Tomorrow, ICANN opens its first new gTLD (Generic Top-Level Domain) application window in 14 years.
Quick question for every university president, CIO, and general counsel:
Who actually owns .edu?
Hint: not your university.
.edu is operated by EDUCAUSE — a Boulder-based nonprofit — under a cooperative agreement with the U.S. Department of Commerce.
EDUCAUSE holds the master record for
harvard.edu,
stanford.edu,
princeton.edu,
ucla.edu — every one of the 7,000-plus accredited four-year institutions permitted under the .edu charter.
During the 2012 application round — the first of its kind in DNS history — MIT filed to operate its own top-level domain.
.mit. Application accepted. Registry agreement signed 2 July 2015. Delegation to the root zone on 6 July 2016. Backend operated by Afilias. Eligibility hard-restricted to MIT schools, departments, laboratories, research centers, and academicians.
The argument for moving early wrote itself into the news cycle.
⚠️ In January 2013, MIT was attacked. Domain industry reporting at the time traced the intrusion path through compromised EDUCAUSE systems.
The next month, EDUCAUSE itself disclosed a server breach. Hashed passwords for the administrative, technical, and billing contacts of every .edu domain in America were potentially exposed.
Within .mit, neither breach scenario applies. The registration policy is written and enforced by MIT itself. No outside registrar can sell
ai-faculty.mit to a degree mill operating from another jurisdiction. No third-party registry compromise can dump credentials for the institution's namespace. The master record lives at 77 Massachusetts Avenue.
That was a decade ago.
The threat surface around higher education has gone from concerning to apocalyptic since.
Quorum Cyber's 2026 Global Cyber Risk Outlook for Higher Education recorded 425 cyber incidents at universities between November 2024 and October 2025 — a 63% jump year over year. Phishing alone accounted for 34% of ransomware incidents in the sector.
In April 2025, a coordinated phishing campaign breached 18 U.S. universities — including UC Santa Cruz, UC Santa Barbara, the University of San Diego, Virginia Commonwealth, and the University of Michigan — by stealing session cookies after multi-factor authentication had already cleared.
In March 2025, Microsoft tracked attackers who hijacked 11 accounts at three schools and used those accounts to send phishing to nearly 6,000 inboxes across 25 universities.
A pattern surfaces.
When an institution's identity lives inside someone else's namespace, that institution's identity is only as secure as the operator's worst day.
A diploma is the most trusted non-governmental credential a human being can hold. Universities issue them daily on domains they do not actually operate.
ICANN's window opens tomorrow, 30 April 2026, and closes 12 August 2026. 105 days. The previous window closed in 2012.
Board approval, string evaluation, registry infrastructure planning, financial modelling, public-interest commitments — each takes weeks. By day one of the window, the schools that will ultimately succeed are already months into preparation.
Unregistry runs the full applicant track end-to-end: ICANN filing, legal counsel coordination, registry back-end, compliance, registrar integration, delegation-day launch. The institution holds one contract, not five.
Does your university own its namespace? Reply with your school.