The .com Monopoly: 1 Billion Domains, 44% of the Internet, and Why Nothing Else Comes Close

On March 15, 1985, a Cambridge, Massachusetts company called Symbolics registered symbolics.com — the first .com domain name ever. By the end of 1987, only 100 .com domains existed. By 2000, there were 20 million. By 2012, 100 million. Today, .com has crossed one billion resolved domain names in our dataset, and a single company — Verisign — operates the entire thing with 932 employees and a 68% operating margin.

The Internet's namespace was never designed to be a monopoly. ICANN launched over 1,200 new top-level domains starting in 2012 to break .com's lock on the market. Fourteen years later, all 1,110 active new gTLDs combined hold just 12.4% of global registrations. .com alone holds 44%.

We analyzed 2.3 billion domains across 1,519 TLDs in the DomainsProject dataset — the world's largest continuously maintained Internet domains collection — and cross-referenced the data with Verisign SEC filings, ICANN contract documents, NTIA regulatory records, and aftermarket sales data.

The headline: .com is not just the dominant TLD — it is the only infrastructure monopoly on the Internet with zero competitors, zero competitive bidding, and a government contract that auto-renews indefinitely. Google was found guilty of Sherman Act violations for maintaining a 90% search market share. Verisign operates at 100% market share for .com, and the DOJ has acknowledged it "possesses significant market power" — but no antitrust action has ever been taken.

The Data

DomainsProject continuously crawls and indexes domains across every delegated TLD in the IANA root zone. Our dataset covers:

Domain counts reflect active DNS resolution — we count domains that resolve, not registry marketing figures. Our dataset includes subdomains observed during crawling, which is why our 1.02 billion .com figure exceeds Verisign's reported 161 million registry registrations. Both numbers tell the same story: .com is the backbone of the functional Internet.

The Scorecard: .com vs. Everything Else

Top 10 TLDs by Domain Count

.com is 4.9x larger than the second-place TLD (.net) — and the gap is structural, not cyclical. The combined total of TLDs ranked 2 through 10 is 550 million domains — still only 54% of .com's count. A single TLD holds more resolved domain names than the next nine put together.

The long tail is extreme. After the top 10, no single TLD exceeds 1.1% of the namespace. The bottom 1,000 TLDs collectively hold less than 3% of all domains.

Concentration Metrics

494 of 500 Fortune 500 companies use .com as their primary domain. Only four use alternatives — three of them .net, all in healthcare. When the world's largest enterprises unanimously choose a single TLD, it is no longer a market preference. It is a dependency.

The Verisign Machine: $1.7 Billion from a Government-Granted Monopoly

Verisign's business model is straightforward: charge $10.26 per year wholesale for every .com domain registration and renewal. With 161 million registry registrations, that produces $1.657 billion in annual revenue. The company has 932 employees — generating $1.78 million in revenue per person — and an operating margin that ranks sixth in the S&P 500.

Verisign Financial Profile

The cost to operate the .com registry is estimated at $1.00-$3.50 per domain per year. Competitive bids for comparable registry operations — like India's .in TLD — came in at $0.70-$1.65 per domain. The American Economic Liberties Project estimates a fair market wholesale price for .com at $0.87-$4.37, compared to the actual $10.26. That gap — roughly $6.73 per domain in excess margin — generates what the Project calls a "$383 million annual windfall to shareholders."

.com Wholesale Pricing History

Verisign has taken the maximum permitted 7% price increase every single time it was allowed. From the 2012 freeze of $7.85 to the current $10.26, that is a 30.7% increase in just three years of active pricing — during a period when no meaningful improvement in service was delivered. If Verisign takes every permitted increase through the end of the current contract, .com wholesale will reach approximately $13.42 by 2030 — a 71% increase from the frozen price.

The American Prospect characterized Verisign as "the most profitable company in America" — a description earned not through innovation but through a government-granted monopoly over a low-dollar administrative product.

The Network Effect: Why Alternatives Can't Compete

.com's dominance is self-reinforcing through at least four mechanisms that no marketing budget or ICANN policy can overcome.

Browser and User Behavior Lock-In

Users are 3.8x more likely to assume a website ends in .com — regardless of its actual extension — according to a controlled recall study by GrowthBadger. .com achieved a 44% memorability score, the highest of any TLD tested. The next closest was .co at 33%.

Every major browser still supports Ctrl+Enter to auto-append .com — a behavior hardcoded since the early 2000s. ICANN's own consumer research, conducted by Nielsen, found 95% awareness of .com among Internet users, compared to 88% for .net and 83% for .org. Legacy TLDs were rated 91% trustworthy as Internet destinations; consumers reported being less comfortable providing personal information on sites using new gTLDs.

