TLD Strategy for Startups: .com vs .io vs .ai vs .dev

About 160 million domains, the canonical TLD, the one your non-technical relatives type without thinking. If you can get the.com that matches your brand for under $5k, take it. The premium over a generic.com is small, and the long-term confusion-reduction is real.

Renewal cost is $10-15/year at major registrars (Namecheap, Cloudflare Registrar, Porkbun). Cloudflare Registrar's $10.44 sells at cost — they treat domains as a customer-acquisition tool for their other products. Namecheap is competitive but with regular promotional pricing tricks. Porkbun has a loyal following for transparent pricing and good support.

What you give up by not having.com: roughly 5-15% of organic traffic that types yourbrand.com instead of yourbrand.io and lands on whatever squatter or unrelated business owns the.com. This is real money for any consumer-facing brand and recoverable for B2B-only brands where customers paste links rather than type domains.

If the.com is squatted, you have three options: pay the squatter (usually $1k-$50k); wait for the registration to lapse (squatters who actively monetize do not let registrations lapse, but the long-tail of dead squatters do); pick another TLD. The wait strategy works for some long-shot names but is unreliable.

The British Indian Ocean Territory ccTLD became the default for technical products and developer tools in the 2010s. Heroku, GitHub Pages projects, hundreds of YC startups, CheckFast included. The aesthetic is clean, the price is moderate ($35-50/year), and the brand connotations skew technical and modern.

The risk is policy. The British Indian Ocean Territory is a UK overseas territory whose status is the subject of ongoing dispute — Mauritius claims it under decolonization principles, the UK and US currently maintain a military base on Diego Garcia. In October 2024 the UK announced an agreement to transfer sovereignty to Mauritius (subject to ongoing implementation as of 2026). The implications for the.io TLD are unclear — ICANN has discretion to retire ccTLDs when the underlying territory's ISO code changes.

Practical impact: if.io is retired, existing registrations might be honored for a transition period (ICANN's previous practice for retired ccTLDs has varied from 5-year wind-downs to immediate cessation). New registrations might stop. Your domain might still work for years; it might also stop within a few years. There is no clear answer.

Risk mitigation: register the.com as defensive backup if affordable (you do not need to use it, just own it for the optional fallback). Keep an eye on ICANN announcements about.io specifically. Consider.dev or.app as more stable alternatives if you are still pre-launch.

Anguilla's ccTLD became the default for AI-related products from roughly 2022 onward. Pricing is significantly higher than.io ($80-150/year at most registrars) because the Anguilla government deliberately maintains premium pricing as a revenue source. This worked:.ai TLD revenue has reportedly accounted for a meaningful percentage of Anguilla's national budget.

Same ccTLD policy risk as.io but with different specifics. Anguilla is a British overseas territory; sovereignty disputes are far less active than.io's situation. The risk is more about Anguilla's specific registry contractor's reliability and pricing decisions than geopolitical unwinding.

What you get: clear AI-product positioning. "yourbrand.ai" signals what the product does without explanation. For genuinely AI-native products, this is real branding value. For products that happen to use AI under the hood (most modern SaaS), the.ai branding may overcommit.

What you pay: ~10x.com pricing. Renewal at $80-150/year times five years is a real budget item for a bootstrapped startup. The premium is for the connotation, nothing technical or operational about the TLD justifies the price.

Google operates the.dev TLD as a generic gTLD (not a ccTLD), which means no government-policy risk. Pricing is $10-15/year — same as.com — and registration is open to anyone. Importantly,.dev is on the HSTS preload list at the TLD level, which means every.dev domain is HTTPS-only by default in every modern browser.

The HTTPS-mandatory aspect is a real benefit: there is no possibility of a man-in-the-middle downgrade attack on first visit, no "this site is not secure" warnings, no need to publish HSTS yourself for that protection. The TLD does the work.

Branding:.dev signals "developer tools" or "developer-focused". This works for technical SaaS, doc sites, internal tooling, and similar. Less clean for consumer-facing or non-technical products — "buygroceries.dev" feels off.

Reliability: backed by Google, which is both a feature (reasonable expectation of long-term operation) and a risk (Google has retired products before, though never a TLD). Treating Google's gTLD as more stable than a ccTLD is reasonable; treating it as 100% safe is overconfident.

.app: another Google-operated gTLD with HSTS-preload. $15-20/year. Targeted at app and software products. Less common than.io or.ai but increasingly visible. Same stability as.dev.

.co: Colombia's ccTLD, marketed as a generic alternative to.com ("co" meaning company). $20-30/year. Has been positioned as the backup.com for years; some success with brands like get.co (URL shortener) and angel.co (AngelList). Colombia is politically stable and the registry has been well-managed.

.so: Somalia's ccTLD. Inexpensive ($25-35/year) and increasingly visible for short-name plays. Risk profile concerning — Somalia's government stability is unsettled and the registry's reliability has had hiccups. Use only for non-critical brands, never for primary domains.

