Keenetic, a router manufacturer serving primarily Russian-speaking markets — accounts for 19.3% of all .io records. This is not a developer-tools company in the Silicon Valley sense; it is network appliance firmware generating DNS entries for each provisioned device. Its presence at the top of the .io record count reveals that the raw record-count framing of "the tech industry's TLD" requires qualification: the single largest consumer of the .io namespace is hardware provisioning, not software development.

github.io at 7.6% is the developer-infrastructure anchor. But those 1 million records are not GitHub's own infrastructure — they are individual developer project pages. The record count represents the scale of the developer community that has standardized on .io as a default project namespace. When a developer types username.github.io into a browser, they are participating in the .io ecosystem whether or not they chose the TLD.

The Platform Layer: 6,144 Domains, Half the Namespace

The platform layer is the defining structural feature of .io. Understanding what these 6,144 domains actually do determines whether .io's character as "the developer TLD" holds up under scrutiny or is a brand story the data only partially supports.

Platform Categories

The developer ecosystem is real — but it is not the majority. Developer Pages/Hosting, Documentation, DevOps/CI, and Status/Monitoring collectively account for roughly 1.27 million records across the platform layer. IoT/Hardware alone accounts for 2.57 million. Blockchain nodes add another 343,000. The .io platform layer is a mix of developer infrastructure, network provisioning, and blockchain operations — with developer tools as a significant but not dominant segment.

Known Tech Companies in the Dataset

Beyond the major platforms, the dataset contains records for dozens of well-known tech companies using .io domains for production infrastructure:

This table is a non-exhaustive sample. Many of these domains appear to be production infrastructure — API endpoints, documentation sites, SDK registries — not defensive registrations. The subdomain counts, while modest compared to the mega-platforms, represent real operational use: terraform.io hosts HashiCorp's infrastructure-as-code documentation, kubernetes.io serves the official Kubernetes project site, and sentry.io runs Sentry's error-monitoring SaaS.

The Developer Fingerprint: What 11.7 Million Subdomains Reveal

Of the 13.2 million total records, 11.67 million (88.2%) are subdomains — records at depth 3 or deeper. The distribution of subdomain prefixes reveals the operational character of the .io namespace.

Top Subdomain Prefixes

The developer-infrastructure fingerprint is unmistakable. Across 24 developer-associated prefixes — including api (134,396), app (89,904), dev (68,427), staging (40,574), test (35,606), docs (27,660), demo (26,250), admin (41,888), dashboard (14,348), beta (11,292), git (9,368), stage (8,366), prod (7,594), registry (6,913), sandbox (4,870), preview (3,470), alpha (2,745), docker (2,221), ci (2,091), k8s (1,494), npm (1,069), cd (476), pypi (298), and canary (241) — the .io namespace hosts 541,561 developer-infrastructure subdomains (4.6% of all subdomains). These are not marketing pages or content sites. They are the operational infrastructure of software companies: staging environments, API gateways, documentation servers, CI/CD pipelines, and Kubernetes clusters.

For comparison, traditional content/web prefixes — blog (39,149), shop (10,490), news (2,025), about (669) — are present but less prominent relative to the developer-infrastructure pattern. .io's subdomain landscape reads like a DevOps runbook, not a marketing portfolio.

Domain Name Characteristics

90.2% of .io domain names are pure alphabetic — no digits, no hyphens. The peak at 6-12 characters (70.4% of all domains) is consistent with human-chosen, brandable names — not autogenerated strings or SEO keyword-stuffing patterns. Compared to legacy TLDs where hyphenated and digit-heavy names proliferated through bulk registration and SEO practices, .io's namespace is remarkably clean. This is consistent with a TLD where $45-100 per year in registration costs serves as a natural quality filter: at that price point, you register a name you intend to use.

Tech Keywords in Domain Names

"ai" appears in 69,868 .io domain names — 4.4% of the namespace. This is a keyword-based upper bound (it captures "email," "train," and "availability"), but even with false positives, the AI footprint in .io is substantial. The crypto/web3 layer is similarly visible: a broader keyword set — "crypto" (10,490), "chain" (7,924), "block" (6,978), "web3" (1,634), plus "token," "coin," "swap," "dao," "nft," "defi," "wallet," and related terms as defined in the Methodology section — collectively marks approximately 80,835 domains (5.1%) as blockchain-adjacent. These two speculative waves — AI and crypto — have left a permanent imprint on the .io namespace regardless of how many of those domains remain active.