Aftermarket Dominance

Every domain sale exceeding $1 million in 2023 and 2024 was a .com. The record sale — ai.com at $70 million in February 2025 — is 41% higher than the previous all-time record (CarInsurance.com at $49.7 million in 2010). The aftermarket doesn't just favor .com — it is a .com market with other TLDs as a sideshow.

The 1,200 gTLD Expansion That Didn't Work

ICANN approved over 1,200 new TLD strings starting in 2012. The following table uses registry registration figures (Verisign DNIB Q4 2025) rather than our resolved-domain counts, to compare new gTLDs on the same basis as .com's 161 million registrations:

All 1,110 new gTLDs combined hold fewer than one-third of .com's registrations. The largest — .xyz at 4.16 million — represents 2.6% of .com's base. The new gTLD "expansion" produced volume but not competition. Worse, new gTLDs carry a disproportionate abuse burden: they represent 11% of the domain market but account for 51% of all phishing domains reported in the Interisle Phishing Landscape 2025 study. That reputation problem further reinforces .com's position as the safe default.

Even Google couldn't crack it. Google launched .app and .dev with a built-in security advantage (mandatory HTTPS via HSTS preloading), accumulated roughly 600,000 registrations each over five years — then sold its entire registrar business (10 million domains) to Squarespace in 2023 and exited the domain space. Google's own products — Gmail, YouTube, Google Cloud — all run on google.com.

Switching Costs

The lock-in is not psychological — it is operational. Changing a domain means updating every inbound link, every email configuration, every business card, every SEO signal, every API endpoint, every SSL certificate, and every piece of brand collateral. Academic research on network effects in the domain system confirms that these switching costs produce "monopolistic markets where dominance results in market lock-in — even if the given provider offers inferior products." For .com, the provider isn't inferior — the alternatives simply cannot overcome the compounding advantage of 41 years of path dependence.

The Infrastructure Bet: 300 Billion Queries a Day, One Registry

Verisign processes over 300 billion DNS queries per day for .com and .net — a volume that has grown from 48 billion in 2008, driven in part by AI agents and automated web crawling. The company operates two of the Internet's 13 root name servers (A-root and J-root) across more than 100 global anycast instances, and maintains capacity at 100x peak observed load.

The Uptime Paradox

Verisign has maintained 28 consecutive years of 100% DNS resolution uptime — an engineering achievement that simultaneously justifies its existence and obscures its risk. The 2002 DDoS attack that took down 7 of 13 root servers left Verisign's infrastructure untouched. The 2016 Mirai botnet attack against Dyn knocked out Twitter, Netflix, and PayPal — but didn't affect .com resolution because it targeted a different DNS layer.

The paradox: Verisign's reliability makes the dependency invisible. Because .com never goes down, organizations never build alternatives. Only 17% of Global 2000 companies employ DNS redundancy. The cost of a US Internet outage is estimated at $458.9 million per hour. Since .com represents roughly 44% of all resolved domains, a .com-specific failure would affect nearly half the functional Internet — and almost no one has a contingency plan for it.

The Single-Operator Risk

The risk to .com is not technical failure. Verisign's infrastructure is among the most resilient on the planet. The risk is that every .com domain on Earth depends on:

• One company (Verisign, 932 employees in Reston, Virginia) continuing to operate
• One government (United States) continuing to authorize that company
• One contract (the NTIA Cooperative Agreement) that auto-renews every six years unless the government actively intervenes

No alternative .com registry operator exists. No competitive bid has ever been conducted. No backup plan has been disclosed.

The Governance Gap: 9,000 Comments, Zero Changes

The .com monopoly is not a market outcome. It is a government policy decision — renewed, reinforced, and defended by two parallel agreements between Verisign, ICANN, and the US Department of Commerce.

The Contract Structure

Amendment 35 (October 2018) was the turning point. Signed under the Trump administration, it eliminated NTIA's contractual right to initiate competitive bidding for the .com registry and granted Verisign authority to raise prices by up to 7% annually — in four of every six years — without cost justification. The DOJ's own Antitrust Division had warned in 2008 that Verisign "possesses significant market power" and that registrants "do not perceive other TLDs as substitutes" — but the price cap was removed anyway.

The Public Comment That Changed Nothing

When ICANN proposed allowing .com price increases in 2020, it received 9,040 public comments — an organization that typically receives fewer than 50. 95% of comments explicitly opposed the increases. ICANN approved them anyway, stating it "was not a price regulator." In the same deal, Verisign agreed to pay ICANN $20 million over five years — a payment critics characterized as a "kickback" for approving the price hikes.

The Regulatory Response

In November 2024, Senator Elizabeth Warren and Representative Jerry Nadler wrote to the DOJ and NTIA urging an investigation into whether Verisign holds "monopoly power in violation of the Sherman Act." They cited a 30%+ price increase since 2018 with no service improvement, and stock buybacks worth over 75% of 2023 revenue. NTIA itself acknowledged that "a reduction in .com prices would be in the public interest" but stated it "does not have authority to set .com domain prices."

