.zip domains: who runs the registry and who can buy

.zip is run by Charleston Road Registry Inc., the sponsoring organisation named in the IANA delegation record. That's Google's own registry arm: the administrative and technical contacts sit under Google Inc., and the name servers run on Google infrastructure under charlestonroadregistry.com. No separate third-party backend provider gets a mention in the sources we checked.

The contract itself sits with ICANN, which signed a base, non-sponsored Registry Agreement with Charleston Road Registry on 8 May 2014, as recorded on the ICANN registry agreement page. ICANN handles the rules every gTLD operator has to follow. Google Registry, through Charleston Road Registry, writes the .zip-specific policy on top of that, including the mandatory HTTPS notice laid out on its registration policy page.

Three roles matter here if you're buying a .zip domain. The registry, Charleston Road Registry, keeps the master database of .zip names and sets the rules for the whole namespace. The registrar is the separate accredited company, GoDaddy, Namecheap, whichever you pick, that actually sells you the domain and lets you manage it. The registrant is you: the name and contact details on the registration. These are three distinct entities, and swapping registrars changes nothing about who runs the registry underneath.

.zip has no eligibility restriction. Anyone, anywhere, can register one, first come first served, as confirmed by GoDaddy's help documentation. No residency requirement, no trademark, no need to belong to a particular industry or profession.

The registry does put conditions on certain name types, not on registrants themselves. If you register a two-character letter/letter ASCII label, you can't misrepresent an affiliation with a government or country-code manager where none exists, per the .zip Domain Registration Policy. Names on the IOC, Red Cross and IGO reserved names list can only be registered on behalf of the relevant organisation. These are registry rules, binding on every registrar.

Separately, the registry runs a premium pricing policy for certain names, so some strings cost more than the standard rate, as set out in the .zip Pricing Policy. That's a pricing tier, not a barrier to entry, but it changes what a given name actually costs at checkout. Individual registrars might add their own verification steps at the point of sale, but that's registrar practice, not registry rule.

Transferring a .zip domain works the same way as any other EPP-based transfer. You get the authorisation code from your current registrar, unlock the domain, then hand that code over to the new one. Namecheap supports RegistrarLock for .zip, and standard ICANN transfer rules apply on top, including the 60-day lock that kicks in after initial registration or after a change of registrant. ICANN has voted to scrap that lock in a future policy update, but it isn't live for .zip yet, so don't plan around it.

Registration terms run from 1 to 10 years, though renewals are usually capped lower than that. Namecheap, for instance, caps renewals at 9 years. Grace and redemption periods differ by registrar too: Hosterion quotes up to 45 days grace after expiry plus a 30-day redemption quarantine, while Gandi publishes a 45-day late-renewal window followed by a restore period that carries a noticeably steeper first-year fee. None of this comes from a single registry-wide policy, it's registrar-reported, so treat the exact day counts and restore fees as a guide rather than gospel.

One gap worth flagging: Google Registry doesn't publish one clear page laying out grace, redemption and restore periods for .zip directly. Check the actual numbers with whichever registrar you're using before you rely on them.

Google Registry's own showcase list isn't long. Hadi.zip, an Android developer's personal site, is one of the few genuine examples it points to. Download.zip used to be on that list too, a curated-download newsletter run by creator David Imel, but a third-party review couldn't reach the site at the time of checking, so file that one under "used to exist" rather than a working example today. Outside the registry's own picks, researchers at DNS Research Federation and Gen Digital have both written up .zip domains turning up in phishing runs that mimic file names such as invoices or software updates, and that's coloured how a lot of the wider internet now reads the string.

Get HTTPS sorted before you go live. The registry mandates it, and .zip sits on the HSTS preload list, so without a valid SSL certificate the domain simply won't load in a modern browser, no insecure warning page, nothing at all. That's a stricter bar than most gTLDs set. On email: .zip text inside messages or chat apps can turn itself into a clickable link automatically, which is worth remembering before you type one out casually in a message.

It suits a primary domain for developer tools and personal sites, where the audience already reads technical branding without blinking, and it's a shakier pick as a redirect target for a consumer brand. One naming rule worth following: stay away from anything that echoes a common filename or software title, invoice, update, that sort of thing, because that's the exact pattern already linked to abuse.