The Speculative Layer: 335,802 Domains With Nothing Behind Them

At the other end of the distribution from the platform mega-domains, 335,802 .io domains — 21.1% of the namespace — exist as a single DNS record each. These are domains with no subdomains, no www record, no mail server — a registration with, at most, an apex A-record pointing somewhere. At $45-100 per year in registration costs, these 335,802 domains represent an estimated $15-34 million in annual registration fees flowing to the registry with minimal corresponding Internet activity.

This is not unusual for a premium TLD — our .ai analysis found that 61% of active .ai websites remain placeholders at $90-220 per year. But .io's 21.1% single-record rate is notably lower than .ai's placeholder rate, consistent with a more mature namespace where attrition has already culled non-renewed speculative registrations. At .io's price point, holding a dormant domain is an annual decision — and 21.1% of registrants keep making it.

The Aftermarket Signal

The premium the market assigns to .io domains provides additional context for the speculative layer:

Five .io domains sold for over $100,000 in 2024 alone — up from three in 2023 — and .io aftermarket dollar volume rose 26.5% year-over-year. 52.9% of .io aftermarket sales are single English words (common nouns), suggesting that the speculative layer is driven by dictionary-word hoarding. Park.io dominates the .io aftermarket with 64.8% of all sales, functioning as both the primary speculator and the primary marketplace — a concentration that mirrors .io's platform layer concentration.

The Competitive Landscape: .io vs. the New Tech TLDs

.io did not become the tech TLD by being the best option — it became the tech TLD by being first. Now it faces competition from TLDs designed specifically for the developer market.

.io has the largest installed base among tech-focused TLDs at ~1.6 million registrations, but its growth has flatlined. Our .ai analysis noted that .ai registrations are growing at roughly 10x the rate of .io. Google's .dev and .app are 3-4x cheaper, enforce HTTPS by default, and carry no sovereignty risk — yet they have not displaced .io. The .io brand premium persists because of network effects: when kubernetes.io, terraform.io, and sentry.io are already established, the next infrastructure company chooses .io for the same reason the previous one did.

The price comparison is stark. A .io domain costs $45 wholesale — 4.4x the price of .com ($10.26), 3.75x the price of .dev ($12), and competitive with .tech ($49). Google's tech TLDs are priced to undercut .io on cost. But .io's $45 price point does something .dev's $12 cannot: it creates a quality filter. At $45/year, bulk speculation is expensive enough to discourage the kind of mass-registration abuse that destroyed .tk. The premium is both a competitive disadvantage and a structural defense.

The Sovereignty Clock: What the Chagos Deal Means for 1.6 Million Registrants

Every section of this analysis so far has treated .io as a technical and commercial object. But .io is also a political artifact — a country-code TLD assigned to a territory created through the forced expulsion of its entire population, now generating $42 million per year in registry revenue that none of the expelled people have ever received.

The Colonial Foundation

The British Indian Ocean Territory was created on November 8, 1965, when the UK separated the Chagos Archipelago from Mauritius — three years before Mauritius gained independence. Between 1968 and April 27, 1973, the UK forcibly removed between 1,151 and 2,365 Chagossians (sources vary) from Diego Garcia, Peros Banhos, and the Salomon Islands. The US paid Britain $14 million for the expulsion — concealed from both the US Congress and the British Parliament. Colonial Office documents later revealed a deliberate strategy to deny Chagossians existed as permanent inhabitants, classifying residents who had lived on the islands for over 150 years as transient contract workers.

The Chagossians were deposited in Mauritius and the Seychelles with initial compensation of £650,000. The 2019 International Court of Justice advisory opinion found the UK's continued administration unlawful. The UN General Assembly called for British withdrawal within six months. The UK ignored both.

The Revenue Controversy

The .io domain monetizes the country code of this territory. The revenue flows are opaque:

• Identity Digital (US-based, Ethos Capital-owned) earns ~$42.4 million per year from .io registrations via ICB Ltd.
• The UK government explicitly denied receiving any .io revenue: "There is no agreement between the UK Government and ICB regarding the administration of the .io domain" and "the Government receives no revenues from the sales or administration of this domain."
• Paul Kane (original .io operator, 1997-2017) previously claimed profits were "distributed to the authorities for them to operate services as they see fit" — a claim the UK government contradicted.
• The Chagossians have received zero revenue from .io domain sales. In July 2021, the Chagos Refugee Group UK filed a complaint seeking repatriation of the domain and back royalties. In February 2020, Chagossians approached Afilias/ICB seeking "a fair percentage of the acquisition price" and a share of past royalties. They were rebuffed.

