17 |
18 | ## Recent updates
19 |
20 |
21 |
22 |
23 |
24 | **November 17th, 2023**: We've emailed all .gov registrants with instructions on how to access the new .gov registrar. Domain requests are still [paused]({{ site.baseurl }}/updates/2023/10/13/transition-update/) until January 2024.
25 |
26 | **October 13th, 2023**: New domain requests are [paused]({{ site.baseurl }}/updates/2023/10/13/transition-update/) until January 2024 as we transition to new infrastructure.
27 |
28 | **September 6, 2023**: We're leading a [change to .gov's infrastructure]({{ site.baseurl }}/updates/2023/9/6/infrastructure-as-a-public-service/) that requires current users to take certain actions. In October 2023, we'll also initiate a pause on new domain requests.
29 |
30 | **February 8th, 2023**: Federal executive branch agencies have [updated requirements]({{ site.baseurl }}/registration/requirements/#executive-branch) for the registration and use of .gov domains, via [OMB Memorandum 23-10](https://www.whitehouse.gov/wp-content/uploads/2023/02/M-23-10-DOTGOV-Act-Guidance.pdf). The update details how domains are requested and which may be approved.
31 |
32 | **January 31st, 2023**: The .gov zone file is [now available](https://czds.icann.org/home) in ICANN's Centralized Zone Data Service. [Learn more]({{ site.baseurl }}/updates/2022/9/14/making-infrastructure-less-invisible/#publishing-the-gov-zone-file) in last September's blog post.
33 |
--------------------------------------------------------------------------------
/pages/privacy.md:
--------------------------------------------------------------------------------
1 | ---
2 | title: Privacy policy
3 | layout: docs
4 | permalink: /privacy/
5 | intro: Thank you for visiting dotgov.gov
6 | ---
7 |
8 | Our privacy policy is clear: Unless you choose to provide additional information to us, we will collect no personal information about you other than statistical information that can be used to make the site more effective for all our visitors.
9 |
10 | ## Information we gather
11 |
12 | The only information that is automatically collected and stored is:
13 |
14 | - the name of the domain from which you access the internet (i.e., DHS.gov if you are connecting from a DHS account, or GMU.edu if you are connecting from George Mason University’s domain)
15 | - the date and time of your visit
16 | - the pages you visit on [dotgov.gov](https://domains.dotgov.gov)
17 | - the internet address of the website you came from if it linked you directly to [dotgov.gov](https://domains.dotgov.gov)
18 | - search terms that you enter into the dotgov.gov search tool
19 |
20 | If your browser accepts cookies, we may use a session cookie to lean how many different visitors come to [dotgov.gov](https://domains.dotgov.gov). We use this information for statistical purposes and to help us make our site more useful to you.
21 |
22 | ## Information you send us
23 |
24 | When you send us personal information (e.g., in an electronic mail message containing a question or comment) or by filling out a form that emails us this information, we only use this information to respond to your request. Such application information is carefully protected by the agency and not available in or retained by web tracking software. We may forward your email to the government employee who can best answer your question(s). We do not disclose, give, sell, or transfer any personal information about our visitors, unless required for law enforcement or statute.
25 |
26 | Domain Registration information: Registration information for .Gov domains requires Point of Contact information. In order to support security of the internet, we are required to offer the WHOIS service with respect to the top-level domain.Gov for which we are the registry. This service allows you or anyone else to determine the availability of domain names and the contact information for the registrar who registered a domain name on behalf of a registrant. WHOIS service typically contains the registrant’s name, contact person's name, address, telephone number, email address, and/or IP address as provided to us by the registrar for the domain name. Via the WHOIS service, this information may be disclosed to unaffiliated third parties in order to determine the registrant or the registrar in case of:
27 |
28 | 1. technical problems that might occur when accessing its domain
29 | 2. assisting law enforcement authorities in investigations, crime prevention, and matters of national security
30 | 3. helping to counter the infringement of third-party legal rights
31 | 4. preventing fraud
32 |
33 | However, only that data necessary for the purposes described above.
