Country Code Top-Level Domain (ccTLD) List and Drop Rules

This is a zone list with drop rules, not a glossary. A country code top-level domain is the two-letter ending of one country or territory. Each row below says who can register, how that zone drops, and where the name is caught.

1. The two letters come from ISO 3166-1 and are delegated by IANA.
2. The local manager sets the drop clock. ICANN does not.
3. .com can take up to 80 days from expiry to drop: 45 grace, 30 redemption, 5 pending delete.
4. .de gives the last holder 30 days after deletion, then the name is free. No five-day countdown.
5. Google locks most country zones to that country. A short vanity list is treated as generic.
6. The created date resets on the new registration. Links and the archive do not.

TLD meaning without the textbook

TLD meaning is the last label in a domain name. In the domain name system the root is above it and the second-level domain sits under it. The Internet Assigned Numbers Authority puts the string in the root. The Internet Corporation for Assigned Names sets the policy frame around that root. Neither of them runs your renewal at DENIC or Nominet.

Split any tld list before you spend money.

• A generic top-level domain is .com, .net, .org, or a newer brand string. It is not a country.
• A country-code top-level domain is the two-letter domain assigned to a specific country or territory.
• .edu and .gov are sponsored generic domains for US institutions and US government. They are not country zones, and you will not keep a dropped one.

People say "domain extensions" as if the list were one market. It is not. A generic top-level string follows an ICANN-style life: grace, redemption, pending delete. Country zones do not. If the only tlds you have caught are .com and .net, you are early.

ccTLD list: zones and drop rules

There is no useful list of country rules inside a US registrar cart. The complete list of country zones that actually resolve is the IANA root database. That is the domain list of the root, not a guide to eligibility. The list of country code top-level zones is only the start. Each manager publishes who may register.

Use this as the working list of ccTLDs, not as every country on earth. Active ccTLDs number well past 300 once internationalized ccTLDs are counted. You will bid on about fifteen of them. Treat that full list as a map of specific countries or territories, not a cart. The domain name industry still talks as if country-code domains were one internet domain with a different sticker. They are not. In a specific country or region the release rule changes, and country code TLDs are local legal objects. A country code top level string, and the ccTLD domains under it, follow the manager. What you pull from any list of top-level labels is the release rule, not another logo.

The table is the zone list. Column four is the drop rule. Column three is who is allowed in. If either cell blocks you, skip the name. Read the registry page the week you bid. This is the field version, not a contract.

Country code domain rules that block the buy

A country domain is simply the local name for this product. Certain ccTLDs look cheap in a promo and then fail a document check.

• An au domain needs Australian presence. For com.au, a foreign trademark filed in Australia is one of the few real paths. A rented ABN that you do not control is how these get pulled later.
• .ca is Canadian presence: citizen, resident, Canadian company, or a qualifying Canadian mark. "My friend in Toronto is the holder" fails the day CIRA asks.
• .fr and .eu want a real tie to Europe. Registering a ccTLD on a fake address is not a grey trick. It is a deletion queue.
• .us is the ccTLD for the United States. A us domain needs a nexus you can stand behind. Google does not treat .us as a generic brand string.
• .es often wants a Spanish NIE or NIF. .it wants an EU tie. .jp wants a local contact. Budget the paperwork or skip the zone.

DENIC reported 18,150,432 .de names on 31 August 2026.

At the end of 2025, about 12.2% of .de holders were outside Germany.

SIDN's .nl stock was about 6.21 million in September 2026.

.de is one of the largest ccTLDs a non-resident can still register. .cn and .br are large and mostly closed. Since 6 December 2025, DENIC also wants a telephone number, a working email, and holder data that survives a risk check. "Open" does not mean "anonymous".

Many of these names never see a US backorder form. The names you want are on a local list, for a day.

Country domain extensions Google does not lock

A country-specific domain is a hard geo signal, until it isn't. Google's multi-regional site notes treat some vanity endings as generic. The list changes. Published there:

.ad, .ai, .as, .bz, .cc, .cd, .co, .dj, .fm, .io, .la, .me, .ms, .nu, .sc, .sr, .su, .tv, .tk, .ws.

.eu and .asia are regional. They are not one particular country. .de, .fr, .co.uk, .com.au and .us are not on the vanity list. You cannot point them at a different market and hope the ending shuts up.

Search Console used to offer a country switch for generic names. Do not build a plan on that toggle. It is gone. Language, hreflang, and the country of the links do the rest.

There is no separate internet country hiding behind a vanity string. The domain ending is either a country signal or a brand string. Pick before you register the domain.

Drop schedules when the domain expires

Three phases. Learn them once and you will stop bidding on names the old holder can still take back.

1. Grace. The registrar may still renew for the holder. On a lot of country zones this phase is short or missing.
2. Redemption or quarantine. Often only the last domain owner can restore. Everyone else waits.
3. Release. On .com this is five days of pending delete and a known hour. On country zones it is a daily file, a Wednesday session, or a first-come race the morning quarantine ends.