A $42-million-per-year business built on the country code of a people who were forcibly expelled and have never seen a penny of the proceeds. This is the backdrop against which the sovereignty question plays out.

The Treaty

On October 3, 2024, the UK announced an agreement to transfer sovereignty of the Chagos Archipelago to Mauritius. The treaty was formally signed on May 22, 2025. Key terms: Mauritius exercises full sovereignty; the UK retains Diego Garcia for 99 years at £101 million per year; Chagossians may return to all islands except Diego Garcia; a £40 million trust fund is established.

As of early 2026, ratification is stalled — the UK House of Lords has delayed further debate, and a Conservative amendment argues ratification would breach the 1966 US-UK agreement on Diego Garcia.

What Happens to a ccTLD When Its Territory Changes Hands

ICANN adopted a ccTLD retirement policy on September 22, 2022. The mechanism:

Historical Precedents

No commercially significant ccTLD has ever been forcibly retired on a short timeline. The longest transition was .tp (Portuguese Timor), which took 13 years from political change to deletion — and it had minimal registrations. The .yu (Yugoslavia) transition took 7 years. The .an (Netherlands Antilles) transition took 5 years. All of these were small TLDs with negligible commercial footprints. .io, at 1.6 million registrations and $72 million in annual wholesale fees, would be the first commercially significant ccTLD to face the retirement process — and the institutional inertia evident in every prior case suggests that .io's retirement, even if the treaty triggers the ISO removal chain, would be measured in decades, not years.

Three Scenarios

Base case — gradual transition (most likely): Treaty ratification eventually proceeds. BIOT formally ceases as a UK-administered territory. ISO takes 1-3 years to update the code. IANA issues notice. Identity Digital requests the full 5-year extension. .io operates under a managed 10-year sunset with registrant protections, revenue-sharing negotiations between Identity Digital and Mauritius, and minimal operational disruption. Timeline: .io potentially retired ~2038-2042, though further extensions are plausible given commercial significance.

Bear case — TLD retirement: Mauritius gains sovereignty and declines to maintain .io's commercial delegation, preferring to develop .mu instead. ICANN faces pressure to enforce the retirement policy as written. The 10-year maximum retirement period is enforced. 1.6 million registrants face migration — at a cost borne entirely by them, not by the registry, the UK, or Mauritius. Timeline: same as above, but with less cooperative transition.

Bull case — Mauritius windfall: Mauritius recognizes .io as a sovereign asset. Identity Digital has already positioned for this scenario — it took over backend operations for Mauritius's .mu ccTLD, establishing a direct relationship. Mauritius renegotiates Identity Digital's operating agreement upward, extracting a revenue share comparable to Tuvalu's .tv deal ($10 million per year for 11,000 people). .io operations continue unchanged. The ISO code is either retained or replaced with a successor code. Timeline: .io continues indefinitely under new sovereign ownership.

The tech industry's response to the Chagos sovereignty question has been, largely, silence. No major .io-dependent company has publicly announced migration plans. Domain experts assess the near-term risk as very low. But the entities most exposed — github.io with 1 million records, kubernetes.io running in production clusters worldwide, terraform.io hosting infrastructure-as-code documentation — have no formal stake in the treaty negotiations. If .io were sunset, the migration cost would be borne entirely by the 1.6 million registrants — not by BIOT (which has no government), not by Identity Digital (which can redeploy infrastructure), and not by the UK or Mauritius.

What's at Stake

• keenetic.io accounts for 19.3% of all .io records — more than github.io, sourceforge.io, and gitbook.io combined — a single router manufacturer's device provisioning system generates more DNS entries than the entire visible developer-tools ecosystem. Any raw record-count comparison between .io and other TLDs must account for this structural outlier.
• 6,144 platform domains (0.4% of the namespace) host 50% of all 13.2 million records — the .io TLD is structurally dependent on a handful of multi-tenant providers. A migration by any top-10 platform to a different TLD would measurably deflate .io's dataset footprint and signal a shift in developer sentiment.
• 335,802 .io domains — 21.1% of the namespace — exist as single-record registrations with no observable subdomains — at $45-100 per year retail, this represents an estimated $15-34 million in annual registration fees for near-zero Internet activity. The long tail of .io speculation is real and persistent, held up by .io's brand premium rather than deployment plans.
• The UK-Mauritius Chagos treaty creates the first modern test case for ccTLD transition at commercial scale — .io has an estimated $72 million per year in wholesale registration fees at stake. ICANN's retirement policy was finalized in 2022, but the closest precedents (.cs, .an, .yu) all involved political dissolution, not treaty-mediated sovereignty transfer. No framework exists for what happens when 1.6 million registrants are caught between two sovereign states and a private equity-owned registry operator.
• $42.4 million per year in .io registry revenue has been generated from the country code of a forcibly expelled population that has received none of it — the Chagossians' 2021 complaint and 2020 direct approach to ICB were both rejected. Whatever the legal outcome of the sovereignty transfer, the moral calculus of .io's revenue distribution is unresolved.

