DNS-over-HTTPS Defaulting User Trust Effects on Less-Known TLDs

As browser vendors and operating system developers increasingly implement DNS-over-HTTPS (DoH) as the default mechanism for domain name resolution, the implications for new and lesser-known top-level domains (TLDs) are growing more complex. DoH, which encrypts DNS queries within HTTPS traffic, is a security and privacy advancement that prevents third parties from passively monitoring or modifying DNS requests. However, the shift toward DoH defaulting also changes the trust architecture of domain resolution in subtle but consequential ways, particularly affecting visibility, performance, and legitimacy perceptions for newer gTLDs that lack widespread recognition or historical reputation in the broader internet ecosystem.

When users type a domain into their browser, the DNS query that resolves the domain name to an IP address historically passed in plaintext through their configured recursive resolver—often operated by an ISP. With DoH, those queries are encrypted and sent to designated DoH resolvers, such as those run by Mozilla’s Trusted Recursive Resolver (TRR) partners or Google’s Public DNS, depending on browser or device defaults. This shift introduces several dependencies that directly impact the discoverability and perceived legitimacy of less-established TLDs. For a new gTLD operator, inclusion in the root zone is no longer sufficient; visibility increasingly depends on whether major DoH resolver operators recognize, support, and resolve domains in that TLD without delay, blocklisting, or default redirection behavior.

Less-known TLDs—especially those launched after the 2012 round or in future application cycles—often suffer from low initial query volumes, which can be misinterpreted by automated threat detection algorithms as potential indicators of abuse or misuse. Large DoH resolvers employ filtering mechanisms to combat malware, botnets, and phishing domains, many of which operate under obscure or inexpensive TLDs. As a result, legitimate domains in small or niche TLDs risk being flagged incorrectly or delayed in propagation due to precautionary heuristics. Users encountering security warnings, blocked pages, or query timeouts for such domains are unlikely to differentiate between a DoH policy decision and actual domain insecurity—they will often assume the site is unsafe or untrustworthy.

This perception is particularly damaging for registries operating gTLDs targeting specific communities, industries, or geographic regions. For instance, a future gTLD like .farmersmarket or .coastaltech may serve a legitimate user base with high-quality content and strong abuse mitigation policies. However, if DoH resolvers default to conservative filtering, and those domains are rarely visited at the outset, their resolution could be deprioritized, flagged, or degraded. In the early weeks or months of operation, before reputation has been built and inclusion in resolver safelists is achieved, this technical barrier becomes a reputational one. Users conditioned by modern browser UI cues—such as lock icons, page load delays, or redirect warnings—may dismiss these domains outright, never revisiting them and undermining organic adoption efforts.

Moreover, DoH defaulting limits the ability of local or enterprise DNS configurations to override or tailor resolution policies. In environments where a new TLD is part of an internal deployment or localized identity strategy—such as a smart city using .metrogrid for IoT devices—DoH can bypass internal name resolution entirely, unless specifically configured to exempt or recognize those namespaces. This creates confusion and operational inconsistency, especially when default resolvers are located outside of the organizational control perimeter. For users in such environments, a .metrogrid domain that works inconsistently across networks may be perceived as unreliable, even if the fault lies with DoH policy, not DNS architecture.

To mitigate these challenges, new gTLD applicants and registry operators must proactively engage with DoH resolver operators prior to and immediately following delegation. This includes providing early notifications to entities like Google, Cloudflare, and Cisco OpenDNS about the intent and structure of the TLD, publishing authoritative DNSSEC-enabled zones, and supplying detailed abuse prevention documentation. Additionally, maintaining active communication with browser vendors—especially Mozilla and Chrome teams—can accelerate inclusion in internal allowlists and minimize misclassification.

Transparency dashboards, which some DoH resolvers provide to track TLD-level and domain-level behavior, can also be leveraged to identify false positives and address propagation delays. Registries must treat these tools not as optional diagnostics but as part of a new operational baseline for user trust. Furthermore, partnerships with hosting providers and CDNs that already integrate with DoH infrastructure can help ensure that second-level domains in the new TLD benefit from higher-resolution reliability from day one.

As more jurisdictions consider mandating DoH in public and educational networks, and as mobile OS platforms integrate it natively, these trust effects will become even more pronounced. TLDs that are not designed with proactive resolver engagement and reputation management will struggle to gain footholds, no matter how innovative their intended use. Conversely, gTLDs that anticipate these dynamics—embedding DoH compatibility, rapid abuse monitoring, and resolver relationship management into their launch strategies—stand a better chance of achieving both technical reachability and user trust.

In the long term, ICANN may need to revisit its evaluation and delegation processes to include compatibility checks with major DoH ecosystems, much like it currently addresses DNS stability and name collision risks. Similarly, community consensus around transparent resolver behavior—perhaps modeled after the DNS resolver operator framework—could improve predictability and trust for all stakeholders. Until then, applicants and registries must understand that in a DNS environment governed increasingly by encrypted-by-default behavior, trust is not only earned through policy and security posture, but also through seamless, invisible infrastructure performance. For the next wave of gTLDs, the pathway to success begins not just with a name, but with its ability to resolve consistently, confidently, and without hesitation in the encrypted age.

As browser vendors and operating system developers increasingly implement DNS-over-HTTPS (DoH) as the default mechanism for domain name resolution, the implications for new and lesser-known top-level domains (TLDs) are growing more complex. DoH, which encrypts DNS queries within HTTPS traffic, is a security and privacy advancement that prevents third parties from passively monitoring or modifying…