Application Details
Last published on: 7 October 2026 at 15:21 UTC
Application Type: New gTLD
Primary String: lugano
TLD Types: Geo (Self-Designated)
Application ID: CDL2651T-T31516
Application Priority Number: --
Application Status: Active
Processing Stage: Pre-Evaluation Processing
Comment Period: --Application Response Documents
Section: Self-Certification
AGB Q192. Q1.1-1 - Provide the applying entity's self-certification document that commits government support on official letterhead from a proper authority that the application for the gTLD(s) and its operation by the applying entity is permitted and that represents and warrants:
SC1.1-1.1 - That the applying entity is the recognized government of its jurisdiction and that the government has authorized the application(s) for applied-for gTLD string(s) or is a recognized intergovernmental organization with relevant authorization for its application(s) for applied-for gTLD string(s).
SC1.1-1.2 - That the applying entity and/or an affiliate commits to the long-term funding required to operate all of the existing gTLDs (if applicable) and newly applied-for gTLD string(s) of the applying entity.Section: Operational/Planning
AGB Q193. Q1.2-1 - Provide a document with a list of the applying entity’s current gTLDs (if applicable) and a list of all gTLDs for entities affiliated with the applying entity (if applicable). If the applying entity and affiliates have no current gTLDs, submit a document that confirms this.Section: Security Policy and Planning
AGB Q220. Q5.1-1 - Provide the applying entity’s self-certification document, signed by the CEO, President, CFO and/or equivalent officer of the applying entity. The self-certification document must represent and warrant:
SC5.1-1.1 - The applying entity will appropriately protect confidentiality of data and prevent unauthorized access to data and services.
SC5.1-1.2 - The applying entity will maintain a mature, appropriately funded and staffed security program, following a recognized, modern security framework based on risk management (such as the ISO27000 series, COBIT, HITRUST CSF, legally required security frameworks, or equivalent). The security program must be in place prior to delegation, and exist through at least the period of the registry agreement.
SC5.1-1.3 - The applying entity is aware of and has designed its systems and business to comply with the relevant privacy and security regulations for all countries in which it operates.Section: DNS Abuse
AGB Q221. Q5.2-1 - Provide the applying entity’s self-certification document, signed by the CEO, President, CFO and/or equivalent officer of the applying entity. The self-certification document must represent and warrant:
SC5.2-1.1 - The applying entity will, no later than delegation of the Top Level Domain (TLD), establish a dedicated abuse point of contact responsible for addressing matters requiring expedited attention and providing a timely response to abuse complaints concerning any name registered in the TLD.
SC5.2-1.2 - The applying entity will, no later than delegation of the TLD, establish, publish, and provide to ICANN the location of a mechanism for members of the public to submit reports of abuse in accordance with the current obligations of the Base RA and any Consensus Policies.
SC5.2-1.3 - The applying entity has developed proposed measures for removal of orphan glue records for names removed from the zone when provided with evidence in written form that the glue is present in connection with malicious conduct (see Specification 6).
SC5.2-1.4 - The applying entity has or will have at time of delegation, established policies for handling complaints regarding abuse. Such policies are to be maintained and posted publicly so that anyone can review the policies via the Internet and any other means deemed appropriate by the applying entity. The applying entity’s policies at a minimum should contain appropriate confirmation of the receipt of the abuse report, the process of review of the report, and actions that will be taken if the applying entity confirms the report is legitimate.
SC5.2-1.5 - The applying entity understands that DNS Abuse is Phishing, Malware, Botnets, Pharming and Spam (when used to deliver other forms of DNS Abuse). The applying entity understands and is prepared to contribute to the mitigation or disruption of DNS Abuse in domains in the TLD zone.
SC5.2-1.6 - The applying entity’s abuse response capabilities are resourced appropriately to ensure a timely and adequate investigation and response to reports of DNS Abuse. This includes capabilities to receive and evaluate evidence of DNS Abuse in reports, and to take action to stop or disrupt the DNS Abuse.
SC5.2-1.7 - The applying entity is prepared to conduct periodic scans of its zone to identify if domains are being used to perpetrate DNS Abuse, and to maintain statistical reports of the scans, the findings, and actions taken.