34 |
35 | We want to make it clear that we will not obtain personally identifying information about you when you visit our site, unless you choose to provide that information to us. Except for authorized law enforcement investigations, or as otherwise required by law, we do not share any information we receive with anyone else.
36 |
37 | ## Security
38 |
39 | For site security purposes and to ensure that this service remains available to all users, GSA servers (owned or contracted), use industry-standard methods to monitor network traffic to identify unauthorized attempts to upload or change information, or otherwise cause damage. Unauthorized attempts to upload information or change information on GSA servers are strictly prohibited and may be punishable by law, including the Computer Fraud and Abuse Act of 1986 and the National Information Infrastructure Protection Act.
40 |
--------------------------------------------------------------------------------
/pages/registration/registration.md:
--------------------------------------------------------------------------------
1 | ---
2 | title: Registration
3 | layout: docs
4 | permalink: /registration/
5 | sidenav: registration
6 |
7 | ---
8 | > **Requests for new .gov domains are paused** until January 2024. See our [blog post]({{ site.baseurl }}/updates/2023/10/13/transition-update/) to learn more.
9 |
10 | * If you want a new .gov domain, you can prepare by reviewing [the new domain request process](https://beta.get.gov/domains/before/) on the beta version of our new website.
11 | * You can [get notified](https://forms.office.com/g/aLbfNuuFD4) when .gov opens for new requests.
12 | * If you submitted a request before October 13, 2023, it will be reviewed before the move to our new registrar.
13 |
14 | [Contact us]({{ site.baseurl }}/help/#contact-us) if you have questions.
15 |
--------------------------------------------------------------------------------
/pages/registration/request-templates.md:
--------------------------------------------------------------------------------
1 | ---
2 | title: Authorization letter templates
3 | layout: docs
4 | permalink: /registration/authorization-templates/
5 | warn: Requests for new .gov domains are paused** until January 2024.
6 | sidenav: registration
7 | ---
8 |
9 | > **Requests for new .gov domains are paused** until January 2024. See our [blog post]({{ site.baseurl }}/updates/2023/10/13/transition-update/) to learn more.
10 |
11 | Choose an authorization letter template to copy and paste from:
12 |
13 | * [City/County]({{ site.baseurl }}/registration/authorization-templates/city-county/)
14 | * [Federal]({{ site.baseurl }}/registration/authorization-templates/federal/)
15 | * [State/U.S. territory]({{ site.baseurl }}/registration/authorization-templates/state-territory/)
16 | * [Tribal]({{ site.baseurl }}/registration/authorization-templates/tribal)
17 | * [Interstate]({{ site.baseurl }}/registration/authorization-templates/interstate/)
18 | * [Independent intrastate]({{ site.baseurl }}/registration/authorization-templates/independent-intrastate/)
19 |
20 | *Unsure which letter to select?* Check out the FAQ, [What's an "authorizing authority", and who is ours?]({{site.basurl}}/help/#whats-an-authorizing-authority-and-who-is-ours) for a breakdown of each domain type.
21 |
22 | CISA will share approved authorization letters submitted by the authorizing authority with the U.S. Census Bureau, including letters that have already been collected by CISA.
23 |
--------------------------------------------------------------------------------
/pages/updates/2023-transition-email.md:
--------------------------------------------------------------------------------
1 | ---
2 | title: Action required for your .gov account
3 | layout: docs
4 | permalink: /updates/2023/9/6/transition-email/
5 | intro: An email sent to .gov registrants, September 2023
6 | subnav:
7 | - text: What's happening?
8 | href: '#whats-happening'
9 | - text: What do I need to do?
10 | href: '#what-do-i-need-to-do'
11 | - text: What other changes impact my organization?
12 | href: '#what-other-changes-impact-my-organization'
13 | ---
14 |
15 | Hello from .gov. We're emailing to notify you about changes coming to the .gov registrar that will affect your account.
16 |
17 | ### What's happening?