Domain renewal is not the .com clock

Until 9 February 2027, .uk follows Nominet's own cycle and a daily drop list. Treat the suspension as long, on the order of 90 days, not as Verisign's pending delete. On that February date the published lifecycle becomes 45 days of auto-renew grace, 30 days of redemption, and 5 days of pending delete. Old scripts will miss the week of the switch. Read Nominet before you renew the domain you just caught, and again before you backorder.

When a .de domain expires and is deleted, DENIC's 30-day redemption belongs to the previous holder only. After that, any DENIC member can register a domain. There is no public five-day fuse. You watch the redemption end date. A US drop catcher is the wrong tool.

auDA purges twice in the early afternoon Sydney time, about 1:00 p.m. and 1:30 p.m. Daylight saving moves the UTC hour by one. Eligibility is checked at registration and can be checked again on a transfer.

CIRA publishes the TBR list and releases .ca names on Wednesday. Catchers in 2026 quote early afternoon Eastern, and their own pages do not agree on the exact hour. Open the CIRA list the week you bid. Trust that clock, not a blog.

.nl sits in quarantine for about 40 days. SIDN has not allowed a privacy or proxy company to pose as the holder since October 2023. Reports through 2026 also put deletion the day before expiry. Confirm on SIDN before you pay. .fr is roughly 60 days from expiry to release, and eligibility still sits on top. .eu is a 40-day quarantine, then whoever is first and eligible.

.nz is the slow one in this set, with a redemption window cited around 90 days, plus a UDAI code on transfers. .in's release is not a clean daily stamp. Don't pretend every zone has a DomCop-style countdown.

ccTLD renewal is where portfolios quietly die. Renew your domain when the invoice shows up, not when the site goes dark. Some zones head toward quarantine with almost none of the .com grace you remember. Domain renewal reminders from a reseller are not the zone clock.

Where an expired domain actually sells

GoDaddy Auctions, DropCatch, NameJet, SnapNames and Dynadot are built for generic inventory. Use them for .com, and for vanity endings that ride a generic backend. You will not catch many ccTLDs from a US panel. They do not sit on Nominet's daily file or on CIRA's Wednesday session. If your backorder panel has no column for the local list, you are shopping the wrong room.

Local rooms, the ones that matter:

• .au: Drop.com.au and Netfleet.
• .ca: registrars inside the TBR session.
• .nl, .de, .be, .fr: European catchers such as Catched, plus registry members (Openprovider, INWX, and the local accredited ones).
• .uk: a UK registrar that ingests the daily drop file.
• .ru and .рф: REG.RU and RU-CENTER auctions.
• .pl: Aftermarket.pl and NASK registrars.
• Aged names that someone already caught: Sedo and Afternic.

ExpiredDomains.net is a domain search screen, not a seller. Filter to one zone. A single global removed-name file on 17 October 2026 held 269,961 names. Almost all of that is generic noise, not the country name you wanted.

Last spring a four-letter .nl came out of quarantine with 19 Dutch referring sites, club pages and a municipal page. Wayback still showed a sports club from 2011. The created date was the catch day. It never showed up on a US drop list. The local catcher had it for a day, and the close was under a contested .com backorder. That gap is the whole trade.

How to vet expired domains

One check, one decision. Stop at the first hard fail.

1. Eligibility. If you fail it, close the tab.
2. Archive. Five to ten years on archive.org. Same language as the SERP you want. A real site, or a rotating doorway?
3. Referring sites. Open them. Local editorial pages count. One footer repeated on 400 blogs does not.
4. Anchors. Brand and naked URLs are fine. A money anchor on every link is leftover from a blast.
5. Index. A site: query. A name that was pushed out and never returned is a different product from a name that simply lapsed.
6. Trademark. The local office, not only USPTO. DPMA, EUIPO, UKIPO, WIPO. Clean links still lose a dispute.
7. Old owner. Current WHOIS is often hidden. Pull historical WHOIS before you call it clean.
8. Topic distance. Expired-domain abuse, in Google's wording, is reviving a name only to rank something else, or redirecting it somewhere unrelated.

Ahrefs or Semrush shows the link and organic past. Wayback shows the pages. Spamhaus tells you if the address was listed. None of that knows the local trademark register. For a single pass over the same checks, use how to vet expired domains, then still open the archive yourself.

Aged domains are this same product after someone else took the drop risk. You pay more, and you still run the list above. A strong domain is a local link graph in the language you will publish, not a high third-party score on a name you are about to 301 across a border.

After the catch

Give the name one job.

• Local site. The clean use. Language, address, and links from that country. This is what the zone is for.
• Same-country satellite. Own pages, same niche as the old links, one outbound to your main local site. Not sitewide, and not on day one.
• Brand on a vanity ending. .io, .ai, .co, .me. You bought a string, not a country SERP.
• Redirect. Only inside the same country and language, only when no URL is worth rebuilding.

