Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Apparently it's a URL shortener. It resolves just fine in Chrome and Firefox. How is this a valid top-level domain?

Update: for the people saying it's browser shenanigans, why is it that: http://com./ does not take me to:

And, do browsers ever send you a response from some place other than what's actually up in the address bar? Aside from framesets and things like that, I thought browsers tried really hard to send you content only from the site in the address bar, to help guard against phishing.

share|improve this question
Slashdot wasn't fast enough to bring it down apparently. – badp Dec 3 '09 at 19:06
Seems like these days general availability of bandwidth is increasing disproportionately with slashdot's readership... – Chris Dec 3 '09 at 19:11
Also note that http://to. yields a different website than (the latter being the same as If one is seeing the same for the two URLs then the browser is indeed messing up, and is probably showing for both... – Arjan Dec 13 '09 at 17:16
I just noticed today that to no longer works. Sad face. One that does still work is ac but that just serves the [][1] website. [1]: – Marcel Apr 8 '11 at 23:03

22 Answers 22

up vote 44 down vote accepted

Basically, someone has managed to convince the owners of the ccTLD 'to.' (Tonga?) to assign the A record to their own IP address. Quite a coup in the strange old world of URL shorteners.

Normally these top-levels would not have IP addresses assigned via a standard A record, but there is nothing to say that the same could not be done to .uk, .com, .eu, etc.

Strictly speaking there is no reason to have the '.' specified, though it should prevent your browser from trying other combinations like '' first, and speed up the resolution of the address. It might also confuse browsers, as there is no dot, but Safari at least seems to work ok with it.

share|improve this answer
Does this mean that, with the right access (however unlikely), someone could set up a web site on the very root "." itself? – Chris Dec 3 '09 at 18:43
Chris: Yes, it's perfectly possible. – xmm0 Dec 3 '09 at 18:47
Exactly. That's why n@ai is a valid email address. – Pridkett Dec 3 '09 at 19:28
It would have to be "http://." – chris Dec 3 '09 at 21:09
Or for content http://./index.html – chris Dec 3 '09 at 21:09

"to" (the country TLD for Tonga) is the entire domain for the site - there's no browser trickery:

$ telnet to 80
Connected to to.
Escape character is '^]'.
GET / HTTP/1.1
Host: to

HTTP/1.1 200 OK
Date: Thu, 03 Dec 2009 18:34:04 GMT
Server: Apache/1.3.27 (Unix)  (Red-Hat/Linux) mod_perl/1.26
Transfer-Encoding: chunked
Content-Type: text/html; charset=ISO-8859-1

<!DOCTYPE html
    PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
<html xmlns="" lang="en-US" xml:lang="en-US">
<title>TO. -- Get Shorty URL</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<form method="post" action="/" enctype="multipart/form-data">
<table><tr><td>Enter a long URL:</td> <td><input type="text" name="url"  size="50" /></td></tr><tr><td>Enter an optional name:</td> <td><input type="text" name="name"  size="20" /></td></tr><tr><td>&nbsp</td> <td><input type="submit" name="&#39;Witz that URL!" value="&#39;Witz that URL!" /></td></tr></table></form>

Connection closed by foreign host.

The reason why it's a good idea to use "http://to./" is because some browsers will try to convert "to" into "" in the address bar.

share|improve this answer
Am I the only one that got confused by "$ telnet to 80" for just a few seconds? – Belmin Fernandez Nov 19 '10 at 21:55

Any DNS zone can have any DNS record for that zone itself (in a bind configuration file, this record is labeled with an @). Actually -- let me ask this -- can the root zone have an @ to describe itself? IE can @ have an address record? I don't see why it couldn't. that would be a cool address to have. "http://./"

The "Root" zone is simply a zone named ".". At the moment, that zone has a bunch of name servers. The addresses of these name servers are distributed as a text file. This text file or something similar is manually entered into many typical recursive name servers.

Placing a "." at the end of a name tells your local resolver that the name you have entered a "fully qualified" domain name, meaning it is exactly and only the name you wish to look up. Often, we use unqualified or otherwise ambiguous names such as "www" to mean "" where your local DNS resolver has "" as the "dns domain" or "search domain".

These root level domain servers have a list of "top level" domains which map roughly to old abstractions of how researchers in the 80s thought the internet would be used and countries, and a top level domain for "infrastructure". Each of these top level domains has a bunch of name servers that have lists of actual zones in that domain, so a request for first goes to a root level server which passes out a list of name servers that know about .com, and when asked, one of those knows about which name server has records for, and one of those knows the specific record for

So, all you need to do is convince whoever runs the TLD for a country or organization to put in an address record for .zone instead of just and you're golden.