18 |
19 | We [built a new way]({{ site.baseurl }}/updates/2023/9/6/infrastructure-as-a-public-service/) to request and manage .gov domains – _**a new .gov registrar**_. We'll retire our current platform in late fall 2023. The new registrar will be the foundation for the services we'll offer in the coming years.
20 |
21 | To access the new registrar, you'll need a [Login.gov](https://login.gov) account that is linked to the same email address you're using in our current registrar. In preparation, we ask that you set up that account now.
22 |
23 | Login.gov provides a simple and secure process for signing into many government services with one account. It also lets you choose from several multi-factor authentication options, including phishing-resistant choices like security keys or the U.S. government’s PIV (personal identity verification) cards or CACs (common access cards).
24 |
25 | ### What do I need to do?
26 |
27 | 1. First, check which email address you use in the current registrar. Log in at [https://domains.dotgov.gov](https://domains.dotgov.gov) and click "Account" in the side navigation. If you need to update this address, please [contact us]({{ site.baseurl }}/help/#contact-us).
28 |
29 | 2. Next, [create a Login.gov account](https://www.login.gov/create-an-account/). Verify your identity to confirm you're you and not someone pretending to be you. Once you have your Login.gov account, you're all set. We'll email you when you can access the new registrar. (If you need assistance setting up your account, review [https://login.gov/help/](https://login.gov/help/).)
30 |
31 | *If you don't take these actions **before early November**, you will lose the ability to make changes to your domain's nameservers.* However, your DNS will remain unchanged and will still resolve online.
32 |
33 | ### What other changes impact my organization?
34 |
35 | * *Our contact details are changing*. We'll begin using help@get.gov for email correspondence and will end phone support in November. You can still [contact us]({{ site.baseurl }}/help/#contact-us) by phone until then.
36 |
37 | * *We will pause new domain requests while we transition to the new system*. We anticipate this will last from October 2023 until January 2024. You can [request to be notified](https://forms.office.com/g/aLbfNuuFD4) when domain registrations open again.
38 |
39 | * *Future domain name requests will not require a physical signature.* Our new request process is fully digital, so your ranking official won't need to sign a letter any longer.
40 |
41 | * *Expiration dates will be automatically extended on all domains by one year*. There's no action needed on your part.
42 |
43 | * *You will be responsible for certificate authorization*. Organizations that wish to use Organization Validated or Extended Validation certificates will need a public security contact in Whois for your domain, which can be set at our registrar.
44 |
45 | ### Changing for better
46 |
47 | We’re building a better way to get and manage a .gov domain. We’ve also shared other changes happening to the .gov infrastructure in a [blog on get.gov]({{ site.baseurl }}/updates/2023/9/6/infrastructure-as-a-public-service/).
48 |
49 | We’ll work to make these changes as easy as we can for the .gov community, and we welcome your feedback.
50 |
51 | \- The .gov team
52 |
--------------------------------------------------------------------------------
/pages/updates/2023-transition.md:
--------------------------------------------------------------------------------
1 | ---
2 | title: Infrastructure as a (public) service
3 | layout: docs
4 | permalink: /updates/2023/9/6/infrastructure-as-a-public-service/
5 | intro: Coming soon – a better way to get and manage a .gov
6 | subnav:
7 | - text: Three changes coming to .gov
8 | href: '#three-changes-coming-to-gov-this-fall'
9 | - text: How these changes impact governments
10 | href: '#how-these-changes-impact-governments'
11 | - text: Changing for better
12 | href: '#changing-for-better'
13 | ---
14 | ###### September 6, 2023
15 |
16 | *By: Cameron Dixon, .gov registry manager*
17 |
18 | It should be easy for governments to get a .gov domain – and hard to manage one insecurely. So, over the next few months, CISA will initiate major changes to the .gov top-level domain’s tech infrastructure, laying a foundation for the services we will offer in the coming years. We have great plans for making .gov the place governments want to be online.
19 |
20 | We [announced]({{ site.baseurl }}/updates/2022/9/14/making-infrastructure-less-invisible/) much of this work a year ago; here’s an update on our progress.
