Every so often a client asks whether their .io domain is about to vanish. It is a reasonable question with an unreasonable amount of noise around it. Here is the position as it actually stands.
Where the worry came from
.io is the country-code domain for the British Indian Ocean Territory. In May 2025 the UK and Mauritius signed an agreement transferring sovereignty over the Chagos Archipelago, with the UK retaining the Diego Garcia base on a long lease.
Country-code domains exist because of a list called ISO 3166-1, which assigns two-letter codes to territories. The logic ran: no territory, no code, no .io. Startups that had built their entire identity on a .io address understandably paid attention.
What has actually happened since
In April 2026 the UK government confirmed the agreement had become impossible to conclude at political level, after the consent required from the United States to amend the underlying 1966 arrangements was not forthcoming. The enabling legislation did not complete its passage. As matters stand, the treaty is not ratified.
And critically: IO remains in ISO 3166-1. Nothing has been removed. No retirement process has been started. ICANN’s own position, published in 2024, is that a change in sovereignty does not automatically mean a change to the domain.
What would have to happen — and how long it would take
Even in the scenario where sovereignty does transfer, the chain of events is long:
- The UN Statistics Division would have to update its country and area codes.
- The ISO 3166 Maintenance Agency would have to remove IO from the standard.
- Only then would IANA and ICANN begin a retirement process.
ICANN’s policy for retiring a country-code domain, adopted in 2022, sets a default wind-down of five years from notification, extendable to ten. That is the floor, not the ceiling.
What history says
The precedents are instructive, and they are all slower than people expect.
.yu— Yugoslavia broke up in 1992. The domain was removed in 2010. Eighteen years..tp— Portuguese Timor. Independence in 2002; removal in 2015. Thirteen years..an— Netherlands Antilles. Dissolved in 2010; removed around 2015. Five years..su— the Soviet Union. Removed from ISO 3166-1 in 1992. The retirement process was formally started in 2025, with a target of 2030. Thirty-three years and still running.
.su is the one to watch, because it is the live test of the modern policy — and it demonstrates that removal from the ISO list does not force anything to happen quickly.
The commercial reality
.io is not a curiosity. It carries over a million registrations and generated revenue in the tens of millions in 2024, growing rapidly. Its operator also took on the registry for Mauritius’s own .mu domain in early 2025 — which, whatever else it signals, is not the behaviour of a company expecting to lose the asset.
There is a great deal of money and a great many businesses pointing in the direction of .io continuing to exist.
So what should you actually do?
Not panic, and not migrate. But the episode is a useful prompt for some ordinary hygiene, which applies to any country-code domain tied to a small or contested territory:
- Own the boring equivalent. Register the
.comand.co.ukversion of your name. This is cheap, and it is good practice regardless of geopolitics. - Do not run business-critical email on a domain you would struggle to replace. Losing a website is inconvenient. Losing the address every invoice, contract and password reset goes to is a different order of problem.
- Keep DNS TTLs sensible so that if you ever do need to move quickly, you can.
- Know where the announcements would come from — ISO 3166-1 newsletters and IANA. Or let someone whose job it is watch for you.
The risk with .io is real but dormant, slow-moving, and heavily signposted if it ever wakes up. That is a very different thing from urgent.
Worried about a specific domain?
If your business depends on a country-code domain and you would like a straight answer about its exposure, ask us. We will tell you if there is nothing to worry about, which is usually the case.
Call 01202 835235 or email contact@domainwarden.co.uk.
Related: .co.uk vs .uk vs .com · domain portfolio audit