Google is launching .app domains, the first top-level domains secured with built-in HTTPS, to its Early Access Program on May 7 and to all on May 8
Over three years after Google paid $25 million to gain the exclusive rights to the “.app” top-level domain, the company …
Context & Ripple Effects
Google's .app launch closes the loop on its $25 million acquisition of the top-level domain in 2015 — the most expensive TLD sale to date — and the company is differentiating it the same way it later did with .dev: HTTPS is enforced at the registry level, not left to each site owner. The two-day staggered rollout, Early Access on May 7 then open registration May 8, follows the premium-pricing playbook Google has used across its domain portfolio.
The move lands amid a broader encryption push from Google, which had already committed to encrypting the vast majority of ads on its platforms by mid-2015; .app extends that posture from Google's own properties to the namespace itself.
First-order effects
- Anyone registering a .app domain is forced to serve traffic over HTTPS from day one — no HTTP fallback — making certificate provisioning a prerequisite rather than an afterthought for developers and companies buying the name.
- Early Access participants pay a premium for first pick of names before general availability on May 8, giving Google immediate registry revenue from squatters and brand owners.
Second-order effects
- Certificate authorities and hosting providers gain a built-in demand stream, since every .app registrant needs TLS certificates and HTTPS configuration support.
- Other TLD operators face pressure to match security-by-default or cede the developer market to Google's secured endings, a template the company extended with its .dev launch with built-in security the following year.
Third-order effects
- If secured TLDs become the norm, the registry itself becomes a security-policy enforcement point — shifting part of web-safety responsibility from individual site operators to whoever controls the namespace, with Google holding several of the highest-profile strings.
- Google's string of launches (.app, .dev, .new) points toward domain portfolios being run as product lines inside one registrar ecosystem, consolidating naming, hosting, and identity around a single vendor.
The trend: Top-level domains are evolving from neutral address space into security-enforced products, with Google using exclusive registry rights to bake HTTPS into the namespace itself.