What Is a .PAY Domain? Your Guide to Sunrise, TMCH, and Brand Protection

After sitting untouched in the internet’s root zone for nearly a decade, the .pay domain finally went live in 2026. .pay was one of the top-level domains Amazon picked up during ICANN’s original 2012 application round, then shelved for years while it rolled out sibling extensions like .bot, .deal, .fast, .talk, and .you. The .pay domain was always going to be the trickiest one to get right, and that shows in how it’s being handled: this is a domain extension that maps directly onto the word “payment,” which makes it a genuine branding opportunity — and, in the wrong hands, a serious reputational risk.

This guide walks through what a .pay domain actually is, who runs it, how the rollout calendar works, and — most importantly — how corporate brands can protect themselves during the process. We’ll cover TMCH, the SMD file, the Sunrise period, and pre-order options, using real dates and verified sources rather than the recycled summaries you’ll find elsewhere.

⚡ Quick Summary

• Extension: .pay
• Operator: Amazon Registry Services, Inc.
• Sunrise period: April 13 – July 20, 2026 (originally set to close May 13, then extended)
• General Availability: August 8, 2027
• Sunrise eligibility: A trademark registered with the TMCH, plus a valid SMD file
• Worth knowing: .pay is not covered by GlobalBlock or similar bulk domain-blocking services

Every date and figure in this guide is checked against official sources — IANA, ICANN, the TMCH, and Amazon Registry — listed in full under Sources at the end.

What Is a .PAY Domain?

A .pay domain is a top-level domain operated by Amazon Registry Services, built specifically for the payments, fintech, and e-commerce sectors. Sunrise registration closes on July 20, 2026, and General Availability opens on August 8, 2027.

.pay was created under ICANN’s new gTLD program and is technically open to anyone — it isn’t a restricted extension — but it’s purpose-built for payment service providers, fintech companies, digital wallets, and e-commerce platforms. Inside the industry, it gets grouped with “money domains,” the same family as .bank, .insurance, and .finance.

Functionally, a .pay domain works exactly like a .com: full DNSSEC support, and it’s perfectly usable for redirects, email, and web hosting. What’s different is what it signals. When someone sees “checkout.pay” or “yourbrand.pay,” they assume it’s connected to a real payment transaction — which is exactly why it’s such valuable brand real estate, and exactly why it’s such an attractive target for bad actors.

One nuance worth flagging: .pay registration is open to anyone, but during the early rollout phases, eligibility rules are layered and restrictive. We’ll break those down next.

Who Runs the .PAY Extension?

The sponsor and official operator is Amazon Registry Services, Inc., headquartered in Seattle, Washington. Nominet, the UK-based registry operator, handles the technical back end — a relationship confirmed in IANA’s official delegation records.

Here’s the interesting part: .pay was first delegated to the ICANN root zone back on July 21, 2016. For almost a decade, the extension technically existed but sat unused. Amazon rolled out several of its 2012-era extensions quickly, while holding others — .pay included — in reserve. That delay wasn’t an accident: an extension tied to “payments” carries fraud and impersonation risks that demand a far more cautious rollout than a typical gTLD. Amazon’s response was to layer in an extra restricted-registration phase beyond the standard Sunrise process, which we’ll get to shortly.

Why .PAY Matters for Fintech and E-Commerce

Payment-related domains are one of the most common targets for phishing attacks. A scammer who registers something like “yourbank-payments.pay” can run a far more convincing scam than with a typical .com lookalike, simply because the extension itself already implies “this is a payment page.” That turns defensive registration from a nice-to-have SEO play into a genuine brand and customer-safety issue.

This extension carries strategic weight for several groups in particular:

• Banks and other financial institutions
• Payment companies and digital wallet providers
• Fintech startups
• E-commerce platforms and major retail brands
• Trademark and IP attorneys handling defensive filings for clients
• Corporate IT and digital transformation teams
• Legal and compliance departments

Each group has its own reason to care: banks want to close off reputational risk, fintech startups see a fresh branding opportunity, and e-commerce brands are weighing the upside and the risk at the same time.

