.io domain: who runs it, who can register, what it costs

Check the IANA record and you'll find Internet Computer Bureau Limited listed as the ccTLD manager of .io, with a contact address on Diego Garcia in the British Indian Ocean Territory and a technical office in Orpington, Kent. Ownership has shuffled twice since then. Paul Kane sold the holding company to Afilias in 2017, Afilias went to Donuts in December 2020, and Donuts was scooped up by private equity firm Ethos Capital in January 2021 (Wikipedia). The group now operates under the name Identity Digital, which Gandi lists as the technical operator for .io. GoDaddy can't even get its own story straight: one support page names Identity Digital, another still says Donuts. That's almost certainly just a rebrand nobody bothered to update everywhere, not two competing backend systems, but the source material doesn't spell it out either way.

Strip away the corporate history and the structure is straightforward. Internet Computer Bureau is the registry: it holds the master database and sets the rules everyone else has to follow. Registrars, GoDaddy, Gandi, Namecheap and the rest, are just accredited resellers who take your money and process the registration on your behalf. The registrant is you, whoever's name ends up on the WHOIS record once the domain is live. However many hands the business has passed through, policy authority for .io still sits with Internet Computer Bureau as the IANA-delegated manager. No registrar gets a say in that.

Anyone, anywhere can register a .io domain, no residency, citizenship or local-presence requirement at the second level (the yourname.io format almost everyone uses). Registrar documentation and independent write-ups back this up: tld-list.com and GoDaddy both describe .io as unrestricted at that level. The one nominal restriction lives at the third level, names like example.co.io, technically reserved for residents of the British Indian Ocean Territory. In practice nobody uses this tier, because the territory has no permanent civilian population to speak of.

The registry sets the technical boundaries: labels run three to sixty-three alphanumeric characters, hyphens are fine but can't sit at the start or end, and you can't use a name for pornography or anything unlawful. Registrars then bolt their own rules on top of that. Some ask for extra verification at checkout, others restrict certain payment methods, and none of this is consistent across providers, it's registrar policy, not anything baked into .io itself. So if a sign-up process feels unusually fussy, blame the registrar, not the registry.

Moving a .io domain between registrars works the same way it does for most top-level domains: you need the EPP (or transfer authorisation) code from your current registrar, and they have to unlock the domain before anything can happen. ICANN's 60-day lock after registration, transfer or registrant change has applied to .io just as it does to gTLDs. But ICANN's GNSO Council voted in March 2025 to scrap that lock as part of a broader overhaul of transfer policy, so whether you actually hit that 60-day wait depends on whether your registrar has caught up with the change yet.

Registration and renewal terms run from 1 to 10 years, a cap set by the registry itself and confirmed by both GoDaddy and Gandi. What happens once a domain expires is murkier: there's no single published registry-wide policy, and registrars describe the aftermath in their own way. GoDaddy parks an unrenewed .io domain, then cancels it and strips it from the account 40 days after expiry. Gandi's pricing page lays out a 45-day late-renewal window at a bumped-up fee, followed by a restore period priced at $120 for the first year, then 15 days pending delete before the name goes back into the pool. Treat these numbers as registrar policy, not registry law, and check your own registrar's terms before you let a .io lapse.