.dev TLD audit hub
Google-operated TLD with mandatory HSTS preload — every .dev domain must serve HTTPS.
Google Registry took control of .dev in 2014 and made it generally available in early 2019 with one unusual constraint baked in: the entire TLD is hardcoded into the Chrome HSTS preload list. That means every browser shipping a recent stable build will refuse to send a plaintext HTTP request to any .dev hostname, regardless of how the site is configured. There is no opt-out. For developers and SaaS teams this is mostly desirable — it removes a class of misconfiguration bugs and forces TLS from day one — but it does mean local development on raw HTTP is impossible without trusted certificates, and a misconfigured CDN or origin without a valid cert produces a hard browser block instead of a graceful warning. Pricing puts .dev between .com and .io, and registrar coverage is broad. Common usage clusters around documentation sites, design-system showcases, OSS project pages and developer-facing SaaS subbrands. Because the TLD requires HTTPS to load at all, our SSL checker's pass/fail boundary on .dev is sharper: a expired or misissued cert is not a degraded state, it is a total outage. We pay extra attention to chain depth and ECDSA support when reporting on .dev, and recommend ACME automation everywhere.