21 |
22 | ### Three changes coming to .gov this fall
23 |
24 | 1. **Moving the .gov registry and DNS**: The most critical element of our work, the *global publication of the .gov DNS zone and related registry software*, will transition to a new service provider. This shift will be carefully coordinated to ensure no impact to U.S.-based government organizations or the public, who depend on .gov websites and email addresses. (To be clear, we don’t run those websites or mail servers, but .gov is the supporting technology layer that makes them navigable online.)
25 |
26 | 2. **A new online home for .gov domains**: We’re launching a new *registrar*, the online home for governments to request and manage a .gov domain. We put the domain request process online (no more physical signatures required). The new registrar will enable many future features, like DNS hosting. Moving to the new registrar requires our users to take some actions, which we detailed in an [email to domain registrants]({{ site.baseurl }}/updates/2023/9/6/transition-email/).
27 |
28 | 3. **A new website for .gov**: Finally, we’re sharing a *beta version of our new website*, which will help governments learn about .gov and why they should use it. We’re still building and testing this site, so that’s why the URL is [beta.get.gov](https://beta.get.gov).
29 |
30 | Both the registrar and our new website are being developed as open source software. You can check out the code for [the registrar](https://github.com/cisagov/getgov) and our [beta site](https://github.com/cisagov/getgov-home) on GitHub.
31 |
32 | ### How these changes impact governments
33 |
34 | * *Our contact details are changing*. We’ll begin using help@get.gov for email correspondence and end phone support in November. You can still [contact us]({{ site.baseurl }}/help/#contact-us) by phone until then.
35 | * *We will pause new domain requests while we transition to the new system*. We anticipate this pause will last from October 2023 until January 2024. You can [request to be notified](https://forms.office.com/g/aLbfNuuFD4) when domain registrations open again.
36 | * *Future domain name requests will not require a physical signature*. Our new request process is fully digital, so your ranking official won’t need to sign a letter any longer.
37 | * *Expiration dates will be automatically extended on all domains by one year*. There’s no action needed on your part.
38 | * *You will be responsible for certificate authorization*. Organizations that wish to use Organization Validated or Extended Validation certificates will need a [security contact]({{ site.baseurl}}/help/security-best-practices/#add-a-security-contact) in Whois for your domain, which can be set at our [current registrar](https://domains.dotgov.gov).
39 |
40 | ### Changing for better
41 |
42 | We’re building a better and more secure way to get and manage a .gov domain, but we understand change can be hard. We'll work to make these changes as easy as we can for the .gov community, and we welcome your feedback.
43 |
44 | .Gov is infrastructure as a (public) service. This work sets the stage for everything good that will follow. For instance, in response to requests from many of you, we plan to offer DNS hosting for .gov domains by the end of 2024.
45 |
46 | If you have any questions or comments, feel free to [reach out to us](https://get.gov/help/#contact-us).
--------------------------------------------------------------------------------
/pages/updates/increase-security-passwords.md:
--------------------------------------------------------------------------------
1 | ---
2 | title: Increasing the security of passwords
3 | layout: docs
4 | permalink: /2018/4/17/increase-security-passwords/
5 | redirect_from:
6 | - /password-update/
7 | ---
8 |
9 | The DotGov registrar has added a security feature to prevent the use of passwords that have been identified in various publicly known data breaches. **All DotGov users will need to update their password** – even if your password has not been re-used or breached – in order for your account to be protected.
10 |
11 | ## Why is this change happening?
12 | The secrecy of your password is crucial to account security, and password reuse is the most common threat to password secrecy. An attacker who breaches one system’s password can often pivot to another system using those credentials.
13 |
14 | By ensuring that [passwords found in data taken from past public breaches](https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/) cannot be used, we minimize the threat of password reuse.
15 |
16 | To do this, we have to ask **all** DotGov users to reset their passwords, because the only practical way for us to implement this check is to do it at the moment a user selects a password. After a user sets their password, it is stored in such a way that it cannot efficiently be checked against lists of known-breached passwords.
