.auth
Is .auth a real TLD? Who’s applying to run it?
.auth is contested: 3 applications for it are on ICANN’s Reveal Day list, as of 7 October 2026. They are NextGEN TLDs, Codyssey and Link Freedom Group. XServer named .auth as a backup string for its .start application. ICANN deactivated it, because another applicant applied for the same string or named it as a backup. Verisign named .auth as a backup string for its .pki application. ICANN deactivated it, because another applicant applied for the same string or named it as a backup. Suffix named .auth as a backup string for its .btw application. ICANN deactivated it, because another applicant applied for the same string or named it as a backup.
A natural fit for login and identity tech brands, but narrow demand and phishing worries keep it a niche developer address.
identity and access-management vendors, developer-tool startups building login/SSO/passkey products, and security teams wanting a semantic home for authentication endpoints
In LFG's published list of 300+ strings submitted before the ICANN window closed on 2026-08-12. Their catalog tagline: “Protected by design.”
Named on the ICANN gTLD application list, 7 October 2026 as a replacement (backup) string of the applicant's .btw application, shown as deactivated: another applicant applied for the same string or named it as a backup
Named on the ICANN gTLD application list, 7 October 2026 as a replacement (backup) string of the applicant's .pki application, shown as deactivated: another applicant applied for the same string or named it as a backup
Named on the ICANN gTLD application list, 7 October 2026 as a replacement (backup) string of the applicant's .start application, shown as deactivated: another applicant applied for the same string or named it as a backup
The 2012 applications making the most similar bet. Chosen by AI from every string in that round, without being told what happened to any of them.
Same bet as .auth: a short, un-ownable trust-function word that no single vendor can claim but every security/identity provider wants, whose value depends entirely on the registry policing who is allowed to stand behind it.
The category-noun form of the same wager — a functional trust word sold to the same buyer set (security and identity vendors putting primary product identity on it), differing from .auth only in being the industry label rather than the technical function.
Closest structural match for the clipped-developer-jargon shape: an abbreviation developers already type daily, bet on developer-infrastructure companies and their tooling namespaces rather than on a consumer audience, which is where .auth's actual registrants (identity/SDK vendors) live.
What a .auth domain is
.auth is not a TLD yet. It is a string on our record of the ICANN 2026 new gTLD round, in our AI & tech category. 3 applications for it are on ICANN’s Reveal Day list.
Is the .auth domain extension real yet?
.auth is not yet a domain extension you can register: nothing resolves under it, and no registrar sells names in it. It is a string applicants have put forward in the ICANN 2026 new gTLD round, the process that decides whether it becomes one.
When can you buy a .auth domain?
You can’t yet. A .auth name can only be registered once the string is delegated (added to the DNS root) and its registry opens. Last round's closest parallel to .auth was .secure, delegated on 10 August 2016.
Is .auth a real TLD?
Not yet. .auth is not in the DNS root, so nothing resolves under it. It’s here because .auth is on ICANN’s Reveal Day list of applied-for strings. Every entry on this page links to its source.
“CS2676T-T34770 · Codyssey SL · primary · contention set 2026-18 LFGL2683T-T31637 · Link Freedom Group Ltd · primary · contention set 2026-18 NTG2671T-T26730 · NextGEN TLDs GmbH · primary · contention set 2026-18”ICANN
“CS2676T-T34770 · Codyssey SL · primary · contention set 2026-18 LFGL2683T-T31637 · Link Freedom Group Ltd · primary · contention set 2026-18 NTG2671T-T26730 · NextGEN TLDs GmbH · primary · contention set 2026-18 SI2639T-T50366 · Suffix Inc. · replacement string of .btw · Deactivated VRSN2658T-T77256 · VeriSign Sàrl · replacement string of .pki · Deactivated XI2694T-T96618 · XRegistry Incorporated · replacement string of .start · Deactivated”ICANN
“.auth · AI & Tech · “Protected by design.””Link Freedom Group
- Band: usable but limited (30-49), at its top. The string is a genuine high-value developer keyword: 'auth' is the standard shorthand for authentication across the software industry, and identity/login tooling is a large, durable product category, so a dev-tool brand plausibly using a .auth domain as its primary identity is credible over the next 5 years. It is not in the 50-69 strong-niche band because the realistic buyer pool is narrow (auth vendors and their subdomain-style endpoints rather than a broad category of businesses), and a TLD semantically tied to credentials invites phishing abuse, which tends to make enterprise security teams cautious and can depress mainstream brand adoption; sustained demand is therefore unproven rather than demonstrated. It is not in the 10-29 vanity band because, by analogy with developer-keyword TLDs that found real primary-identity use among technical audiences, the term has authentic end-use utility, not just novelty. Applicant facts: the string is announced by Link Freedom Group, which filed more than 300 strings in the ICANN 2026 round and published its catalog listing this string under 'AI & Tech' with the tagline 'Protected by design.'; a portfolio applicant of that breadth is a neutral adoption signal in itself. Main market uncertainty (launch assumed): whether security-conscious organizations treat .auth as a trust-enhancing home for identity products or preemptively block and avoid it as a credential-phishing surface, since that single dynamic swings both end-use adoption and aftermarket value.