At present, the following top level domains have address records (not all run web servers, though)

ac has address
ai has address
bi has address
cm has address
dk has address
gg has address
hk has address
io has address
je has address
ph has address
pn has address
pw has address
sh has address
tk has address
tm has address
to has address
uz has address
ws has address

and the following have mx records (so user@TLD. is a potentially deliverable address)

ai mail is handled by 10
as mail is handled by 10
cf mail is handled by 10
dj mail is handled by 5
dj mail is handled by 5
dm mail is handled by 10
gp mail is handled by 20
gp mail is handled by 5
gp mail is handled by 10
gt mail is handled by 10
hr mail is handled by 10
io mail is handled by 10
kh mail is handled by 10
km mail is handled by 110
km mail is handled by 100
mh mail is handled by 10
mh mail is handled by 20
mh mail is handled by 30
mq mail is handled by 10
ne mail is handled by 20
ne mail is handled by 10
pa mail is handled by 5
td mail is handled by 0
tt mail is handled by 0
tt mail is handled by 10
ua mail is handled by 10
va mail is handled by 20
va mail is handled by 50
va mail is handled by 90
va mail is handled by 10
ws mail is handled by 10

(I really wonder about what's going on with "tt" here...)

So, in theory, you could send email to pope@va. and it will be delivered properly...

If you use different root servers, you will wind up with a different view of what exists on the internet. All the local resolutions I did were against my local system which is using "dnscache" which goes directly to the root servers. Many other resolving DNS servers will ask another local DNS server instead of asking the root servers.

share|improve this answer
Looks like tt just has two MX records, nothing to wonder about. If the first fails it will kick into the second... – Tom Wijsman Apr 12 '12 at 13:56
no -- what I find odd about that is that at the time I did that lookup tt was returning someone's home computer. is roadrunner, an end-user ISP. Maybe they also offer other services, but still a bit wacky to have an MX pointing to an address. – chris Apr 19 '12 at 20:06
@chris Do you mean that a TLD can have no associated IP? – Pacerier Jul 17 '12 at 14:04

How it's not? There isn't any limitation for the minimum "sections" a domain should have. It's a ccTLD for Tonga like us, eu, uk, me, .... The following dot means it's a subdomain of the root domain. In fact, is really

Basically, what they have done is simply adding an A record pointing to a Web server. They own the nameserver responsible for answering queries for to. and all its subdomains so they can do that easily.

Demonstration of the fact:

MehrdadAir:~ Mehrdad$ ping to.
PING to ( 56 data bytes
Request timeout for icmp_seq 0
--- to ping statistics ---
2 packets transmitted, 0 packets received, 100.0% packet loss
MehrdadAir:~ Mehrdad$ telnet 80
Connected to
Escape character is '^]'.
GET / HTTP/1.0
Host: to.
User-Agent: Mozilla

HTTP/1.1 200 OK
Date: Thu, 03 Dec 2009 18:41:05 GMT
Server: Apache/1.3.27 (Unix)  (Red-Hat/Linux) mod_perl/1.26
Connection: close
Content-Type: text/html; charset=ISO-8859-1

<!DOCTYPE html
    PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
<html xmlns="" lang="en-US" xml:lang="en-US">
<title>TO. -- Get Shorty URL</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<form method="post" action="/" enctype="multipart/form-data">
<table><tr><td>Enter a long URL:</td> <td><input type="text" name="url"  size="50" /></td></tr><tr><td>Enter an optional name:</td> <td><input type="text" name="name"  size="20" /></td></tr><tr><td>&nbsp</td> <td><input type="submit" name="&#39;Witz that URL!" value="&#39;Witz that URL!" /></td></tr></table></form>
Connection closed by foreign host.

PS: Based on the content of this thread, I'm absolutely convinced that the software used by some Internet operators (ISPs, ...) does not follow specs correctly and just happens to follow conventions. This is probably why the domain is broken for many people.

share|improve this answer
Not true. While DNS itself would technically allow single-part domain names, the registration authorities (ICANN et al.) will not let you register a naked top-level domain. – sleske Dec 3 '09 at 18:21
sleske: It's a country. Countries do have TLDs. – xmm0 Dec 3 '09 at 18:22

It is rare that a top level domain has an A record, but it's perfectly legitimate. Think how you can have "" and "" have different records, and apply that all the way down to the Tongan ccTLD, .to.

share|improve this answer
it doesn't seem to have an A record, from my investigations using nslookup – rmeador Dec 3 '09 at 18:26
It must or you wouldn't be able to visit the site! – Mark Renouf Dec 3 '09 at 19:38
@rmeador I don't know how you checked but it was badly done since "to" does have a A record. – bortzmeyer Dec 16 '09 at 13:55


"telnet 80" ... typing "GET /" works

"telnet 80" ... typing "GET /" works

"telnet to 80" ... couldn't open connection

"telnet to. 80" ... couldn't open connection

so yeah, i would guess the browser's helping out. m.