Here’s what that looks like in practice: if a customer searches for your brand and lands on “yourbrand.pay,” they’ll assume it’s yours — whether it actually is or not. The address itself already carries a trust signal, so most users skip the usual verification steps, like checking for an SSL certificate or confirming domain ownership. That makes .pay riskier than a typical typosquatting scheme: the attacker isn’t exploiting a misspelling, they’re exploiting what the extension itself implies.

The .PAY Launch Timeline

A new gTLD doesn’t launch on a single day — it rolls out in phases. .pay’s calendar is a bit different from a standard launch, and understanding that difference is the key to picking the right strategy.

Sunrise Period (April 13 – July 20, 2026)

Sunrise is the priority registration window open only to verified trademark holders. .pay’s Sunrise opened on April 13, 2026, and as of this writing in June 2026, it’s still running. It was originally scheduled to close on May 13, but the registry extended it to July 20, 2026 — so you have more runway than the original calendar suggested, though that window is now counting down for real.

One technical detail worth knowing: .pay runs on a “Start Date Sunrise” model. Most gTLD launches collect every Sunrise application and only run an auction at the end of the period if multiple parties want the same name. .pay works differently — first-come, first-served applies from day one. There’s no “I still have until the deadline” cushion here: if you want a high-value, generic, or short name, another trademark holder with a matching SMD file could beat you to it on any given day. Recent legal-industry coverage confirms this directly — competing applications go to whichever filer was first in time, full stop. This isn’t a guess; it’s the registry’s published rule.

After Sunrise: The Limited Registration Period (LRP)

This is the part most other guides skip, and it’s the most strategically important piece. .pay doesn’t move straight from Sunrise into open General Availability. In between sits a Limited Registration Period (LRP), open only to applicants who can attest they’re working with an approved payment service provider or third-party payment processor. The registry isn’t requiring upfront documentation during this phase — instead, it plans to catch false claims through spot checks and complaint-based reviews after the fact.

That has a real consequence for an ordinary e-commerce brand without an existing trademark: if you miss Sunrise and you’re not a payment provider yourself, the LRP isn’t your next opportunity — General Availability is. Current industry sources put the LRP’s closing date at a fixed February 1, 2027. Extending Sunrise pushed back when the LRP starts, but not when it ends, which means the LRP window has effectively shrunk to around six months.

General Availability (August 8, 2027)

On August 8, 2027, .pay opens up to general, first-come-first-served registration. That leaves roughly a thirteen-month gap after Sunrise closes — a long wait if you don’t hold a trademark or operate in payments. That gap might look unusually long at first glance, but multiple independent legal and industry sources confirm the date separately; it isn’t a typo, it’s a deliberately extended rollout schedule. That’s exactly why pre-ordering isn’t just a marketing gimmick — it’s a genuine strategic move.

What Is the TMCH?

The Trademark Clearinghouse (TMCH) is the global verification system ICANN set up so trademark owners can register their marks in one central database. It isn’t a domain marketplace — its only job is confirming that a trademark genuinely exists and who owns it, using a single standard that every new gTLD registry worldwide recognizes.

Registering with the TMCH doesn’t hand you a domain automatically — it gives you the right to participate in Sunrise periods and to use enforcement tools like Trademark Claims notices when needed. TMCH registration typically runs in 1-, 3-, or 5-year terms, and it stays valid across every new gTLD that launches during that period, not just .pay.

The length you choose is itself a strategic call. If your brand will need protection across more than just .pay — and new extensions keep launching — a 3- or 5-year registration saves you from re-filing every time. That’s also why the fee looks steep at first glance: you’re not paying for a one-time check, you’re paying into a verification infrastructure that thousands of registries rely on, kept current on your behalf.

What Is an SMD File?

Once your TMCH registration is approved, the system issues a digitally signed SMD (Signed Mark Data) file — essentially an encrypted credential proving your trademark has been verified.

When you file a Sunrise application, you upload that SMD file to your registrar. The registry’s systems — in this case, Amazon Registry’s infrastructure — validate it and assign the matching name to you. Without a valid SMD file, a Sunrise application is a non-starter; the system simply won’t accept it.