Three days after the Warren-Nadler letter, ICANN renewed Verisign's .com contract through 2030.

The Geopolitical Dimension

.com is US-controlled infrastructure in a fragmenting world. Verisign is a Virginia corporation subject to US sanctions law. In June 2021, the DOJ seized 36 Iranian .com domains — including PressTV.com — because .com registries fall under US jurisdiction. In 2020, 92 additional domains were seized for alleged Iranian disinformation.

The response from adversary states has been structural. Russia enacted its Sovereign Internet Law in 2019, requiring ISPs to connect to a national DNS system capable of functioning if disconnected from the global Internet. China has developed .chn with its own root DNS infrastructure. Both nations are building alternatives not because their technology is better, but because dependence on US-controlled .com is a strategic vulnerability they are unwilling to accept.

The irony is that the same concentration risk concerns that drive Russia and China to build sovereign alternatives apply equally to every country and business relying on .com — they simply haven't acted on it.

What's at Stake

The .com concentration data has concrete implications:

• 44% of all resolved domain names depend on a single registry operator with zero competitors — a concentration level that exceeds AWS (30% of cloud), Google (90% of search), and Visa/Mastercard (80% of payments), all of which face at least some competition
• Verisign's 68% operating margin on a government-granted monopoly generates $1.1 billion in annual operating income — with wholesale prices projected to reach $13.42 by 2030, the cost of .com will have risen 71% from the 2012 freeze with no competitive mechanism to constrain it
• 99% of Fortune 500 companies and 44% of all websites run on .com — yet only 17% of Global 2000 companies employ DNS redundancy, creating a single-point-of-failure risk that would cost an estimated $459 million per hour if realized
• 1,110 new gTLDs launched since 2012 have captured just 12.4% of registrations — the namespace expansion designed to reduce .com concentration has failed, and new gTLDs' 51% share of phishing domains further entrenches .com as the only trusted default
• US jurisdiction over .com makes every .com domain subject to American sanctions and seizure — a geopolitical risk that Russia and China have explicitly moved to mitigate by building sovereign DNS alternatives
• 9,040 public comments opposing .com price increases were overridden by ICANN — the governance system designed to steward the namespace has demonstrated it will not constrain the monopoly, even when the regulator (NTIA) acknowledges that lower prices would serve the public interest

What Would Help

1. Enterprise security teams: build .com failure into your threat models. .com has never gone down — which is exactly why most organizations have no contingency for it. DNS redundancy across multiple TLDs, multi-provider DNS configurations, and documented failover procedures for a .com resolution outage should be part of every enterprise resilience plan. Start with our TLD statistics dashboard to understand your namespace exposure.

2. Regulators: treat .com like the critical infrastructure it is. Google was found guilty of Sherman Act violations for maintaining a 90% search monopoly — a market where users can switch to Bing in seconds. Verisign operates at 100% market share in a market where switching is impossible. The DOJ acknowledged Verisign's market power in 2008. Eighteen years and multiple price increases later, no antitrust action has been taken.

3. ICANN: require competitive bidding for .com. No competitive bid for the .com registry has ever been conducted in 30+ years of Verisign's control. The cooperative agreement auto-renews every six years unless the government actively intervenes. A legitimate competitive process — even if Verisign wins it — would establish market pricing, create operational redundancy planning, and restore credibility to a governance system that approved price increases over 9,000 objections.

4. Registries and infrastructure operators: invest in namespace diversification. The .com monoculture is a systemic risk. Alternative TLDs with strong abuse controls, competitive pricing, and institutional adoption incentives — not just marketing campaigns — are the only path to reducing concentration. The data shows that cheap pricing alone attracts abuse (.xyz, .top), while premium pricing creates barriers (.ai). The middle ground is operational credibility.

5. Security researchers: monitor .com's monopoly economics, not just its DNS. The technical infrastructure is resilient. The governance infrastructure is not. Price increases, contract renewals, and regulatory actions are the vectors through which .com's monopoly affects the broader Internet. Track the .com statistics page alongside Verisign's SEC filings and ICANN Board resolutions for a complete picture.

This analysis was conducted using the DomainsProject dataset, which continuously indexes domains across all 1,519 active TLDs in the IANA root zone. Dataset domain counts reflect active DNS resolution as of March 2026. Registry registration figures are sourced from Verisign SEC filings and the Domain Name Industry Brief (Q4 2025). Financial data is from Verisign's FY2025 earnings release. Regulatory data is from NTIA, ICANN, and congressional correspondence. Explore .com statistics on our TLD statistics page, browse the full TLD dashboard, or access the complete dataset for your own research.