What Would Help

1. ICANN: establish a ccTLD transition protocol for peaceful sovereignty transfers before .io forces one. The Chagos case is the first time a commercially significant ccTLD faces potential redelegation through a treaty rather than political dissolution. ICANN's existing retirement policy was designed for cases of operator malfeasance or code removal — not for sovereignty transfers between consenting states. A framework with explicit timelines, registrant protection provisions, and revenue-sharing baselines would benefit every ccTLD that sits on contested or transferring sovereignty. Start with /stats/tld/io to understand the scale.

2. Identity Digital: publish a registrant communication plan for the Chagos transition. Identity Digital currently operates .io under an agreement that predates the sovereignty treaty. Registrants — especially those running production infrastructure on .io subdomains — have no public disclosure of what transition planning looks like. Tuvalu's .tv model (GoDaddy openly renegotiated with the government, ensuring continuity) provides a template. The 1.6 million .io registrants deserve at least the same transparency.

3. Infrastructure-dependent .io users: audit your exposure now, not after a treaty ratification. Companies with production systems on .io domains — API endpoints, SDK registries, documentation, developer authentication flows — should catalog every .io dependency and estimate migration costs. github.io's 1 million records belong to individual developers. kubernetes.io's DNS entries are in production clusters globally. terraform.io serves documentation that engineers reference daily. Migration from an established TLD is not a weekend project. The time to plan is before IANA issues a Notice of Removal.

4. Mauritius: treat .io as a sovereign asset in the treaty negotiation, not an afterthought. Anguilla earned an estimated $93 million from .ai in 2025. Tuvalu earns $10 million per year from .tv. The .io wholesale registration revenue base — $72 million per year — is larger than either. Mauritius's negotiating position should include explicit provisions for ccTLD revenue sharing, with legal structures that ensure continuity of operations while directing commercial upside to the new sovereign. The .nu precedent — where Niue's ccTLD was delegated without its consent and the revenue flowed to Sweden — is the failure mode to avoid.

5. Security researchers: use .io's premium pricing as a natural experiment in abuse economics. At $45 wholesale, .io is priced near the threshold where bulk abuse registration becomes uneconomical. The Interisle Consulting Group's phishing landscape data consistently shows that higher-priced TLDs have lower abuse rates. An analysis of .io's abuse rate per 1,000 domains — compared to .app ($12), .dev ($12), .ai ($90), and .tech ($49) — would directly test the price-floor hypothesis with four data points at different price levels and different registry models. Our TLD statistics provide the baseline domain counts.

This analysis was conducted using the DomainsProject dataset, which continuously indexes domains across all 1,519 active TLDs in the IANA root zone. All .io record counts and domain composition figures reflect active DNS observations as of Q1 2026. Platform classification (100+ record threshold) and keyword-based thematic counts (crypto/web3, ai-containing) are structural proxies defined in the Methodology section; both are upper-bound estimates subject to false positives from substring matching. Registry financial data is from Internet Computer Bureau Ltd filings with UK Companies House. The UK-Mauritius Chagos Islands sovereignty chronology is sourced from UK Foreign, Commonwealth & Development Office announcements, the UK Parliament House of Commons Library, and the treaty text published May 2025. Historical ccTLD precedents are sourced from ICANN documentation and Domain Incite reporting. Pricing data from Cloudflare Registrar at-cost pricing and TLD-List aggregates as of Q1 2026. Aftermarket sales data from NamePros and Strategic Revenue analysis. Y Combinator TLD analysis from MarkUpgrade. For the broader context of island ccTLD economics, see our earlier post Tiny Islands, Massive TLDs. Explore .io statistics on our TLD statistics page, browse the full TLD dashboard, or access the complete dataset for your own research.