In practice, the SMD file arrives as an encrypted text file, and it’s reusable — you can apply the same file across Sunrise applications for different gTLD launches. Keep it secure: anyone who gets hold of it could file applications in your name without your knowledge.

Why a Local Trademark Isn’t Enough

Here’s the misconception we run into constantly: “I already have a registered trademark, so I’m covered.” Not quite. A national trademark registration — whether through the USPTO, EUIPO, Turkey’s TÜRKPATENT, or an international WIPO filing — proves your rights are protected in that jurisdiction. But ICANN’s Sunrise mechanism doesn’t recognize national registrations directly.

ICANN built the TMCH specifically because it can’t verify hundreds of different national trademark formats one by one. Your trademark can be globally recognized and still get you nowhere in .pay’s Sunrise period if it isn’t registered with the TMCH and backed by a valid SMD file. Your national registration is the foundation the TMCH application rests on, but it doesn’t substitute for it.

Think of it this way: your national trademark is like a valid ID card within your own country’s borders. The TMCH is the internationally recognized, digitally signed equivalent. You can’t get the second without the first, but the first alone won’t get you through the door during Sunrise.

How to Get a .PAY Domain

If you want to protect your brand or register a new .pay domain, you’ve got two real paths, and they’re not mutually exclusive — most corporate clients end up using both. Not sure where you stand? You can check your brand’s current status under .pay with our domain lookup tool.

Priority Registration via TMCH

If you hold a registered trademark, this is the safer route. The process generally breaks down like this:

1. Prepare your trademark certificate (USPTO, EUIPO, TÜRKPATENT, WIPO, or your relevant national office) and submit it to an authorized TMCH validation provider.
2. Once verified, receive the SMD file the system generates.
3. Attach that SMD file to your Sunrise application through your chosen ICANN-accredited registrar.
4. Wait for the registry to approve your application and assign the domain.

TMCH verification can take anywhere from a few business days to a couple of weeks depending on document type and jurisdiction, so don’t bank on the July 20, 2026 deadline and leave it to the last minute. Getting your application in during the first week of July gives you a real buffer against unexpected delays.

Reserving a Name with Pre-Order

If you don’t hold a trademark, your name is generic, or you’ve already missed Sunrise, you can still place a pre-order through an accredited registrar. That request gets submitted automatically the moment the relevant phase — LRP or General Availability — opens. One thing to keep in mind: the same “first come, first served” rule applies here too. A pre-order doesn’t guarantee you the name; it just makes sure your request goes out as fast as technically possible. Expect heavy competition the moment General Availability opens on August 8, 2027, with thousands of requests landing for popular names simultaneously, which makes your registrar’s submission speed part of the strategy too.

Common Sunrise Mistakes to Avoid

The mistakes we see most often in the field:

• Leaving TMCH verification to the last week. Verification can run long, and a rushed SMD file at the last minute can cost you the entire Sunrise window.
• Not checking whether your trademark actually qualifies. Descriptive or generic marks can get rejected by the TMCH outright — confirm your mark meets the distinctiveness bar before you apply.
• Protecting only the exact brand name and skipping variants. Bad-faith registrations usually show up as small variations — a hyphen added, an extra word — so protecting only the exact match leaves real gaps.
• Confusing the LRP with General Availability. Assuming you can apply during the LRP as a regular e-commerce brand without payment-provider status is a common and costly mistake; it can get your application rejected or revoked later.

One More Thing: .PAY Isn’t Covered by GlobalBlock

A lot of corporate brands lean on bulk-blocking services like GlobalBlock instead of registering defensively everywhere. Here’s the catch: like several of Amazon’s other recent extensions, .pay currently sits outside GlobalBlock’s coverage. That means your existing subscription doesn’t automatically protect your brand under .pay — you need a separate action for this extension specifically. It’s a detail most generic guides skip, but it matters if you actually want your brand covered.

Which Protection Strategy Is Right for You?

The right call depends on your trademark status, your budget, and your risk tolerance. Here’s how the two paths compare:

The general rule: if you hold a registered trademark and the name matters strategically, don’t let the Sunrise window pass you by. If you don’t have a trademark, or the name you want is generic, Pre-Order is your only real tool, and the earlier you get in line, the better your position.

