.gov

Generic top-level domain

RDAP + WHOISrestricted Government & Politics

Register: —first year
Renew: —a year
Transfer: —to move it
Registrars: —quoting it
Lookup: RDAP + WHOISanswers for it
DNSSEC: Signed1 DS record in the root
Level: Secondmybrand.gov

Check a name

One command, straight against the registry — no account, no page to load.

Name

Fills the command and the registrar links below in with your own name. The page is static — nothing is looked up here, and nothing you type leaves the browser.

ds mybrand --tld gov

Add --where for the registrars and the registry's rules, --registry for the server that answered, or --all-info for everything at once.

What it costs

No registrar in the price table bundled with ds quotes .gov, so the CLI prints no figure beside it — one of 927 such TLDs. That is a gap in the table as often as it is a TLD nobody sells. See Prices for supplying your own table with --pricing-file.

Who can register

US government only: federal, state, local and tribal government organisations.
get.gov

Availability and eligibility are different questions, and ds answers the first: a name here reported AVAILABLE means the label is free, not that this registry will sell it to you. The note is hand-maintained and was last checked on 2026-09-02; the registry page it links to, not this one, is the authority. All 81 restricted TLDs, under 27 rules, are listed on Who can register.

How `ds` answers for it

RDAP first, WHOIS second — the same order for every TLD. .gov has both, so RDAP answers and WHOIS is the fallback if it does not.

RDAP: https://rdap.nic.gov/rdapFrom IANA's bootstrap, refreshed when this page was built. The lookup is https://rdap.nic.gov/rdap/domain/mybrand.gov — a 404 means the name is free.
WHOIS: whois.nic.govQueried on port 43, from the bundled whois.json. The name is called free when the reply contains No match for — text matching, which is why RDAP is preferred where it exists.

ds mybrand --tld gov --registry prints whichever of these answered. If a bundled WHOIS host has gone stale, IANA is asked who serves .gov today. See Accuracy notes.

The registry

From IANA's delegation record for .gov. .gov is a sponsored TLD.

Run by: Cybersecurity and Infrastructure Security AgencyBased in United States of America. Delegated 1985-01-01, record last updated 2026-08-04.
Registry site: get.govWhere the registry documents .gov — its rules, its accredited registrars, and any launch phases. Not a shop: registries sell wholesale to registrars, not to you.
Published services: rdap.nic.gov · whois.nic.govWhat the registry itself tells IANA it runs. They agree with what ds asks.
Name servers: a.ns.govb.ns.govc.ns.govd.ns.govThe 4 authoritative servers for the .gov zone — what the root delegates to. Nothing ds queries directly; they are what makes a registered name resolve.

What it is

Derived from the root zone and ICANN's registry list — each one is a fact with a source.

sponsored IANA Root Zone Database types it "sponsored"

What it is for

Our reading, not a fact — nothing in the root zone says what a TLD means. Hand-maintained in tld-categories.json.

Government & Politics The public sector, the armed forces, and elections.

In the root zone

The delegation itself, read out of the root zone — serial 2026090900, on 2026-09-09. The registry section above is IANA's record of what .gov was delegated to; this is what the root actually answers with when a resolver asks it where .gov lives.

Delegated to: a.ns.gov199.33.230.12001:503:ff40::1
b.ns.gov199.33.231.12001:503:ff41::1
c.ns.gov199.33.232.12001:503:ff42::1
d.ns.gov199.33.233.12001:503:ff43::1
The 4 name servers the root hands out for .gov, with the glue addresses that come with them — every one of them answers over IPv6. None of this is what ds queries: these servers know which names exist, not who registered them.
DNSSEC: Signed — 1 DS record in the root
key 2536ECDSA P-256/SHA-256 · SHA-2560BAF26B7BBF313A859046FD3B1EE49DDFBA33934CFB3E717C21E2A2935C2F259
Each one is a fingerprint of .gov's own signing key, published by the root and signed with the root's key — which is how a resolver that trusts only one key can prove an answer under .gov came from its registry and was not tampered with in transit. It says nothing about who owns a name or whether one is free.

Ask the root yourself — no registry involved, and the same records this section was built from: dig +norec @a.root-servers.net gov. NS and dig +norec @a.root-servers.net gov. DS.