TLD checker
A domain ending in .cmo or .con is a typo, one ending in .local or .internal will never resolve on the internet, and one ending in .dev cannot be served over plain HTTP at all. Paste hostnames or URLs to sort them into valid, likely-typo, reserved and unknown — with the nearest real TLD suggested for each typo.
Summary
How to use
- Paste hostnames or full URLs, one per line. A bare hostname works — you do not need to add a scheme.
- Read the verdict column: valid, likely typo (with a suggestion), reserved (never resolvable publicly) or unknown.
- The detail column explains what the TLD is — country-code, original gTLD, generic — and adds warnings where they matter, such as HSTS-preloaded namespaces.
- For an authoritative check, open
data.iana.org/TLD/tlds-alpha-by-domain.txt, copy the whole thing, and paste it into the second box. The tool then validates against today's registry rather than a bundled snapshot. - Copy problem hostnames gives you just the lines that need attention.
What the bundled list covers, and what it does not
Bundled is every two-letter country-code TLD, all of the original generic TLDs, and several hundred of the widely used newer ones. It is not the full registry — there are roughly 1 400 delegated TLDs, most of them brand namespaces nobody outside the brand will ever type. So a verdict of unknown means "not in the bundled snapshot", not "invalid", and the tool says so in the detail column. If that distinction matters for your use, paste the IANA list; it is a 30 KB text file and the check becomes exact.
The typo detection does not depend on the list being complete. A TLD one edit away from a real one — .cmo, .con, .net split wrongly, .ogr — is reported as a likely typo with the suggestion, which catches the overwhelming majority of real-world domain errors: transposed letters in .com, a dropped letter in .info, a doubled one in .orgg.
Three categories worth knowing about
Reserved names that look like TLDs. .local is Multicast DNS (RFC 6762), .test, .invalid and .localhost are reserved by RFC 6761, .example by RFC 2606, and .onion by RFC 7686 for Tor. None will ever resolve publicly. .corp, .home, .lan and .mail were applied for and refused precisely because so much internal infrastructure already assumed them — and in 2024 ICANN reserved .internal for exactly this private-use purpose. If your internal hostnames use any of these, a certificate authority cannot issue you a public certificate for them.
HSTS-preloaded TLDs. .dev, .app, .page, .bank and .insurance are preloaded in browsers as HTTPS-only. Every browser upgrades http:// to https:// before the request leaves, and a self-signed or missing certificate produces an error the user cannot click through. This surprises people who used .dev for local development before Google bought the namespace in 2019 — .localhost or .test is the correct choice for that.
Punycode TLDs. A TLD beginning xn-- is an internationalised one — .рф, .中国, .السعودية. Valid, but worth flagging because a Punycode TLD in a list often means the whole domain needs decoding to be readable. The Punycode converter does that, and the homograph checker tells you whether it is impersonating something.
FAQ
Does a valid TLD mean the domain exists?
No. This checks the ending against the registry — whether somename.com is registered, parked or for sale needs a DNS or WHOIS lookup, which a browser tab cannot do. It answers "could this be a real domain", not "is it".
What about multi-part suffixes like .co.uk?
The TLD there is .uk; co.uk is a public suffix one level down. This tool validates the TLD. To split a hostname into subdomain, registrable domain and public suffix, use the domain / host extractor, which uses the Public Suffix List.
Why is a two-letter TLD I use flagged as unknown?
Very few are — the country-code list is complete. If it happens, check for a typo in the hostname, or that you have not caught a retired code: .yu, .cs, .zr, .an and .tp were all delegated once and have since been removed.
Is the list ever fetched from IANA automatically?
No — the file has no CORS header, so a browser cannot fetch it cross-origin. That is why pasting it is offered instead. Nothing you paste leaves the tab.