Example Scenarios

The scenarios below are entirely hypothetical, meant only to illustrate strategic thinking — they don’t represent any actual brand’s real application.

A well-known apparel or e-commerce retailer: Say a globally recognized e-commerce brand holds a registered trademark. Even though the brand doesn’t process payments directly, a bad actor registering “brandname.pay” and using it for a fake checkout page would create a serious reputational risk. For this profile, the right move is straightforward: complete TMCH registration and file a defensive Sunrise application.

A major bank: Banks already run an intensive brand-protection program; the real risk with .pay specifically is customers mistaking “bankname.pay” for a genuine banking channel. TMCH registration is probably already in place — the missing piece is likely just a Sunrise filing that covers .pay.

A fintech startup: For a fast-growing payments startup without a registered trademark yet, the calculus is different. If the company genuinely operates as a payment service provider, it may still have a shot during the LRP even after missing Sunrise. If trademark registration is already underway, it makes sense to fast-track the TMCH application in parallel.

An e-commerce brand with a generic name: If the brand name is a generic, industry-standard term, a TMCH application will most likely get rejected, since the TMCH only accepts registered, distinctive trademarks. In that case, the only realistic path is placing a Pre-Order ahead of General Availability.

A trademark and IP law firm: For a firm managing defensive filings on behalf of dozens of corporate clients, the real challenge is tracking which client’s TMCH registration is current and which needs a fresh filing. For firms with large client portfolios, centralized TMCH management and portfolio-level Sunrise tracking is far more efficient than running each client’s process separately.

TMCH and .PAY Cost Table

The figures below reflect an illustrative pricing scenario. Actual prices — especially for premium or short-character domains — can shift based on current registry (Amazon Registry) and registrar policy; contact us directly for a firm quote.

TMCH fees typically bundle in trademark verification, SMD file generation, and ongoing Trademark Claims notifications for the registration term, so it’s not a one-off transaction — it’s an ongoing registration that represents your brand’s identity across the new gTLD ecosystem.

TMCH Registration Fees (Sample)

.PAY Pre-Order Examples (Illustrative)

Once General Availability opens, standard .pay registrations are expected to land in a similar range to other new gTLDs, roughly $30–45 a year, with premium and short-character names priced well above that.

Prices shown above are illustrative samples and may change without notice; check current availability and pricing for a specific name through our domain lookup tool or confirm directly with Atak Domain before registering.

Atak Domain’s Take

What’s surprised us most while tracking the .pay rollout is how it’s marketed as “just another Sunrise” when it’s actually a two-tier restriction in disguise. Most coverage assumes a straight jump from Sunrise to General Availability, but the Limited Registration Period in between creates close to a year-long wait for brands without a trademark or a payments business. Which brings us to our actual take: the “no rush, there’s time” mindset is far riskier here than with a typical gTLD launch. If your brand is trademarked and the name matters, don’t wait until August 2027 to decide — move now, while Sunrise is still open.

We’ve also noticed risk tolerance varies a lot by client profile. Large, multi-market brands with established governance processes tend to go straight for TMCH and Sunrise without much deliberation — for them, protecting brand reputation is worth far more than the registration fee. Smaller businesses with tighter budgets, or brands still mid-registration, are better served by Pre-Order; it doesn’t eliminate the risk entirely, but it’s a reasonable middle ground. Our advice: figure out which profile fits you and build your strategy around that, rather than trying to run both approaches “just in case” — that usually just inflates the budget for no real benefit.

Frequently Asked Questions

What exactly is a .pay domain?

.pay is a top-level domain created under ICANN’s new gTLD program, operated by Amazon Registry Services, and aimed at the payments, fintech, and e-commerce sectors. Anyone can register one, though different eligibility rules apply at different rollout phases.

Who operates the .pay extension?

Amazon Registry Services, Inc. is the sponsor and official operator. Nominet, headquartered in the UK, handles the registry’s technical operations.

When does the Sunrise period end?

Sunrise opened on April 13, 2026, and was originally set to close May 13, 2026, but has been extended to July 20, 2026.

