A window into TLD popularity and abuse
When the domain name system was first designed, Top-Level Domains were a short, fixed list meant to categorize the relatively small number of sites on the early internet. Forty years later, that list has grown past 1,400 entries and now includes country-code TLDs (.us, .pt), generic TLDs beyond the original seven (.biz, .shop, .nyc), Internationalized TLDs in non-Latin scripts, and brand TLDs such as .google and .nike. With another expansion round expected to start in April 2026, Cloudflare Radar is consolidating its TLD coverage onto a single page that ranks activity, highlights abuse patterns, and links directly to domain registration options.
The new TLD page sits under the DNS menu and draws on aggregated data from Cloudflare's 1.1.1.1 Public DNS Resolver, its cloud email security service, and Certificate Transparency logs. For each TLD, the page shows its type, delegation status, manager, and a popularity score, plus a link to a dedicated per-TLD page for delegated names.
Email and certificate signals
Radar previously scattered TLD insights across several datasets. An email security page introduced a "Most abused TLDs" view in March 2024, which ranks TLDs by their share of malicious and spam email. That analysis takes the sending domain's TLD from the From: header and weights it against traffic seen by Cloudflare's cloud email security service.
Certificate Transparency data, added during Birthday Week 2025, gives a complementary view of TLD activity.
That page includes a certificate coverage section showing how pre-certificates are distributed across the top 10 TLDs, which reflects how much effort is going into securing web traffic for names under each suffix.
Ranking by DNS Magnitude
The core of the new page is a ranking based on DNS Magnitude, a metric developed by nic.at that estimates a TLD's internet-wide visibility. Rather than raw query counts, which a single busy client can skew, Magnitude measures how many distinct networks query a TLD. Cloudflare aggregates individual client IP addresses into subnets, and scores range from 0 to 10, where a higher score means queries come from a broader range of networks.
$$Magnitude=\frac{ln(unique\ networks\ querying\ the\ TLD)}{ln(all\ unique\ networks)}*10$$
The ranking table lists the top 2,500 TLDs with their type, status (delegated vs. non-delegated), manager, and magnitude value. Types are broken down as:
- gTLD (generic TLD): general-purpose suffixes such as
.comand.info. - grTLD (generic restricted TLD): limited to specific communities or uses, such as
.name. - ccTLD (country code TLD): assigned to countries or territories, such as
.ukor.jp. - iTLD (infrastructure TLD): reserved for technical infrastructure, such as
.arpa. - sTLD (sponsored TLD): run by a sponsoring organization for a defined community, such as
.eduor.gov.
Non-delegated entries are names that are not currently in the public DNS root zone. Magnitude also carries a cautionary note: a high value can signal wider name collision risk, where private namespace usage of a non-delegated TLD leaks queries into the public DNS.
The leaderboard includes the usual suspects — .com, .net, .org — alongside commercially repurposed ccTLDs like .io, .co, and .tv. But the number one spot belongs to a legacy suffix: .su, delegated for the Soviet Union in 1990. Its use declined after the USSR dissolved, and ICANN has reportedly slated it for retirement in 2030.
Over a single day, .su does not top the ranking by unique networks. But over a seven-day window it sees queries from more distinct networks than any other TLD, driven by traffic to a popular online world-building game. More than half of those queries originate in the United States, Germany, and Brazil.
Individual TLD pages
Clicking any TLD in the DNS Magnitude table—or searching for one directly—opens a dedicated page for that TLD. These pages are limited to delegated TLDs; non-delegated TLDs appear in the ranking but have no individual page. Delegation data, including TLD type and manager, comes from the IANA Root Zone Database.
Each TLD page leads with two main cards. The first summarizes general properties: type, manager, DNS magnitude value, DNSSEC support, and RDAP support. DNSSEC support is checked by looking for a Delegation Signer (DS) record in the root zone, and the record is parsed to identify the associated DNSSEC algorithm. RDAP support is shown when the TLD appears in the IANA RDAP bootstrap file. The second card holds WHOIS information: creation date, last update, and nameserver list. If Cloudflare Registrar supports the TLD, an extra card provides direct registration options; the registrar currently covers more than 400 TLDs.
Below the cards, a DNS query volume section shows activity for domains under the TLD based on traffic to Cloudflare's 1.1.1.1 resolver. A line chart tracks queries over the selected time frame, while donut charts break down queries by type, response code, and DNSSEC support. A choropleth map shows the geographic distribution of queries by country.
Each TLD page also includes a Certificate Transparency section. A line chart displays total certificate issuance over the selected period, alongside a donut chart showing issuance share among the top certificate authorities.
Broadening the DNS view
The DNS page launched earlier in 2025 with query volumes by ccTLD. That dataset now covers all delegated TLDs, and a new "Top-level domain distribution" section has been added to the DNS page. It includes a line chart showing query share across the top 10 TLDs and a table extending that ranking to the top 100. Unsurprisingly, .com leads with over 60% of queries, followed by .net, .arpa (an infrastructure TLD), and .org.
Both Radar search and the API accept non-ASCII TLDs in punycode (A-Label/ASCII-Label) and internationalized domain name (U-Label/UNICODE-Label) forms. For example, the South Korean TLD .kr can be referenced as xn--3e0b707e (A-Label) or 한국 (U-Label).
Next steps for TLD data
TLD name servers carry billions of daily queries, so their performance matters. In 2026, Radar's TLD pages will add latency and responsiveness insights for these name servers. That data will give TLD managers an external view of query performance, and help developers and site owners assess name server reliability before registering new domains.
The full dataset behind these pages is exposed through the Radar API, and can be explored interactively in the Data Explorer and AI Assistant. All Radar charts are downloadable and embeddable for external use.
