Is .io Safe? The Chagos Situation, Explained Properly
The UK agreed to hand the territory behind .io to Mauritius, and a wave of articles announced the death of the extension. Two years later .io is operating normally, the treaty has stalled, and the real timeline is nothing like the headlines.
September 21, 20266 min readTLDs · ccTLD · io
The short answer. As of September 2026, .io is operating completely normally. IO remains an assigned ISO 3166-1 code, the registry is accepting registrations and renewals, and ICANN has issued no retirement notice. The treaty that triggered the panic has not been ratified. Even in the worst realistic case, retirement would take five to ten years and come with a long transition. Using .io today is a reasonable decision.
What actually happened
.io is a country-code extension. Country codes are not invented by ICANN, they are drawn from the ISO 3166-1 list of country codes. The IO code belongs to the British Indian Ocean Territory.
In October 2024 the United Kingdom and Mauritius announced a political agreement to transfer sovereignty over the Chagos Archipelago, which makes up that territory, to Mauritius. A treaty followed on 22 May 2025.
The reasoning that produced the headlines was straightforward: if the territory ceases to exist as a separate entity, the IO code could be withdrawn from ISO 3166-1, and a ccTLD whose code is withdrawn is eventually retired from the DNS root.
That chain is real. Every link in it is also slower and less certain than the coverage suggested.
Where it stands now
.io is fully operational. Registrations, renewals and transfers all work normally. Nothing about holding a .io today is degraded.
IO is still in ISO 3166-1. The code has not been withdrawn. This is the trigger for everything else, and it has not been pulled.
ICANN has issued no retirement notice. There is no timetable, because there is nothing yet to start one.
The treaty has stalled. The UK ran out of parliamentary time to pass the legislation approving it in the current session, and no successor bill is planned. Reporting attributes the delay in part to the US administration withholding formal written consent.
So the situation that produced two years of "the end of .io" articles has, so far, not progressed to the point where anything can happen.
The three possible outcomes
Domain Incite's analysis sets out the realistic branches.
1. The code survives unchanged. Mauritius takes sovereignty, the territory keeps a listing, and the two-letter code stays IO. Nothing happens to .io at all. This outcome requires no action from anyone holding a .io.
2. The code changes. The territory keeps a listing but under a different two-letter code. The old ccTLD is retired and replaced, on a timeline measured in five to ten years, with a transition period.
3. The listing disappears. Chagos stops being recognised as a separate entity for statistical purposes, the code is withdrawn, and retirement follows. Again five to ten years.
Two of the three involve no change for years, and the third involves no change either until a formal process starts that has not started.
Why retirement is slow
ICANN's process for retiring a ccTLD is deliberately drawn out. Once a code leaves ISO 3166-1, there is a defined wind-down with notice periods, registrant communication and a transition window running for several years.
The reason is obvious once stated: extensions have millions of registrations belonging to businesses, and pulling one abruptly would break a meaningful part of the internet. Nobody involved wants that, including the registry operator, whose business it is.
.io is also not a marginal extension. It has substantial commercial adoption, particularly among technology companies, which creates significant pressure toward outcome one or a long, orderly version of the others.
The practical translation: if the worst case begins, you will have years of notice, not weeks. That is a very different risk profile from the one the headlines implied.
Should you use .io?
It is fine for a technology product, a developer tool, a side project, or anything where the .com is unavailable and the audience is technically literate. The realistic risk over a normal product lifetime is low.
Think harder if you are building something intended to run for decades under the same name, if rebranding would be catastrophic, or if you would find it hard to explain the situation to an investor who read one of the articles.
The genuine costs of .io have nothing to do with Chagos, and they are worth weighing:
- Price. .io is one of the more expensive common extensions, and the spread between registrars is wide. Over five years a single .io runs from roughly $235 to $332 depending purely on where you register it.
- The .com assumption. People will type the .com by default, whatever you print.
- Renewal cliffs. Several registrars sell .io cheaply in year one and renew at double or more.
We compared all of that in The Cheapest Domain Registrar in 2026, and the wider extension question in The Best Domain Extensions to Choose in 2026.
If you hold .io domains
Do not panic sell. The market already priced this story twice and .io values did not collapse.
Do monitor the situation rather than re-reading 2024 articles. The signal to watch is not treaty news, it is whether IO leaves ISO 3166-1. Nothing before that matters operationally.
Consider securing the .com of your name if it is available and affordable, purely as optionality. That is sensible regardless of ccTLD politics.
Keep renewals current. The most likely way you lose a .io in the next five years is still an expired credit card, not geopolitics.
Common questions
Is .io going away?
Not currently. IO remains an assigned ISO 3166-1 code, the registry operates normally, and ICANN has issued no retirement notice. The treaty that could eventually start that process has not been ratified.
What happens to .io if the Chagos treaty completes?
It depends on whether the territory keeps a listing and whether its two-letter code changes. In the outcomes where .io is eventually retired, the process would run five to ten years with a transition period.
Should I move off .io?
For most projects, no. The risk over a typical product lifetime is low and any retirement would come with years of notice. Reconsider only if your name must survive unchanged for decades.
Why is .io associated with tech companies?
Because io reads as input/output, which made it attractive to developers, and because it was widely available when short .com names were not. The association is cultural rather than technical.
Is .io expensive?
Relative to .com, yes. Over five years a .io typically costs several times a .com, and the difference between the cheapest and most expensive registrar is around $100 for the same domain.
What is the actual signal to watch?
Whether IO is withdrawn from ISO 3166-1. That is the trigger for everything downstream. Treaty coverage before that point does not change anything operationally.
Put the research to work.
Check your shortlist across the extensions that matter, then save the strongest names to a project.
Check a domain