If I apply during Sunrise, am I guaranteed the name I want?

No. .pay’s Sunrise runs on a first-come-first-served basis — if another trademark holder with a valid claim applies before you, you can lose the name even with your SMD file ready to go. Timing matters as much as eligibility.

What is the TMCH, and how do I register?

The Trademark Clearinghouse (TMCH) is the global database that verifies registered trademarks. You submit your trademark certificate through an authorized TMCH provider, and once approved, the system issues your SMD file.

Where do I get an SMD file?

It’s generated automatically once your TMCH registration is approved, and sent to you directly. You upload it to your registrar when filing a Sunrise application.

I already have a national trademark — why do I need to register with the TMCH too?

Because ICANN’s Sunrise mechanism doesn’t recognize national trademark offices individually; it relies on the TMCH as a single global verification standard instead. Your national registration is the foundation the TMCH application is built on, but it doesn’t replace it.

What happens if I miss the Sunrise period?

If you operate in payments, you may still have a shot during the Limited Registration Period (LRP) that follows. If not, your next real opportunity is General Availability on August 8, 2027, so it’s worth placing a Pre-Order now rather than waiting.

Is .pay only for payment companies?

No — technically, .pay is open to everyone. But during the early phases (Sunrise and LRP), access is limited to trademark holders or payment service providers. It becomes fully open with General Availability on August 8, 2027.

Does my GlobalBlock subscription automatically protect my brand on .pay?

No. Like several of Amazon’s other recent gTLDs, .pay falls outside GlobalBlock’s coverage. You’ll need a separate Sunrise application or defensive registration to protect your brand under this extension specifically.

How much does a .pay domain cost?

Standard registration fees at General Availability are expected to land in a similar range to other new gTLDs. TMCH registration fees and premium .pay pre-order pricing vary by term and name — contact Atak Domain for current, exact figures.

How can I tell if a .pay name is premium?

Premium status is usually determined by character length, whether the name is a generic or industry term, and historical demand for that name under other extensions. Short, memorable names, or ones tied directly to the concept of “payment,” are the most likely candidates for premium pricing. Your accredited registrar can run a pre-check to confirm.

Can a trademark or IP attorney register TMCH on behalf of multiple clients?

Yes. The TMCH system lets law firms and corporate consultancies manage multiple client trademarks under a single account — useful for firms juggling large client portfolios who want to track renewals and Sunrise filings from one dashboard instead of running each client’s process separately.

Can I transfer a .pay domain after registering it?

Yes. Once a .pay domain is registered, standard ICANN domain transfer rules apply, the same as with most other gTLDs. Any registry-specific restrictions tied to the Limited Registration Period would still need to be honored by the new registrant, so check the terms attached to your registration before transferring.

Does .pay support email and hosting like other domains?

Yes. Technically, a .pay domain works just like a .com or any other gTLD — it supports DNSSEC, email routing, and standard web hosting. The difference is purely in what the extension signals to visitors, not in its technical capability.

Can individuals register a .pay domain, or only businesses?

.pay is technically open to individuals as well as businesses. That said, during Sunrise and the LRP, eligibility is restricted to trademark holders or payment service providers, so most individual registrants will need to wait for General Availability on August 8, 2027.

The Bottom Line

After sitting unused for a decade, .pay is launching at exactly the right moment — digital trust in payments and fintech keeps growing in importance, and extensions built specifically for that space are becoming more valuable as a result. The real takeaway is recognizing that this rollout isn’t structured like a typical launch; it’s a two-tier process, and your strategy needs to reflect that. Sunrise is open right now and closes July 20, 2026; after that, if you don’t hold a trademark or operate in payments, your next real shot doesn’t come until August 2027.

Whether you need to protect your brand under .pay, complete your TMCH registration, prepare your SMD file, or lock in a Pre-Order ahead of General Availability, Atak Domain’s team handles the entire process so you don’t have to track deadlines, eligibility rules, or registry policy changes yourself. The Sunrise window is closing, and every day that passes is a day someone else could register your name first. Check your brand’s .pay status and let’s lock in the right strategy before time runs out.