Verisign will delete 22,000 third-level .name domains in early 2027 after ICANN approval

What is happening

Around 22,000 internet addresses of the form first.last.name are set to be deleted after ICANN approved a Verisign request to end third-level registrations in the .name top-level domain. According to a dev.to write-up, the notice period runs at least 90 days, pointing to removal around February 2027 — including registrations prepaid as far as 2040. Many owners only discovered the decision in early September 2026, through a blog post by Google engineer Neil Fraser rather than an official notification.

A domain that was marketed as permanent

The .name top-level domain launched in January 2002 under Global Name Registry and was aimed at individuals rather than companies. It originally sold only third-level names with a shared second level, so john.doe.name and jane.doe.name could belong to unrelated people. Launch-era marketing, preserved in archived pages cited by dev.to, pitched it as a web address "for life". Second-level registrations arrived in 2004, and Verisign bought the registry in 2008.

Neil Fraser registered neil.fraser.name in 2002 — reportedly in part because .name was not then run by Verisign — and, per his posts, has used it for his website, email, and APIs for his home IoT devices. His termination post says the site disappears in February, the email goes with it, and the connected devices stop working. The Hacker News discussion drew 2,213 points and 538 comments, according to dev.to.

How the approval happened

Verisign filed its request through ICANN's Registry Services Evaluation Process on April 15, 2026, citing declining usage and limited registrar support, and ICANN approved it on May 7, publishing the letter on July 28. Asked on the form what effect the change has on the life cycle of domain names, Verisign answered with a single word: "None." The stated benefit was equally brief — improved operational efficiency for the TLD.

ICANN's letter says Verisign consulted registrars covering most of the user base and that they raised no security, stability or competition concerns. Registrants themselves were not asked; a footnote, as quoted by dev.to, says those relationships belong to the registrars. ICANN also states its review is limited to security, stability and competition and does not extend to other impacts — such as losing an email address held for two decades.

For scale, per the dev.to article: Verisign reported $435 million in quarterly revenue, and the 22,000 names are roughly 0.012 percent of its 179 million .com and .net domains.

The appeal

One registrant, Doytchin Spiridonov, filed a reconsideration request with ICANN on June 2. The board committee handling such appeals issued its recommendation on August 24, and Domain Name Wire reported the request was on track to be denied. The reasoning, as relayed by dev.to, holds that early termination does not affect a domain's life cycle because the name still passes through the standard post-deletion stages — a framing hard to square with a registration paid through 2040. ICANN has checked Verisign before, forcing the 2003 Site Finder wildcard shutdown after 19 days, but that was a DNS stability issue, which sits inside its mandate.

A takeover risk, not just an outage

Once the third-level names are deleted, the second level beneath them presumably becomes registrable. Whoever then registers fraser.name could recreate neil.fraser.name, run a mail server for it, and receive password resets for any account still listing the old address — the standard path from mailbox control to identity control. Fraser warns that an attacker could take over hundreds of his accounts and push commits under his credentials.

There is also a browser-side problem. The Public Suffix List, which browsers use to draw boundaries between sites, still has an open question about how to treat .name's shared second levels. Where a second level is not treated as a public suffix, its future owner would sit on the same side of the cookie boundary as every name below it.

What owners and operators should do

Registrants should move logins first — updating the email address on mail providers, code hosting, registrars, banks and admin accounts — and migrate the site second. The old address should be removed as a recovery option, and any commit-signing, SSH or API keys tied to it rotated. Third-level .name records remain visible via whois.nic.name for anyone confirming their registration. The broader lesson is to register at the second level: anything beneath it belongs to someone else, however far ahead you pay.

Service operators should treat email-based logins on domains that can expire or change hands as a takeover vector, re-verify old accounts before sending sensitive resets, and offer passkeys or second factors that do not depend on the mailbox.

Why it matters

This is a case study in who actually controls a name on the internet. A registration marketed as lasting a lifetime and paid 14 years in advance can be ended by a registry decision reviewed only for security, stability and competition — criteria that, by ICANN's own account, exclude the interests of the people affected. The deletion also turns a personal outage into a security problem, because email-based account recovery means a dead domain can be resurrected against its former owner. Anyone relying on an address they do not control at the registry level — or any service that authenticates users by mailbox — has something to learn from it.