DNS study finds many .do domains have no website

DNS, the Domain Name System that turns names such as example.do into internet addresses, sits at the centre of a new analysis of the Dominican Republic’s .do country domain. The study, published on CircleID and based on more than 41,000 .do domain names, found that a large share of registered names do not lead to a working website, including 61% in some categories examined.

The .do country-code top-level domain, or ccTLD (a two-letter internet ending assigned to a country or territory), is administered through nic.do by the Pontificia Universidad Católica Madre y Maestra. It includes second-level extensions such as .org, .sld, .web, .edu, .mil, .net, .gob, .gov, .com and .art. The study says there are now more than 46,000 registered .do domains, a figure described as more than four times many neighbouring Caribbean island ccTLD totals. To examine why so many names may have been registered, the author used a Domain-Monitor dataset of 41,140 names, representing about 96.76% of all .do registrations as of March 2026.

The analysis looked first at the structure of the names themselves. Length was treated as one clue: a short domain was defined as fewer than 4 characters, while a long one was defined as more than 15 characters, following a criterion inspired by Domain Name Statistics. Short names can be easier to remember and type, while longer names may be used to reflect an institution or brand more precisely. The study gives jce.gob.do as an example of a short institutional name and colegiobuenavista.edu.do as a longer name that more fully reflects an organisation’s identity.

Across the dataset, the mean .do domain length was 9.08 characters and the most common length was 7 characters. That points to a concentration around relatively short names, although longer names lift the average. The study says 64% of names classed as long did not have a properly configured web server. It gives santodomingoverde.gob.do as an example of a long name without a hosted website, suggesting that some such registrations may be used for brand or identity protection. Among short names, 52% did not host a website, a pattern the study links to possible domain speculation, meaning registration for possible resale or future use. It notes that 31% of short names were registered before 2020, compared with 30% of long names.

Numbers in domain names were another major focus. The study examined how many digits appeared in each name and which digits occurred most often. No analysed domain contained more than five digits, which the author interprets as a sign that registrants prefer shorter numerical strings for ease of use. Only two names contained five or more digits in the March 2026 data: 12345.do and 58099.do. According to the study, neither had A records or AAAA records (DNS records that point a name to IPv4 or IPv6 addresses) or MX records (DNS records used for email delivery). In practical terms, they were not set up for a website or email. WHOIS queries, which ask registration databases for administrative domain information, did not reveal registrant identities for those names, and both used Alibaba Cloud’s AliDNS name server infrastructure. The study says these signs make speculative registration likely, potentially with future international use in mind.

The digits 2, 4 and 8 appeared especially often. The study connects this to what it calls the semiotic use of numerals, where a number carries meaning beyond its mathematical value. A number may stand in for a word or sound, such as 2 suggesting “to” or “do” in English, or “tu” in Spanish, with 2espacio.do given as an example. The number 8 is also noted for its association with wealth in Chinese culture. The study says that many .do domains containing 8 are linked to websites aimed at Asian audiences, citing 8888.do as an example, and also mentions 56, 57 and 1024.do as similar cases of international use.

Operational checks were central to the findings. The study tested whether names resolved through DNS by looking for A and AAAA records, then checked whether web services answered on standard web ports 80 for HTTP and 443 for HTTPS. HTTP and HTTPS are the systems browsers use to load websites, with HTTPS adding encryption for the connection. It also examined web response codes, especially 200 responses, which mean a resource is available, and 3xx responses, which mean the visitor is being redirected elsewhere. For numerically composed names, the study found that 61% did not have a properly configured web server because they did not respond correctly to HTTPS requests. Another 4% did not have a properly configured IP address at all.

Not every inactive or unusual registration is suspicious. The study explicitly says privacy-protected WHOIS records and recent registration dates can be useful administrative signals, but do not by themselves prove malicious behaviour. Still, it notes that some numbered or mixed names may point to brand protection, such as natgeo1.do, while others may be associated with suspicious activity including possible phishing or typosquatting, with then0tl0u1s.com.do cited as an example. Phishing is an attempt to trick people into giving away information, and typosquatting means registering a lookalike address that relies on typing mistakes or visual confusion. Only 20% of numerically composed .do names were registered before 2020, which the study interprets as evidence that most of these are relatively recent digital identities.

The study also used Shannon entropy, a measure of how varied or random characters are in a name, to classify domain structure. It set high entropy at 3.5 or above, medium entropy below 3.5 and at least 1.5, and low entropy below 1.5. Low entropy, as in aaa.do, reflects repetition and low complexity. High entropy, as in dreamsvillasplayadelcarmenresortandspa.com.do, reflects greater variety and complexity. The study says both extremes can be associated with different uses, including speculation, brand protection or automatically generated names, including those produced by Domain Generation Algorithms, or DGAs, which are programs that create many domain names automatically.

The entropy results showed a mean of 2.60 bits, a median of 2.72 bits and a standard deviation of 0.61 bits. The study describes this as moderate-to-high randomness, consistent with acronyms and compound terms, many intended for domestic ccTLD use. A skewness value of -0.75 indicated more of a tail toward lower entropy names, and the most common entropy value was 1.58 bits. The study says this low-entropy subset may include names used for resale or international use. At the same time, an excess kurtosis value of 0.46 did not show a large share of extreme entropy values, which would otherwise have suggested more unusual patterns.

For domain owners, the practical lesson is simple: a registered name is not the same thing as a working, trustworthy web presence.