Did You Know TLDs Can Be Websites?

You've probably registered a domain with Route53 or another popular registrar.

You pick something like seanboult.dev, spin up a web server, configure your A record, attach a TLS cert, and boom it's live.

Well in the past, before the AI boom, there once was a web server on .ai and it made its way to Hacker News.

This was a cool relic that always intrigued me. Here is a snapshot from the Wayback Machine.

Now you're like wait, I can't go to http://ai today? No, sadly at some point the A record was removed and the web server was shut down.

Don't worry though, at the time of writing this I found another one.

Without further ado, here it is! https://uz.

Seems the TLS cert does not match the common name so you'll have to force your way in...

But then you're in!

So how does this work?

Well, the same way you can add an A record to the apex of your domain (such as example.com), a registry operator can add DNS records directly to the apex of a Top-Level Domain zone, such as .uz in this case.

Would love to know if you find more like this, leave a reply if you do.

If we ever did one on .aws what would you like to see there 🤔?

---

As always, happy coding 😉!

Follow AWS for more articles like this.

AWS Follow

Articles written by current and past AWS Developer Advocates to help people interested in building on AWS. Opinions are each author's own.

Follow me for all things tech

Sean BoultFollow

Developer. Hacker. Creator.

.

Comments

[Ben Halpern]

TIL

[Sean Boult AWS]

Yeah i was shook when i saw it posted on hacker news several years ago.

Obviously it extends more then just the web. My ambitious goal is to have email sean@aws one day and watch zero providers support it.

[Nazar Boyko]

The cert mismatch is what makes this a great demo, honestly. It shows exactly how much of "a domain works" is DNS and how much is everything else agreeing that the name is real. The A record is fine, the browser just has nowhere to put a single-label name.

[Esin Saribudak]

Wild, didn't think the Internet could get any weirder!

[Sean Boult AWS]

I thought weird is a reserved keyword for Austin 😂

[EmberNoGlow]

Author: put some command on the cover
Cybersecurity geeks: DO NOT ENTER COMMANDS YOU DON'T KNOW
Me 🔥:

Hmm, that command is clickbait 😭😭😭

[Sean Boult AWS]

yes and no, it used to work. I mentioned in the blog the .ai site was taken down for whatever reason.

This is what i found works as of writing this.

demo $ curl -v -s -k https://uz 2>&1 | rg "HTTP/1.1"
> GET / HTTP/1.1
< HTTP/1.1 200 OK

[EmberNoGlow]

The command you gave me didn't produce any results. I tried checking if the connection was working at all, but it didn't.

Later I found out, after checking the site on 8.8.8.8, your server DOESN'T WORK AT ALL

{
  "Status": 0 /* NOERROR */,
  "TC": false,
  "RD": true,
  "RA": true,
  "AD": true,
  "CD": false,
  "Question": [
    {
      "name": "uz.",
      "type": 1 /* A */
    }
  ],
  "Answer": [
    {
      "name": "uz.",
      "type": 1 /* A */,
      "TTL": 10441,
      "data": "91.212.89.8"
    }
  ]
}

[Hosein Mahmoudi]

it's interesting

[Sean Boult AWS]

Indeed. i love finding weird parts of the internet 😂.

[Leonid Svyatov]

Great find. On the .aws question at the end: you contractually can't. ICANN's New gTLD Program Committee resolved on 13 August 2013 that dotless names are prohibited, after SSAC's SAC053 recommended banning A/AAAA/MX at a TLD apex outright (announcement). That only binds ICANN-contracted TLDs though, which is exactly why .uz still gets away with it. RFC 7085 puts it plainly:

Many people have expressed a belief that ICANN prohibits all TLDs from being dotless. That belief is not true; ICANN's policies apply only to their contracted TLDs.

[Sean Boult AWS]

TIL, thanks for sharing!

[PubliFlow]

Good cloud patterns. For teams considering this architecture, I'd also recommend evaluating data residency and compliance implications early — retroactively adding encryption and access controls is significantly harder.

[PubliFlow]

Solid cloud architecture breakdown. One consideration that's becoming increasingly important is cost governance — implementing proper tagging, budget alerts, and right-sizing from the start prevents painful optimization sprints later.

[PubliFlow]

Nice cloud architecture write-up. One thing I'd add is the value of infrastructure-as-code testing — tools like Terratest or Pulumi's testing framework catch misconfigurations before they hit production.

[Sarvar Nadaf]

Cool Stuff!