share|improve this answer
telnet to. 80 works fine for me. Some proxy server might have messed that up for you. – xmm0 Dec 3 '09 at 18:26
@Mehrdad telnet to. 80 doesn't work for me and I'm definitely not behind a proxy. Perhaps your DNS is doing something else to help you out... – Dan Herbert Dec 3 '09 at 18:34
some dns server can resolve the domain name, some not... – splattne Dec 3 '09 at 18:36

Looks like someone bought the whole .to. TLD as Mehrdad said you can then add an A Record. I think they're just adding the . to the end of to make sure that what ever is looking up the address searches at the root of the tld. the . on the end of all domains should be implied anyway what I don't get is why does return a 400 Bad Request?

share|improve this answer
Chris: IIS doesn't like serving something good when it sees Host: I cannot find anything in the HTTP specification that limits Host header value from containing . at the end. I guess it's a bug in IIS; it does not conform to the specification. – xmm0 Dec 3 '09 at 19:03

Being a TLD, it too can have an A record pointing to an IP Address, just like can have an A record.

Edit: According to some testing with nslookup, it does seem like the A record for "to" is different than the one for "", though I'm not entirely sure if this is a glitch or not.

share|improve this answer

this has nothing to do with browsers. 'to' has a DNS Resource Record, simple as that:

@ SOA to. ( ... )
@ A
share|improve this answer
Is that an example or is the IP address really that awesome? – Chris Dec 3 '09 at 18:44
that's an example, real IP is as you can see from "dig to." output. But a much funnier revelation is, registery for to is at "" :) – hayalci Dec 13 '09 at 19:11

No help browser needed:

$ curl -i "http://to./check"
HTTP/1.1 302 Found
Date: Thu, 03 Dec 2009 18:27:20 GMT
Server: Apache/1.3.27 (Unix)  (Red-Hat/Linux) mod_perl/1.26
Location: <<<=== Actual URL
Transfer-Encoding: chunked
Content-Type: text/plain

It seems the whole TLD is mapped to an IP address (vs. a DNS hierarchy), try:

$dig to.
to. 		85265	IN	A

But check any other TLD:

$dig as.
as. 		600	IN	SOA 56480 10800 1800 604800 21600

I don't know if this follow ICANN rules but it's just a matter of configuring the DNS for the DNS of a whole country TLD.

share|improve this answer
It has nothing to do with ICANN rules, ccTLDs depend on the local law, not on an US-based bureaucracy. – bortzmeyer Feb 9 '10 at 16:31

Apparently not all caching DNS entities are prepared for a TLD to have an A record, as it worked only with 50% of the 2 DNS servers I tried.

Those friendly browsers "fixing" the domain in that case to sure don't help in clearing the confusion.

share|improve this answer
Safari (on 10.5) works ok for me with to. – Mike Pountney Dec 3 '09 at 18:29
@Mike Pountney: He's talking about DNS servers, not browsers. Some DNS servers don't work no matter what browser you have. – Amuck Dec 3 '09 at 18:48
Mike is referring to my original answer where I tried (and failed) with Safari – Timo Metsälä Dec 3 '09 at 18:52
Chrome is fine as well. to – Mark Renouf Dec 3 '09 at 19:39
Good statistic. %50 of two servers :-) :-/ – hayalci Dec 13 '09 at 19:13

this is really not new. dot tk has been offering this for ages. look at then the technical tab. they do it cooler, http://tk./abcde is also which is even shortener!

share|improve this answer
The question was not "How is http://to./ so NEW?". Just saying :) – Chris Dec 3 '09 at 19:20
haha.. true :) for tk. its just about adding an A record for tk. – mauriez Dec 6 '09 at 13:13

I think the simple answer is that the owner of the web server set


as (additional) http host header for that web site.

The problem here is that some DNS server can resolve "to" and "to." (Google DNS says and some simply cannot.

share|improve this answer

The DNS specification also permits a trailing period to be used to denote the root, e.g., "a.b.c" and "a.b.c." are equivalent, but the latter is more explicit and is required to be accepted by applications. This convention is especially important when a TLD name is being referred to directly. For example, while ".COM" has become the popular terminology for referring to that top-level domain, "COM." would be strictly and technically correct in talking about the DNS, since it shows that "COM" is a top-level domain name.


share|improve this answer

As has been indicated. "to." is a valid way to specify a fully qualified host name. No other portions of your "typical" DNS name are required.

If you look at this screen capture of a "dig to.", you'll see that "to." has an A record of

I'm guessing Tonga decided to allow this in exchange for something (cold, hard cash possibly?)

share|improve this answer
I've read elsewhere that selling the use of .to is one of Tonga's main income streams these days. – John Gardeniers Dec 13 '09 at 21:01
Img gone..​​​​​ – Pacerier Jul 17 '12 at 14:07

Any chance it may have something to do with OpenDNS. On my home computer using OpenDNS nslookup returns an IP address. On my work computers through the VPN to does not resolve and http://to./ does nothing.

