Originally published at https://monstadomains.com/blog/registry-level-domain-takedowns/
Your registrar is not the last line of defence for your domain. The registry above it is. In July 2026, two separate registry level domain takedowns proved that point in public. Telegram watched roughly a billion short links break in a matter of hours, and a single US state locked a website out of the .com zone without ever touching its registrar. Neither owner had done anything wrong at their registrar, and neither could fix the problem there. If you assumed that paying a reputable registrar keeps your domain safe, these registry level domain takedowns should change how you think about who really controls your name.
Telegram Loses A Billion Links Overnight
On 13 July 2026, the .me registry placed t.me, Telegram’s primary short link domain, on a status called serverHold. The domain vanished from the global DNS. Every t.me/username, channel link, and group invite stopped resolving in browsers worldwide. Telegram’s messaging core kept running, but the links that route roughly a billion users to public channels and profiles simply died. People scrambled to swap in telegram.me as a workaround while the outage rolled across every timezone.
The trigger was narrow and revealing. A 13 July designation from the US Office of Foreign Assets Control named a Ukraine based entity called First VPN Service and listed one Telegram channel, t.me/FirstVPNService, as an identifier. A single sanctioned address attached to the domain was enough. The registry, operated by Identity Digital, removed the entire domain from DNS rather than the one channel, and Telegram founder Pavel Durov publicly asked the registry for help restoring it.
Why telegram.me was the only escape
Telegram could not undo a serverHold from its own account, so it rerouted its apps to telegram.me, a name on a different registry. That is the whole story in miniature. When a registry acts, the owner’s fastest fix is to abandon the affected name and move on. Registry level domain takedowns do not leave you a support ticket you can win. They leave you hunting for another domain entirely.
Texas Locks A Domain Through Verisign
The Telegram outage was not an isolated glitch. Two weeks earlier, on 1 July 2026, Texas Attorney General Ken Paxton secured a court order directing Verisign, the operator of the .com registry, to lock the domain motherless.com. The site’s operator, Kick Online Entertainment, had ignored a Texas age verification law and a prior injunction. Rather than pursue the company, the state reached past it and past its registrar, straight to the registry that controls .com. It was the opening move in a fortnight of registry level domain takedowns.
The recovery terms show how heavy that lever is. To regain the domain, the operator must post a 9.14 million dollar bond, implement compliant age verification, and pay outstanding civil penalties. Whatever you think of the underlying site, the mechanism is the point. A state court told the .com registry to freeze a name, and it froze. That is the same class of action as the Telegram case, aimed at a different target for an entirely different reason.
How Registry Level Domain Takedowns Actually Work
Domains sit in a chain of control. You manage records at your registrar. Your registrar talks to the registry that runs the top level domain. The registry publishes the authoritative zone that the rest of the internet trusts. Registry level domain takedowns skip the first two layers and act at the top. The tool is an EPP status code called serverHold, which only the registry can set and only the registry can lift.
When serverHold is applied, the registry pulls the domain from the zone file. It no longer resolves anywhere, regardless of your DNS provider, your hosting, or your DNSSEC configuration. Public WHOIS and RDAP records for t.me showed the serverHold flag with a timestamp of 2026-07-13T19:24:55Z. There is no switch in your registrar dashboard that overrides it, because the block lives one full layer above your registrar.
Why your registrar cannot help
This is the hard truth behind registry level domain takedowns. Your registrar is your service provider, but it is not the authority over the zone. When a registry acts on a legal order or a compliance requirement, your registrar becomes a bystander. It can advocate for you, but it cannot reverse the status. That is exactly what left Telegram, with all of its resources, reaching for a second domain instead of a fix.
What These Registry Level Domain Takedowns Reveal
The Telegram case reveals how little it takes. A single channel named in a sanctions listing pulled an entire domain used by around a billion people out of DNS. The registry did not surgically remove the offending address. It removed the name. When compliance risk attaches to any part of a domain, the cheapest move for a registry is often to take down the whole thing and let the owner sort out the fallout.
The Texas case reveals the second lesson. Registry level domain takedowns are no longer only about sanctions or law enforcement in one country. A single US state used a court to reach a global registry. Both incidents landed at the registry layer within two weeks of each other, and in both, the registrant and the registrar were bypassed entirely. That is the shared signature of registry level domain takedowns. The block is total and the appeal is slow. Concentrating your identity, your brand, and your traffic in one domain is a demonstrated operational risk, not a theoretical one.
The Pattern Behind The July Enforcement Wave
According to Domain Name Wire, the t.me suspension was the second registry level action in a fortnight, following the Texas order against Verisign. Two different legal systems, two different registries, one mechanism. That clustering matters. It suggests registries are growing more comfortable using serverHold as an enforcement tool, and that courts and regulators have noticed how effective it is. These are the same registry level domain takedowns that once felt rare.
Digital rights groups have warned about this for years. The Electronic Frontier Foundation has long argued that registry level enforcement is a blunt instrument that silences far more than the targeted content. The July 2026 cases are textbook examples. A sanctions listing aimed at one VPN service knocked out a billion links, and an age verification dispute in Texas froze a .com name worldwide. The collateral radius of registry level domain takedowns is the entire domain, every single time. If you have watched lookalike domain attacks in the news, this is the same infrastructure fragility from the opposite direction.
How To Stay Resilient Against Registry Level Domain Takedowns
You cannot veto a registry, but you can reduce how much a single takedown costs you. Start by not routing your entire identity through one domain on one top level domain. Register defensive names on separate registries so a serverHold on one does not erase your reach. Telegram survived because telegram.me sat on a different registry, ready to absorb the traffic the moment t.me went dark.
Choose your top level domain with the registry operator in mind, not just the sticker price. Different registries answer to different jurisdictions and pressures. A ccTLD tied to one government behaves differently from a legacy gTLD. When you plan for registry level domain takedowns in advance, you spread that jurisdictional risk instead of concentrating it. Keep your contact details current and your account hardened so you at least hear about trouble early, and learn how to run a website anonymously if exposure is part of your threat model.
Finally, work with a registrar that treats your privacy and your resilience as the default. A registrar like MonstaDomains cannot lift a serverHold, but a privacy first one will not hand your data over at the first request and will help you plan around registry level domain takedowns rather than leaving you to discover them mid outage. If censorship resistance matters to you, weigh those factors before you buy, not after an outage teaches you the hard way.
Where This Leaves Domain Owners
Three things are clear after July 2026. Registry level domain takedowns are real, fast, and beyond your registrar’s control. A single flagged channel or one court order can remove a name that a billion people rely on. And the only durable defence is to avoid putting all of your presence behind one domain on one registry. Treat these registry level domain takedowns as a planning problem, not a rare accident that only happens to other people.
None of this means the situation is hopeless. It means you choose deliberately, spread your risk, and pick partners who share your priorities. If resilience and privacy matter to you, start with a privacy first domain registration and build outward from a name you actually control.
Top comments (0)