.xyz: a generic gTLD operated by XYZ.com LLC. Cheap ($1-5/year first year, $10-15 renewal). Heavy spam usage has hurt the brand connotation; some teams report email deliverability penalties when sending from.xyz domains. Avoid for transactional email.

.io alternatives that are safer:.dev (Google),.app (Google),.software,.tech (Radix). The price is higher than.io in some cases but the policy risk is lower.

ccTLDs for specific markets:.de (Germany),.uk (UK),.fr (France),.jp (Japan),.br (Brazil) — appropriate when targeting specific geographic markets. Each has its own residency requirements (some, like.de, require an in-country contact). Use only for market-specific subdomains, not primary corporate domain.

The registrar — where you register your domain — matters more than people realize. Different registrars have different reliability, different pricing, different security postures, and different policies during disputes.

Cloudflare Registrar is our default recommendation. Sells at cost (no markup), excellent two-factor auth, no upsells, and integrates cleanly with Cloudflare DNS. The downside is that they only support a subset of TLDs (most.com,.io,.ai,.dev,.org,.net are supported; some niche ccTLDs are not).

Porkbun is the indie favorite. Transparent pricing, no auto-renewal scams, good support, supports a wider TLD set than Cloudflare. Slightly higher pricing than Cloudflare but still reasonable.

Namecheap has been the budget option for years. Reliable but with aggressive upsells and pricing tricks (renewal price often higher than registration price). The advanced features (DNSSEC, two-factor) work fine but the UI is dated.

Avoid GoDaddy. Aggressive upselling, history of selling customer data, repeated security incidents, and the worst customer support of any major registrar. Porkbun, Namecheap, and Cloudflare all charge less and treat customers better.

Avoid your hosting provider's bundled domain registration. Convenient but creates dependency — when you migrate hosts, you have to migrate the domain too, which is a separate operation that can fail. Keep registrars and hosting separate.

Google has stated for years that all gTLDs are treated equally for ranking purposes. The.com advantage is not a Google ranking factor — it is a user-behavior factor (more clicks because more familiar, more direct-type traffic).

ccTLDs (.io,.ai,.co,.uk,.de, etc.) are geo-targeted by default..uk is associated with the UK in Google's index;.de is associated with Germany;.io is associated with British Indian Ocean Territory. For most ccTLDs this geo-targeting is actually a non-issue because the territory is small enough that there is no meaningful local ranking competition.

.io specifically has been treated as essentially a gTLD by Google for years — there is no real "BIOT search" Google needs to favor — and ranks competitively for global queries. Same for.ai and.co.

What hurts: TLDs associated with spam (.xyz,.tk,.ml). Email deliverability is the canary here — if your TLD has high spam volume, ESPs adjust reputation accordingly and your transactional email lands in spam more often. Pre-2024.xyz email had measurable deliverability penalties; the situation has improved but the legacy reputation lingers.

What helps: nothing specific to the TLD. Every TLD ranks equally on the merits — content quality, link profile, technical SEO. Pick a TLD on branding and operational considerations, not SEO.

Should you register the.com if your primary is.io? The argument for: prevents impersonation, keeps the option open if.io retires, protects against typosquatting. The argument against: extra cost, easy to forget renewal, signals "we wanted.com but could not get it" if anyone digs.

Our take: register the.com if it is available for under ~$200/year (registration plus renewal cost over 5 years). Set up a 301 redirect to your primary domain. Do not actively promote the.com — let it be a defensive backup that catches typo traffic and prevents squatters.

Do not register every TLD variant of your name (.com,.net,.org,.co,.io,.ai). The defensive value drops sharply after the first 1-2 TLDs and the operational overhead grows. Register the.com if available, register your primary TLD, and stop.

Trademark protection is separate from defensive registration. If you have a registered trademark, the UDRP process lets you reclaim infringing domains across most TLDs. This is more powerful than defensive registration for established brands.

CheckFast launched as checkfast.io. The.com (checkfast.com) was held by an inactive squatter wanting $15k; we did not negotiate. The.io fit the technical-product positioning, the price was reasonable, and we accepted the policy risk.

We registered checkfast.com defensively in 2025 when the squatter let it lapse. It is now a 301 to checkfast.io. Total annual cost: ~$50 for both registrations.

If we were starting today, we might pick.dev instead. The HSTS-preload mandatory-HTTPS is a small but real security benefit, the policy stability is better, and the price is lower. The branding nuance —.dev signals "developer tool" vs.io's broader "technical product" — would have been a minor consideration.

We would not pick.ai unless the product were specifically AI-native. The premium pricing is hard to justify for the connotation alone, and the same ccTLD risk profile as.io applies.

We would not pick.com unless we could get the exact match cheaply (under $1k). Brand confusion from squatter-owned alternatives is overrated for B2B SaaS — most customers paste links rather than typing domains, and the small fraction who type-and-misspell are not lost forever.