The previous issue on domain extensions ended on a thread I deliberately left dangling. It was about how tiny states lease out their national domains: Tuvalu lives off .tv, Anguilla — off .ai, Niue is litigating over .nu. But this economy has a layer beneath domains, and it is far stranger: ISO 3166-1 itself, the standard that decides what counts as a country at all. Two letters in that standard are not a description of reality, but a licence. It is issued under rules almost nobody knows about, and it outlives the states it denotes.
I checked the publication archive — “ISO 3166,” “Diego Garcia,” “exceptionally reserved” had never appeared even once. So I’m digging from scratch.
The rule for entering ISO 3166-1 is disarmingly straightforward. A new country name gets into the standard in exactly one way: it must be registered in the UN bulletin Country Names or in the UN Statistics Division reference Country and Region Codes for Statistical Use. Until a name appears in one of those two documents, ISO 3166/MA cannot do anything — it does not assess applications; it merely records what has already been entered on UN lists.
And to get into the UN bulletin, you need to meet at least one of three conditions: be a UN member, be a member of a UN specialized agency, or be a party to the Statute of the International Court of Justice. Population, territory, money, international recognition — none of them are on the list. The addition process is mechanical, too: as soon as a name appears at the UN, ISO adds it to the standard by default, without a separate decision or vote.
So the world’s country directory has no policy of its own. It has someone else’s — the UN’s — and inherits it wholesale by default, including disputed names such as “FALKLAND ISLANDS (MALVINAS)” in the same alphabetical list as “TAIWAN, PROVINCE OF CHINA.”
The logic of the codes is administrative, not geographical. A two-letter designation is chosen to reflect a “significant unique component of the country name.” Which means everything generic gets thrown out: “Republic,” “Kingdom,” “United,” “Federal,” “Democratic” — they recur too often and would create confusion. Hence the standard’s main scar: the United Kingdom is officially designated GB, after Great Britain. The code UK exists, but in another category.
That is the category of “exceptional reservations,” and it opens upon request. An official ISO 3166/MA document explicitly lists seven petitioners and their motives, and the list reads like an expense ledger: Finland — to provide letters for the semi-autonomous Åland Islands; France — to code metropolitan France separately from its overseas territories; the United Kingdom — “to ensure that the code element UK is not allocated to any other country” (that is the wording verbatim); ITU — for sites hosting telecommunications equipment; UPU — for territories issuing their own stamps; WCO — for customs enclaves; and ISO 4217 — for the euro, whose code EUR existed in the currency standard but required a basis in the country standard.
International bodies asked for letters too, and got them. AC — Ascension Island, TA — Tristan da Cunha (both at the postal union’s request, as philatelic territories), CP — Clipperton Island and DG — Diego Garcia, both at the International Telecommunication Union’s request for equipment locations. CQ — Sark, simply because Britain asked for it, the letters taken from the French Sercq. EA — Ceuta and Melilla, IC — the Canary Islands, both through the customs authorities, because those Spanish territories have special customs status.
Notice what is happening here. The Canary Islands are an ordinary part of Spain, within the EU, with a population of more than two million. They have a code, but a non-standard one. Meanwhile the Sovereign Military Order of Malta — with more than a hundred diplomatic missions, its own passport, its own postage stamps, its own licence plates, observer status in the UN General Assembly since 1994, and two extraterritorial residences in Rome — has no code at all. Neither official nor reserved. The reason is simple, and more insulting than any conspiracy theory: the Order has never been a UN member and does not appear on UN lists, which means the mechanism that gave letters to metropolitan France and Sark simply does not switch on for it.
Then comes my favourite category. Besides assigned and reserved codes, the standard leaves users entire ranges for DIY work: AA, QM–QZ, XA–XZ and ZZ. The idea is direct — if you need a country that is not in the standard, make one up for yourself and never collide with an official update. ISO promises not to take those letters.
The loophole has proved useful. XK — Kosovo. The letters were chosen from the user-assigned range and are used de facto: by the European Commission, the IMF, SWIFT, Deutsche Bundesbank, the customs authorities of Ireland, Malta, Cyprus and France, Canadian and Swiss agencies, the British tariff reference, the US State Department, and Unicode’s library of language standards. Kosovo, meanwhile, is formally not entitled to a code, even though it met condition (b) — membership in a UN specialized agency — back in June 2009, when it joined the IMF and the World Bank. The UN terminology bulletin has still not been issued, and Kosovo does not appear in the M49 statistical-use reference.
The second use is more modest in scale, but written into an actual international deal. The code XI denotes Northern Ireland for VAT collection purposes in trade with the European Union after Britain left the EU. Letters from the user-assigned range became part of a customs protocol.
And ISO 3166/MA takes care to stress that it does not maintain or administer lists of user-assigned codes. That matters for understanding the whole construction: what looks like a unified system is one-third made up of arrangements the standard merely promises not to break.
The standard has a third part — ISO 3166-3, “codes for formerly used names of countries.” It answers a question that arises in life surprisingly often: what do you do with a code when a country vanishes? Every entry has its own arithmetic.
A former country’s four-letter code is built according to three rules. The first two letters are the old code; the last two depend on the manner of death. A name change produces the code of the new name, and if the letters did not change in the process — the service code AA. Thus Burma BU became BUMM (Myanmar, MM), and likewise the Byelorussian SSR turned into BYAA, because the new country kept the same code. Absorption by a neighbour produces the absorber’s code: East Germany DD became DDDE, Germany DE. Breakup into several parts produces HH, “there is no single successor,” so Czechoslovakia CS became CSHH. I counted exactly thirty such gravestones in the register.
