Buy .to Domain Name

No. The registry keeps the extension open worldwide and puts it plainly: a .to name works everywhere exactly as a .com name does. You do not need to be established in Tonga, to hold a company there, or to appoint a local representative, and no trustee service is involved. A company based in Türkiye, a sole trader and a private individual all register on the same terms. The data collected at registration is limited to first name, last name and email address, plus a company name for organisations. No identity copy, trade register extract or activity certificate is requested. Allocation is first come, first served for every name outside the registry's reserved list.

Through the registry's own channel the first registration runs for at least two years; on renewal the floor drops to one year and you may pick a one, two, three, five or ten year period. Through the registrar channel the term runs from one to ten years. Measurement confirms the ceiling: the registry's own names carry ten-year registrations. The term starts on the day of registration and ends on the same day of the same month in the expiring year, so your renewal date stays fixed in the calendar. A longer term means fewer renewal deadlines to track; a shorter one means keeping the reminder address current.

The chain after expiry is defined day by day. The name first enters an auto-renew window and can be renewed at the normal price until day 40, but on day 5 it is placed on hold and stops resolving, so your site and email go down while your right to renew is still running. On day 45 a 30-day redemption period begins, where recovering the name requires contacting support and may carry an extra fee. Day 75 opens a five-day pending-delete phase, and at the end of day 80 the name is released to the public again. Registrars may not warehouse expired .to names: they are routed to the auction platform the registry designates.

No, the personal fields are not published. The reason is not a privacy add-on but the way the registry is built: its policy has registrant details held by the registrar and never sent to the registry at all. Not holding the data, the registry cannot display it. A lookup returns the domain name, the creation and expiry dates, the registrar's details, the status codes and the name servers; name, address, telephone and email do not appear. Data access and erasure requests are directed to your registrar rather than the registry. You can check what is visible for a registered name on the whois search page.

There are two separate operations. A change of registrar follows the standard route: the transfer lock on the name is lifted, an authorisation code is issued and handed to the new provider. Measurement shows these locks are actively used on .to names, so unlocking is the first practical step. A change of holder works differently in the registry's own channel: the current holder generates a transfer key, the new holder uses that key to re-register the name in their own name, and the action counts as a new registration subject to new registration charges. Start on the domain transfer page.

The registry puts its limits on use rather than on who you are, and it is unusually blunt about it. It states that it revokes registrations it considers directly or indirectly responsible for distributing spam; phishing, wilful malware distribution, botnet command and control and fast-flux techniques are also on the prohibited list. One point deserves particular attention: names running free URL shortening or redirection services are singled out, and such a name can be suspended permanently once a legitimate phishing report arrives for a link under it. Trademark disputes run through ICANN's UDRP and rapid suspension procedures.

The registry refreshes the zone file from its customer database every six hours, so a new name starts resolving worldwide within a few hours at most. The critical detail is this: registering the name is not enough on its own, because without name servers defined the name never enters the zone file and the address stays dark. Completing the registration and the DNS setup in the same session is therefore the practical approach. One security limit is worth knowing too: although the zone is signed internally, the matching link is not published on the root side, so DNSSEC validation does not chain end to end in this extension.