The announcement landed like a hand grenade in the domain industry. Telegram, the messaging app with 900 million monthly active users (and claims of 10 billion usernames), applied for the '.gram' top-level domain. Pavel Durov's vision: every user gets a native domain like durov.gram, and can host interactive websites directly on Telegram's infrastructure. No third-party hosting. No DNS complexity—just a username upgraded to an internet identity.
Code doesn't care about marketing hype. DNS is a protocol that demands precision. A registry for 10 billion records is not a simple add-on. It's a new business unit with existential risks.
Context: The Proposal
Telegram applied to ICANN for the .gram TLD. If approved, any user with a Telegram username can claim the corresponding second-level domain (e.g., @durov becomes durov.gram). These domains will resolve to websites hosted on Telegram's servers—interactive pages built using Telegram's Mini Apps framework. The pitch: no learning curve, instant deployment, global reach.
But the technical and operational implications are staggering. ICANN's new gTLD program is notoriously slow. The last application round closed in 2012. The next round? Still pending. Durov's announcement might be a preemptive signal, not a real application. Yet even if it's real, the path from application to delegation is a minefield.
Core: The Infrastructure Scalability Challenge
Let's break down the technical stack Telegram would need to build or buy.
DNS Infrastructure. A registry must operate authoritative DNS servers for the TLD. For 10 billion domains, that's a minimum of 10 billion NS records, plus glue records, DNSSEC signatures, and update propagation. Most registries handle tens of millions. Scaling to billions requires anycast, massive caching layers, and a backend that can handle hundreds of thousands of updates per second. Code doesn't. The registry software must handle millions of dynamic updates without breaking consensus.
Name Server Capacity. Telegram would need to run multiple geographically distributed name servers. At 10 billion domains, the query load could exceed 100 million QPS during peak hours. That's Facebook-level traffic. The cost of bandwidth alone could eclipse Telegram's current operational expenses.
Certificate Management. Every .gram domain that serves HTTPS needs a TLS certificate. Let's Encrypt issues 1.5 million certificates per day. Telegram would need to automate certificate issuance for billions of domains—potentially using ACME, but with custom rate limiting. A single bug could cause mass revocation.
Content Hosting. The websites are hosted on Telegram's servers. That means each domain requires storage for static assets, and potentially server-side logic for Mini Apps. The storage cost for 10 billion minimal homepages (10KB each) is 100 petabytes. Data transfer costs at that scale are astronomical. Telegram would need to build or repurpose a CDN with edge compute capabilities.
Security Architecture. This is where my audit instincts kick in. Domain registries are prime targets for phishing and malware. Telegram's privacy-first stance—no phone number required for accounts, encrypted messaging—creates a tension with ICANN's Registration Data Policy (RDS). Whois requires accurate contact information. Telegram's standard approach is to hide user data. That conflict will surface in the application review.
From my experience auditing smart contracts, I've seen how scaling security is often an afterthought. Here, the registry must implement domain verification, abuse detection, and takedown procedures. Without a robust system, .gram could become a haven for phishing attacks targeting the 900 million Telegram users themselves.
Data Availability and Resolution. Each domain must resolve reliably. If Telegram's DNS goes down, millions of websites disappear. The company's history of occasional outages (e.g., during DDoS attacks) suggests they need a more resilient architecture. Redundancy across multiple cloud providers? Or a dedicated DNS infrastructure like Verisign's? That requires capital and expertise Telegram hasn't demonstrated.
Contrarian: The Regulatory Blind Spot
The conventional analysis focuses on competition with Web3 domains (ENS, Unstoppable) or traditional registrars. But the biggest blind spot is ICANN's own processes.
ICANN has not opened a new gTLD application round since 2012. The next round is expected in 2026 at the earliest. Durov's announcement might be premature—or it might be a signal that Telegram is applying through a backdoor (e.g., acquiring an existing registry). But even if they get through, the application includes a rigorous evaluation of financial stability, technical capability, and security.
Telegram's financials are opaque. The company relies on founder funding and crypto ventures. ICANN requires a demonstrated history of registry operations or a bank guarantee. That's a hurdle.
More importantly, the .gram string could face objections from rights holders. Grammarly, Instagram (Meta), and other brands with 'gram' in their names might file a Legal Rights Objection. The dispute resolution process is expensive and delays delegation by years.
Then there's the content moderation paradox. Telegram has long resisted proactive moderation. As a registry operator, they would be required to implement abuse prevention measures, including domain takedowns for malware, phishing, and copyright infringement. Failure to do so could result in ICANN's Registry Accreditation termination. The registry agreement gives ICANN broad powers to suspend a TLD for non-compliance.
Telegram's user base includes communities that value its hands-off approach. Implementing domain-level abuse controls could alienate core users. Not implementing them could lose the TLD.
Takeaway: The Vulnerability Forecast
The .gram plan is a strategic move to lock users into Telegram's ecosystem by converting usernames into internet assets. But the execution will reveal whether Telegram can transition from a lightweight messaging app to a heavyweight internet infrastructure provider.
The most likely outcome: .gram will launch as a limited beta, restricted to premium users or a small test group. Scaling to billions will take years, if ever. The real vulnerability is not technical—it's regulatory. ICANN's process, brand objections, and abuse obligations will slow deployment and potentially kill the project.
Code doesn't. The registry software will need to be built from scratch or adapted from open-source tools. But the code can't solve the fundamental tension between privacy and registry accountability. That's a policy problem, not a programming one.
Trust is math, not magic. But in this case, the math involves DNS, certificates, and 10 billion endpoints. One misconfigured algorithm or one overlooked abuse report, and the entire project collapses. Telegram's risk is not just a failed application—it's a reputational blow that could undermine its core promise of secure communication.
The final question: Will .gram ever go live? My bet is yes, but only after a multi-year regulatory battle, and only for a fraction of the claimed user base. The real value isn't the domains themselves—it's the data and lock-in they create. And that's a story the code will tell, one log entry at a time.