Safety in Name Only - A Longitudinal Measurement Study of the .kids TLD

The .kids top-level domain was delegated with an explicit mission: To provide a trusted, age-appropriate namespace for children, backed by a Registry Agreement that makes policy violations grounds for suspension or cancellation. We present the first longitudinal measurement study of .kids, covering its full operational lifetime from May 2022 through March 2026 across roughly 1,400 daily snapshots. We combine active DNS measurements from OpenINTEL, ICANN registry transaction reports, VirusTotal, Cloudflare Radar, Internet.nl, and abuse blocklists.
Our results show the zone has not lived up to its mandate. Growth was driven by coordinated bulk-registration events rather than organic demand, over 85% of registrations use the minimum one-year term, and over 30% of the zone is non-operational at any given point. Among active domains, policy-violating content is disproportionately present. VirusTotal flags 3.7% of domains as malicious or suspicious, dominated by phishing that exploits the trust the .kids name conveys. Inspection of domain name strings alone reveals 176 apparent Registry Agreement violations. Of the 44 .kids domains that ever reached the Tranco top 1M, 23 are piracy or unauthorized streaming services and only 5 plausibly serve child-safe content. Blocklist-flagged domains persist in the zone for a median of 34 days, showing that the signal for harmful content is available but remediation is slow.
Our findings illustrate that a policy framework is only as effective as its implementation, and speaks directly to the RIPE community's ongoing discussions on DNS operations, abuse handling, and Internet governance. We will discuss what these results mean for registries operating purpose-driven namespaces, for operators handling abuse reports, and for the policy debate around child safety online.