What's the cheapest domain extension that still looks legit for a business?
Usually .com itself. At cost it is about $10.46 a year at Cloudflare (October 2026), roughly $52 over five years, and .org is close behind. The $2 first-year deals on .site, .online or .store renew at $27 to $44, so five years costs two to three times as much. A local ccTLD such as .de is cheaper still.
Updated October 26, 2026 · 6 primary sources, listed below
Cheap over five years, not just year one
The sticker price on most cheap extensions is a first-year promotion. What a business actually pays is the first year plus every renewal, so we rank by the five-year total: first year + four renewals at the cheapest registrar in the tld.expert daily price matrix, checked 2026-10-21.
Extensions customers already trust
| Ending | First year | Renews at | 5-year total | At |
|---|---|---|---|---|
| .com | $10.46 | $10.46/yr | $52.30 | Cloudflare Registrar |
| .org | $8.50 | $11.20/yr | $53.30 | Cloudflare Registrar |
| .net | $11.86 | $11.86/yr | $59.30 | Cloudflare Registrar |
| .us | $4.30 | $6.96/yr | $32.14 | Dynadot |
| .ca | $8.77 | $9.18/yr | $45.49 | Porkbun |
| .uk | $5.30 | $5.30/yr | $26.50 | Cloudflare Registrar |
| .de | $2.90 | $4.07/yr | $19.18 | Porkbun |
Promo-priced extensions (often under $3 in year one)
| Ending | First year | Renews at | 5-year total | At |
|---|---|---|---|---|
| .site | $2.50 | $26.97/yr | $110.38 | Dynadot |
| .online | $4.99 | $27.70/yr | $115.79 | Cloudflare Registrar |
| .store | $4.99 | $42.20/yr | $173.79 | Cloudflare Registrar |
| .shop | $2.06 | $31.41/yr | $127.70 | Porkbun |
| .xyz | $12.30 | $11.20/yr | $57.10 | Cloudflare Registrar |
| .top | $1.63 | $4.63/yr | $20.15 | Porkbun |
| .info | $3.60 | $22.14/yr | $92.16 | Porkbun |
| .biz | $1.50 | $18.93/yr | $77.22 | Dynadot |
Cloudflare Registrar sells at cost, so where it is cheapest its price is effectively the wholesale floor; it needs a Cloudflare account and Cloudflare nameservers. Renewal jumps on promo extensions are tracked on the renewal trap list.
What makes an extension look legit
Two things: customers recognise it, and it is not where scammers live. The second one is measurable. Interisle’s Phishing Landscape 2025 scores each TLD by phishing domains per 10,000 registered (May 2024 to April 2025):
| TLD | Phishing score per 10k |
|---|---|
| .top | 532.6 |
| .xyz | 174.2 |
| .shop | 150.7 |
| .com | 29.4 |
| .net | 25.7 |
| .org | 21.6 |
Source: Cybercrime Information Center (Interisle), top TLDs by phishing domains.
Cheap promo pricing and abuse go together: Cloudflare’s March 2024 analysis of its 2023 email traffic found over 95% of the mail from TLDs such as .top and .sbs was spam or malicious. A business on one of those endings inherits the suspicion in inboxes and at checkout.
Our pick by situation
- Default: .com. Cheapest legit option over any real time horizon and the one customers type without thinking.
- Nonprofit or community: .org. Same price band as .com, among the lowest phishing scores.
- Local business: your ccTLD. .uk, .de and .ca read as local and trusted, and cost the same or less than .com. Many have residency rules; see who can register them.
- US business: .us. Among the cheapest credible endings, but only with a US nexus under the usTLD Nexus Requirements.
- Avoid for a business you want trusted: .top, .xyz and other abuse-heavy promo endings, however cheap year one looks. See whether .xyz email goes to spam.
Live check against the registries and registrars, with the cheapest price we found and the renewal next to it.
Common questions
Is a $1 or $2 domain a scam?
No, it is a real registration, but the price is a first-year promotion. On .site, .online, .store and .shop the renewal in our matrix is 10 to 20 times the first-year price, so the second year is where you pay. Always read the renewal line before you buy.
Is .xyz cheap and legit?
Cheap, yes: about the same five-year cost as .com at cost. Legit-looking is the problem. Interisle's 2025 data puts .xyz at about six times the phishing rate of .com, which is why cautious customers and some mail filters distrust it.
Can anyone register a .us domain?
Only with a US nexus: a US citizen or resident, a US organisation, or a foreign entity with a bona fide US presence, under the usTLD Nexus Requirements. If you qualify it is one of the cheapest credible endings in our matrix.
Why is Cloudflare cheapest for .com?
Cloudflare Registrar sells at cost with no markup, so its price is effectively the registry wholesale fee plus the ICANN fee. The catch is that it requires a Cloudflare account and Cloudflare nameservers; the cheapest direct-buy registrar is a few cents higher.
Sources we checked
- tld.expert registrar price matrix, “Daily Porkbun, Dynadot and Cloudflare Registrar price snapshots” (October 21, 2026).
- Cloudflare, “Cloudflare Registrar: domains at cost” (retrieved October 26, 2026).
- Interisle Consulting Group, “Phishing Landscape 2025 (May 2024 to April 2025)” (September 1, 2025).
- Cybercrime Information Center (Interisle), “Phishing activity in TLDs, May 2024 to April 2025” (September 1, 2025).
- Cloudflare Blog, “Top-level domains and email phishing threats (Joao Tome)” (March 26, 2024).
- About.us (usTLD registry), “usTLD policies: Nexus Policy and Requirements” (retrieved October 26, 2026).
Extensions on this page
More straight answers
- What is a TLD (top-level domain)?
- How to come up with a business name (and a domain that goes with it)
- How to check if a business name is taken
- How to trademark a business name (and what it means for your domain)
- How to choose a domain name for your business
- Will using a non-.com domain hurt my Google rankings?
- Starting an app in Brazil: should you use .com.br or .com?
- Can I register a .de or .ca domain if I don't live in that country?
- Should I buy the .net and .co versions of my domain to protect my brand?
- Will emails from a .xyz or .io address go to spam?
- Is it risky to build my company on a .io domain because of the Chagos Islands deal?
- How much will a .ai domain cost over 5 years, including renewals?
- Why does my .dev site require HTTPS, and can I turn it off?