It could be a bug with OpenDNS...this seems to be acting similar to their shortcut functionality, where you enter something like 'mail' as the shortcut and '' as the website, and when you enter 'mail' from your defined network it takes you to ''. Possibly someone defined their network as and created 'to' as a shortcut? If that's the case it would be a huge opportunity to exploit OpenDNS users!

share|improve this answer

Perhaps an even more puzzling question is why on earth don't they shorten links to

rather than
share|improve this answer
or of course just for an 2 extra vowels in your tweet – Simon Dec 4 '09 at 2:49
Just because someone else already registered that go second-level domain. (I guess that's also why is being used; it was probably one of the few short domain names that is kind of easy to remember, and available?) – Arjan Dec 13 '09 at 17:52
(And as an aside: is not the same site as http://to) – Arjan Mar 28 '10 at 21:27

So the question is why wouldn't it work. And the answer is that after Verisign decided to introduce a wildcard into the .com. zone a few years back, the developers of bind introduced the concept of a 'delegation-only' zone. In a delegation-only zone, any A records which aren't inferior glue for an NS record will not be accepted by the resolver and the client will get back an NXDOMAIN.

So while from a strict protocol viewpoint it's okay for the "to." DNS name to have an A record, in practice it won't work for customers of some ISPs.

You might put:

zone "com." { type delegation-only; };

in your named.conf to turn this on just for the .com. domain, or you might turn it on for all of the TLDs but exclude some of them by adding to the options{} block something like:

root-delegation-only exclude { "de"; "to"; };

etc. There's a long list of "accepted" domains here which are commonly allowed, such as "to", but depending on how BOFHish you're feeling, you might limit this more.

The link has moved since I first noted it down, and again since I first wrote this reply, but I think this is what I pointed to:

share|improve this answer

Warning: I know only enough about DNS to be dangerous. But here's what I know:

. is the root domain; to is one below that

This makes more sense (and works!):

So, basically, we're omitting the www part and the browser is inferring it?

basic DNS overview:

share|improve this answer
So the extra dot is normally left out, but isn't left out in this case so as not to confuse the web browser? – MJeffryes Dec 3 '09 at 18:17
The trailing dot tells the web browser to not-add .com. If you just put http://to, your browser changes that to, but if you use http://to. then the web browser changes that to – Drew Stephens Dec 3 '09 at 18:23
Chrome takes me from to to that same site (to.) – Assaf Lavie Dec 3 '09 at 18:49
This is actually correct. This has nothing to do with browsers, "to" is a valid host name. – Mark Renouf Dec 3 '09 at 19:36
On my computer, to. ( and and to. (to.) yield different pages, and use different IP addresses. I guess "www" has truly been registered as a second-level domain by someone else. – Arjan Dec 10 '09 at 9:26

Doing a whois on the TO. domain name yields that it is owned by IANA:

Domain Name: TO
   Whois Server:
   Referral URL:
   Name Server: AUTH02.NS.UU.NET
   Name Server: COLO.TO
   Name Server: NS-TO.RIPE.NET
   Name Server: NS1.IAFRICA.COM
   Name Server: TONIC.TO
   Status: clientDeleteProhibited
   Status: clientTransferProhibited
   Status: clientUpdateProhibited
   Status: serverDeleteProhibited
   Status: serverTransferProhibited
   Status: serverUpdateProhibited
   Updated Date: 23-oct-2008
   Creation Date: 18-dec-1995
   Expiration Date: 31-dec-2099
share|improve this answer

Some screen captures, to show that http://to./ yields a different site than

http://to./ versus (click to enlarge)

The IP addresses are different as well: versus today.

So: if one is seeing the same for the two URLs then the browser is indeed messing up, and is probably showing for both. probably does not need the trailing dot to tell browsers not to try anything fancy, and hence is the same as, in which www probably has been registered as a second-level domain by some unrelated other company.

share|improve this answer

They own, so points to the same URL. The browser changes it to on the request.

share|improve this answer
Are you sure this has anything to do with "www"? Millions of domain names work without "www" and I don't think it's because this is implicit. – Chris Dec 3 '09 at 18:18
This is misleading. While can point to the same address, can point to a completely different computer. – xmm0 Dec 3 '09 at 18:19
Or are you saying that "www" is some kind of default TLD? – Chris Dec 3 '09 at 18:19
now I'm even more confused! :( – Jeff Atwood Dec 3 '09 at 18:20
this is not correct – Kyle Cronin Dec 3 '09 at 18:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.