Rebuild beats a redirect when old URLs have links. Keep those paths. Write in the language of the links. Then add the offer. That is the version that still looks like a website to a rater and to a crawler.

The version that fails once you scale it: one host, several unrelated country zones, one registration pattern, a thin template, anchors pointed at a money page in another country. Add a dropped .ac.uk or .edu.au and you are not "grey". You are waiting on a registry ticket. Google does not have to do anything for the name to disappear.

Keeping a name you just caught

Pick the domain registrar that is actually accredited in that zone, not the cheapest global cart. A transfer of a country zone can demand an auth code plus ID that .com never asks for. If the gaining side cannot sponsor you, register a domain at a member who can, or don't start.

Domain privacy is not a universal switch. .nl wants the real holder. .de publishes company holder data and hides a natural person. A proxy on a zone that forbids it is a deletion reason, not a footprint.

New domain names in a strict zone should be bought only after the ID check is boring. The interesting aged name is the one you are allowed to hold on the renewal date, not only on day one.

Domain hacks, IDN ccTLDs, .edu and .gov

Domain hacks glue a word onto a country string: bit.ly, youtu.be, a brand cut out of .io or .ai. Fine as a product name. Fragile as the only asset. You inherit that registry's politics. .ly is Libya. Read the manager before the hack becomes the company.

An internationalized domain name is the non-Latin form, stored in punycode (xn--). An IDN ccTLD is the country zone in local script: .рф beside .ru, .中国 beside .cn. For a local audience that is a real signal. A homograph built to mimic a Latin brand gets delisted, and in some places it gets a lawyer. Certain country audiences live on the IDN string more than on the Latin one. Publish for them, or don't register it. Those script zones are a separate column in the root. Don't merge their metrics with the Latin twin.

.edu is a sponsored zone for accredited US colleges, run through EDUCAUSE. .gov is the US government zone under CISA. You will not buy either as an SEO asset. Under a country zone, .ac.uk, .edu.au, .gob.mx, .gouv.fr and .gov.uk are a second-level domain with institution rules. A university string in an auction is a trap unless you are that institution.

New extensions are the other pile in a domain extensions list: .shop, .xyz, .online, .site, and city strings such as .berlin or .london. Google treats those new strings as generic, including the city ones. They are not country targeting. .xyz spent years as spam stock. Use a new extension as a brand choice, not as a geo trick and not as cheap network grain.

Code top-level domain names in Google's own wording are the country-tied set. Everything else in a "new TLD" pitch is a generic product with a marketing budget. Keep them off this ccTLD list.

Retirement of ccTLDs

IANA retires a zone when the country or territory leaves ISO 3166-1. The retirement note sets a default of five years, with an extension cap of ten. .yu, .tp and .an are gone. .su is the leftover people still resolve: the Soviet code left the active ISO list and the zone was never fully switched off. Do not start a project on a suffix IANA has already marked. Old links to a retired ending just die.

Skip these for a money site or a small network: free zones with a spam history, any name you cannot personally qualify for, YMYL drops that were deindexed, and IDN lookalikes. Every ccTLD on the IANA list is not a candidate. Every country having a two-letter domain extension does not mean you have a business there.

Short answers people try to cite

What the two letters mean

A ccTLD is a country code used as the domain ending. The two-letter domain extension assigned to a specific country is the whole idea. The part of the domain that carries geo weight is that suffix, not the keyword you put in front of it.

Who runs the zone?

The ccTLD manager. IANA delegates. The domain industry talks about a global form as if it approved your .fr paperwork. It didn't. Domain name registrations in a country zone are a local contract. Domain registration is the contract with that manager.

Which names are worth a bid this month?

A unique domain with local editorial links, a clean archive in one language, eligibility you already meet, and a release date you can see. If any one of those is missing, it is not a deal. It is inventory.

Do I need a local address to register?

In specific countries, yes. In .de, .uk, .nl and .pl, no, with the data checks above. "No local address" still means your contact data must be real. DENIC can ask for someone in Germany to accept court papers. That is not the same rule as "Germans only", and the sloppy guides still mix them up.

What to do on Monday

1. Pick the country SERP first. Then the zone. Not the other way around.
2. Check eligibility for that specific domain before you look at link counts.
3. Get the drop source: Nominet's daily file, DENIC redemption end, auDA's Sydney purge, CIRA's Wednesday TBR, SIDN's quarantine exit.
4. Vet archive, links, anchors, index, local trademark.
5. Catch in the local room. Renew immediately. Rebuild in the old language, or don't redirect at all.

A country-code top-level name rewards the person who reads the registry PDF. It punishes the person who applies a .com checklist to every country and then wonders why the catch never arrived.

Figures cited from DENIC (31 Aug 2026 stock; 2025 foreign-holder share), SIDN stock reports around September 2026, Google's managing multi-regional sites documentation, IANA's retirement guide, and lifecycle notes from Nominet, DENIC, auDA, CIRA, EURid, AFNIC and SIDN. Re-check the week you bid.