The New .dev Domains and What They Require

A new ending, open to everyone

Since yesterday, anybody can register a domain ending in .dev. Short names that have been taken in .com for twenty years are suddenly available, and the offers are already arriving.

The ending is run by Google's domain registry and aimed at software developers, much as .app, which opened last year, was aimed at apps.

Both come with a condition most domain endings do not have. They only work over HTTPS, and there is no way around it.

That condition is worth understanding before buying one, and so is the question of whether a new ending is where your attention belongs.

The list built into browsers

Browsers carry a list of names that must only ever be reached over HTTPS, the encrypted connection shown by the padlock.

It is called the HSTS preload list, and the major browsers, Chrome, Firefox and Safari among them, all use it.

Individual sites can apply to join it. With .dev and .app, the whole ending is on it, so every name registered under them is covered from the first day.

A browser asked for a page on a .dev name will never try plain HTTP. If HTTPS is not working, the page does not load.

What a .dev name requires

• A certificate from the first day, before anybody visits.
• Renewals that never lapse, since an expired certificate blocks the site entirely.
• Every image and script loaded over HTTPS as well.
• Hosting that issues certificates automatically for each name it serves.
• Somebody watching for certificate errors as they happen.

The second is the one that matters over years. A certificate that lapses on an ordinary site produces a warning; on a .dev site it produces a locked door.

No way past the warning

On an ordinary .com with a certificate problem, browsers show a warning page, and some visitors press on regardless.

On a name covered by the preload list, that option is gone. The browser shows the error and offers no way past it, for any visitor, until the certificate is fixed.

Free certificates that renew themselves every few months make this manageable. They keep renewing as long as the domain points at the server that requested them, and somebody needs to notice the day that stops being true.

What HTTPS-only does not change

The preload list only governs web browsers. Email on a .dev name works as it does on any other domain.

So a .dev name used purely for email avoids the certificate question. It does not avoid the mistyping one, which matters more for an email address read aloud over the phone than for anything else.

What the ending says to customers

There are now hundreds of domain endings, including ones named after trades and professions.

Customers have not caught up. Most people in Canada assume a business is at .ca or .com, and type one of those when they half remember an address.

An unfamiliar ending gets mistyped, misheard, or corrected by autocomplete into something else. Email sent to an address at it goes astray the same way.

Some people also read an unusual ending as a sign of spam, which is not entirely unfair, since some newer endings have been popular with spammers.

Try saying the address aloud the way a customer would hear it on the phone, and count how often it would need spelling out.

A worked example

A two-person IT support business registered a short .dev name this week, planning to put it on new business cards.

They pointed it at their existing hosting, as they had every domain before, and typed it into a browser. The page refused to load, showing a security error with no button to continue.

The hosting was fine. The browser had insisted on HTTPS, and the server had no certificate for the new name yet.

A certificate fixed it the same afternoon, and the .dev name now forwards to their main site.

The more useful discovery came while they were in the registrar's account. Their .com, the address on every invoice and both cars, was due to expire in five weeks, with reminders going to an address nobody checked.

Renewing that was the important job of the week.

The offers that follow a launch

Every new ending brings a wave of email. Some of it is ordinary advertising. Some claims that somebody is about to register your business name under the new ending, and that you must buy it first.

That second kind is a pressure tactic, not a warning, and it works on the same nerve as the fake renewal notice.

If an ending matters to you, check it yourself, through the registrar you already use, in your own time.

The names that matter more

For most businesses, the domains worth protecting are the ones already in use: the .ca or .com on the vans, the cards, the invoices and every email address.

Register them in the business's name, not an employee's or a former designer's. Renew for several years at a time, with automatic renewal on a card that has not expired.

Send the registrar's reminders to an address somebody reads, and turn on the registrar lock that stops a domain being transferred without your approval.

If the other of .ca and .com is still free, or an obvious misspelling of your name, register it and point it at the main site.

The counter-case

Some businesses have good reason to want a .dev name.

A software developer or technical consultancy whose customers recognise the ending may reasonably use one, even as the main address. A short .dev name that forwards to the main site is harmless too, once its certificate is in place.

And a brand new business with no established address has less to protect, though it still needs a .ca or .com that customers will guess.

For an established business, though, the address customers already know deserves more attention than any new ending.

Before buying another ending

1. List every domain the business owns.
2. Check each is registered in the business's name.
3. Renew the main domain for several years.
4. Turn on automatic renewal with a current card.
5. Send reminders to an address somebody reads.
6. Lock the domains at the registrar.
7. Get a certificate first for any new name.

Step five is the one most often wrong. Domains rarely lapse because nobody would pay; they lapse because the reminders went to somebody who left.

Telling a genuine renewal reminder from an imitation is covered in the renewal notice that is not from your registrar.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.