Then comes the bookkeeping that is why I love this subject. Under ISO 3166-1:2020, a deleted country’s alphabetic codes cannot be reassigned for at least fifty years. In transitional reservations, the terms are set out as specific dates: the Netherlands Antilles’ AN is reserved until 2060, Czechoslovakia and Yugoslavia’s CS until 2056, East Timor’s TP until 2052. Numerical codes are not held back for reuse at all: the standard states outright that reserved numerical codes do not exist. Hence the oddity: Ghana’s numerical code, the three-digit 288, remains with it forever, and no other country will ever get it.
With ccTLDs, it is different. .an, .cs, .yu, .zr, .tp have left the root zone, while .su lives on, even though the Soviet Union has been gone for thirty-five years. The reason is exactly what I suspected: the SU code was not removed from the standard; it was moved into an “exceptional reservation,” where it has remained since June 2008 at the request of Russia’s Internet Development Fund. ICANN’s logic is hard-edged and one-sided: a top-level domain can be removed from the root only once the corresponding two letters have vanished from ISO 3166. As long as the letters remain in the standard, the zone remains too — and there is no statute of limitations here.
The most interesting layer emerged when I decided to check how the standard and the domain root zone line up today, letter by letter. The latest IANA root-zone list (version of 29 September 2026, 1439 lines) against the full list of assigned ISO 3166-1 codes: five codes have no ccTLD of their own — BL (Saint Barthélemy), BQ (Bonaire, Sint Eustatius and Saba), EH (Western Sahara), MF (Saint Martin) and UM (United States Minor Outlying Islands). All five are small or disputed territories that the domain simply never reached. The standard knows them; the internet does not.
And there are three zones in the root that should not be in the standard: AC, EU, SU — all three exceptionally reserved. Plus UK, also a reservation, though that is a different case: .uk serves the same country as .gb, and the split has never bothered anyone.
I would not call this an anomaly. It is more an honest imprint of the method: the registry of IP addresses and domain names was built on ISO 3166, but was never its mandatory appendix. The asymmetry of five codes and three zones is the price of international infrastructure being built on a standard that does not consider itself the final authority on truth.
Now — the very story this all began with. DG means Diego Garcia: an atoll in the middle of the Indian Ocean, one thousand six hundred kilometres south of India, the largest by land area in the Chagos Archipelago. The letters were assigned to it by the International Telecommunication Union for “the location of telecommunications installations,” and the trace of that request still sits in ITU documents: in the list of telegraph destination codes, DG appears in a neat line with the number 939, beside real countries.
This may be the most honest metaphor in the entire story. Diego Garcia exists in international classifications not as a place where people live, but as a coordinate for equipment on the world map.
There have been no people there since 1971. In 1965, the archipelago was separated from Mauritius to create the British Indian Ocean Territory, and from 1966 the islands and plantations were bought from private owners. In 1971, the plantations were closed under an agreement with the United States, under which Diego Garcia was to become a military base; by the terms of the deal, no other economic activity was permitted on the island. The local population — the Ilois, descendants of Indian labourers and African slaves — were removed to the Seychelles, and then to Mauritius, amid allegations of intimidation and starvation. In April 2006, one hundred and two people were granted the right to come for a week, tend the graves, and see the places where they were born.
And now for the final twist, so fresh it is almost indecent. In 2024–2025, Britain agreed to transfer sovereignty over Chagos to Mauritius, keeping the military base on a 99-year lease — for £101 mn on average per year, or, according to the Guardian, £165 mn for the first three years and £120 mn annually from the fourth. In April 2026, the deal was suspended: Trump withdrew his support. In September, at the UN General Assembly, he called it “terrible” in front of Prime Minister Andy Burnham, and British Defence Secretary Wes Streeting announced a review of the terms. Britain, meanwhile, put payments to Mauritius on pause — at least £120 mn, which under the agreement it was supposed to pay for the lease of that very atoll.
Now let us look at where my two letters are in all this. The treaty does not mention the term “British Indian Ocean Territory” at all: Mauritius is being given control over all commercial activity in the archipelago, including digital services, as well as rights of representation in the ITU. Which means the entity to which the IO code is attached may cease to exist — and the standard will have to initiate a review.
The stakes are not small. The .io zone contains, by various estimates, 1 to 1.6 mn domains, and it has long been popular with tech companies because the letters read as “input-output.” In its official 2024 explanation, ICANN played exactly the same tune as with .su: as long as IO remains listed in ISO 3166-1, nothing happens; if the code leaves the standard, the ccTLD retirement policy adopted in 2022 will kick in, and a five-year window of phased winding-down will begin. During that time, tens of thousands of companies will have to change their addresses, and moving a domain is not a redirect in a config file.
Let me gather what this whole construction adds up to. The index of countries by which the world checks passports, addresses, bank-account numbers and customs duties belongs to a standards organization, but has no policy of its own: it copies UN lists by default. Everything that did not fit into it lives in three side categories — reserved at others’ request, permitted for DIY, and intended for dead countries. The division between those categories has nothing to do with reality; they are merely notes on who asked, and when.
Hence the practical conclusion felt firsthand by metropolitan France, Clipperton Island and the Canary Islands alike: letters are needed for accounting, routing and protocol, but no one is obliged to describe a country with them. Once a record has been opened, you can pry a code out of it only through a procedure where the dogs are asleep: fifty years for letters, never for digits, and a decision about the fate of a domain zone carrying a million and a half addresses.
Two letters weigh exactly as much as the people and systems that have managed to move onto them. Kosovo lives in XK because that is what the banks agreed on. Diego Garcia lives in DG because telecoms asked for it. And Diego Garcia in the 2025 agreement does not live at all.
tlds-alpha-by-domain.txt, version of 29 September 2026), IANA