Summary

  • The IANA root-zone entry for .io, as displayed on 12 November 2026, reports an active, delegated country-code domain managed by Internet Computer Bureau Limited, last updated 3 November 2026 — and reports nothing about ISO 3166-1, about sovereignty, or about the condition on which the delegation would end.
  • The one worked precedent separates the two events by four years, seven months and 22 days: the ISO code for the Netherlands Antilles was deleted on 15 December 2010; the corresponding domain was recorded as not delegated from 6 August 2015.

The record is a status, not a term

Open the IANA entry for .io and you get a disciplined list of administrative facts. String information: A-label io, category country-code top-level domain, script Latin. Status: Active. Technical Status: Delegated. Manager: Internet Computer Bureau Limited, at a Diego Garcia address care of Sure (Diego Garcia) Limited. Administrative contact: Internet Administrator at the same address. Technical contact: an administrator at a Kent address in the United Kingdom. Four name servers, a DS record, a WHOIS server. Last Updated: 3 November 2026.

That is the whole page. There is no field for the legal basis of the code, none for the territory's constitutional position, and none that states what would end the delegation. Anyone holding a .io name is holding a service whose published founding condition is invisible in the record that governs it.

What the treaty says, and what it does not

The trigger is real and it is dated. The UK–Mauritius agreement concerning the Chagos Archipelago including Diego Garcia was signed at London and Port Louis on 22 May 2025 as CP 1334. Article 1 assigns sovereignty over the entire archipelago, including Diego Garcia, to Mauritius. Article 19 defines the territory exhaustively — islands, internal waters, territorial sea, archipelagic waters, exclusive economic zone, airspace, seabed and subsoil. Article 18 makes entry into force depend on a later notification that both parties have completed their internal requirements. Article 13 runs a 99-year Initial Period from that moment, with a possible further 40 years.

It contains no reference to .io, to ISO 3166-1, to the IANA root zone, or to any registry arrangement. A 37-page instrument that disposes of a territory says nothing about the two-letter code that territory's name produced.

Nor is the trigger yet pulled. The joint statement of 3 October 2024 described a political agreement expressly "subject to the finalisation of a treaty." The Foreign Secretary told Parliament on 7 October 2024 that the treaty was neither signed nor ratified. And a Department for Environment, Food & Rural Affairs page updated 28 October 2026 states that the 22 May 2025 treaty has not been ratified and has not entered into force, that the British Indian Ocean Territory therefore remains a UK Overseas Territory, and that sovereignty would transfer if it does.

So the honest current position is a signed instrument not in force, over a territory still British, over a code still listed, over a domain still delegated. Three layers, each waiting on a different clock.

The only revocation clause on the books is about competence

RFC 1591, dated March 1994, is where the delegation logic was written down. Section 3 vests overall DNS coordination and delegation responsibility in IANA, notes that most top-level domains are two-letter ISO 3166 country codes, and describes the designated manager as a trustee: "These designated authorities are trustees for the delegated domain, and have a duty to serve the community." A trustee serving the relevant nation and the global Internet community at once. That is the closest the founding document comes to saying who the delegation is for.

On endings, it is narrow. Persistent operational problems can lead to revocation and redelegation. Transfers require mutual agreement. IANA generally avoids changing an arrangement without the parties' agreement, except where a manager has substantially misbehaved.

Read that list for what is missing. Incompetence, yes. Misbehaviour, yes. Disagreement, yes. The dissolution or sovereign transfer of the entity the code names: not there. No reviewed passage of RFC 1591 makes a territory's constitutional future a ground for revoking a domain.

What happened the one time the country went away

The Netherlands Antilles dissolved politically on 10 October 2010. ISO 3166-1 Newsletter VI-8, dated 15 December 2010, recorded the alpha-2 code AN for NETHERLANDS ANTILLES with the change description "Delete entry" and added BQ, CW and SX in its place.

IANA's own 2011 report on the delegation of .CW then explains what that meant in practice. The report says the former .AN entry was retired from ISO 3166-1 in December 2010, that .AN was "no longer eligible for continued delegation," and that it would nonetheless remain subject to transitional arrangements before full retirement. The code was gone. The domain kept resolving.

For how long, the record is unusually concrete. The IANA entry for .an reports status Retired and states "Not delegated since 2015-08-06," with the same date as Last Updated. The August 2015 root-zone audit, covering 1–31 August 2015, lists an as completed on 6 August 2015.

From 15 December 2010 to 6 August 2015 is four years, seven months and 22 days. That is the measured gap between a code deletion and a non-delegation in the only case where the full chain is on the public record. It is not a rule anyone published in advance. It is what happened once.

What the reviewed record does not say

Four absences shape this story, and each is a fact about a page, not a claim about the world.

The .io entry states no termination condition and does not mention ISO 3166-1. RFC 1591 names no sovereignty ground. The treaty names no registry. And no reviewed document defines the eligibility standard IANA applied in 2011 beyond the Antillean case itself.

What that leaves is a gap that is structural rather than accidental. The uniqueness of a two-letter code is maintained by a standards body; the use of the domain is administered by a registry; the political fact underneath both is settled by governments. Nobody in that chain publishes a single instrument binding all three.

What a holder can actually point to

A .io registrant's contract is with a registrar, which is downstream of the manager, which is downstream of the root zone, which is downstream of a listing that this registrant never sees and cannot renew. When people describe country-code domains as property, this is the layer where the metaphor fails — not because the address is fragile, but because its founding condition lives outside every contract the customer signed.

That does not make the domain unreliable. It makes it contingent, and the contingency is legible only if you go looking: a status field that says Active, a treaty that says nothing, and a precedent that took more than four years to convert a deleted code into a retired domain.