17 |
18 | To be clear, this action is **not** being taken because of a breach on any DotGov-related system. The General Services Administration is proactively working to improve the security of the .gov zone for its users and administrators.
19 |
20 | ## What should DotGov users do now?
21 | 1. We **strongly recommend that you use a password manager** to generate and store a long, complex, unique password used only for the DotGov service.
22 |
23 | 2. Change your password at [https://domains.dotgov.gov](https://domains.dotgov.gov). If it’s in a publicly known data breach, you will be asked to select a different one. _If you get this alert and it’s a password you use anywhere else_, we urge you to **change your password in those applications**, too.
24 |
--------------------------------------------------------------------------------
/pages/updates/moving-to-cisa.md:
--------------------------------------------------------------------------------
1 | ---
2 | title: .gov is moving to CISA
3 | layout: docs
4 | permalink: /2021/3/8/moving-to-cisa/
5 | redirect_from:
6 | - /moving-to-cisa/
7 | subnav:
8 | - text: What's happening now
9 | href: '#whats-happening-now'
10 | - text: What's happening next
11 | href: '#whats-happening-next'
12 | ---
13 | ###### March 8, 2021
14 |
15 | .gov exists so that the online services of bona fide U.S.-based government organizations are easy to identify on the internet. Increasing and normalizing its use helps the public know where to find official government information -- *and where not to*.
16 |
17 | For those that use it, .gov is *critical infrastructure*: it's central to the availability and integrity of thousands of online services relied upon by millions of users. Since it underpins communication with and within these institutions, all aspects of .gov's administration have cybersecurity significance.
18 |
19 | ## What's happening now
20 |
21 | Because of this, the **[Cybersecurity and Infrastructure Security Agency](https://cisa.gov) will be the new policy and management authority for the .gov top-level domain** (TLD), assuming governance from the U.S. General Services Administration (GSA). This is happening under the DOTGOV Act of 2020, legislation that was part of the recently enacted [Consolidated Appropriations Act of 2021](https://www.congress.gov/bill/116th-congress/house-bill/133/text/enr#:~:text=dotgov). For more than 20 years, GSA has supported government organizations and worked to make .gov a trusted space. CISA is committed to that aim, too. We'll be good stewards of the program GSA created and .gov's shared infrastructure, and we thank the dedicated public servants at GSA for their work.
22 |
23 | For current .gov registrants, the transfer won't impact use of the [.gov registrar](https://domains.dotgov.gov/), which is where domains are managed, renewed, and where new domains can be requested. GSA and CISA are working together to ensure a seamless transition in day-to-day operations, which will be finalized by late April.
24 |
25 | ## What's happening next
26 |
27 | In the coming months and years, CISA intends to provide a user-centered platform for DNS management, help government organizations maintain better awareness of the security threats their .gov systems are exposed to, and offer additional services to support the privacy, reliability, accessibility, and speed of .gov domains.
28 |
29 | The DOTGOV Act reports Congress' finding that "the .gov internet domain should be available at no cost or a negligible cost" to U.S.-based government organizations. CISA is working on this -- and we ask for your patience. The way .gov domains are priced is tied closely with the service contract to operate the TLD, and change in the price of a domain is not expected until next year. The Act also contemplates the use of Homeland Security Grants for "migrating any online service" to .gov, a process we will work out with FEMA.
30 |
31 | .gov holds a unique place in internet history, and we couldn't be more excited to honor and build on that legacy. If you're from the government, we're here to help:
32 |
33 | - To obtain a .gov domain, check out [dotgov.gov](https://home.dotgov.gov/registration/).
34 | - If you're a U.S.-based government organization, we want to hear what you'd like to see in .gov and what challenges we can help resolve: email us at .
35 |
--------------------------------------------------------------------------------
/pages/updates/updates.md:
--------------------------------------------------------------------------------
1 | ---
2 | title: Updates
3 | layout: docs
4 | intro: What's happening around .gov
5 | permalink: /updates/
6 | subnav:
7 | - text: 2023
8 | href: '#2023'
9 | - text: 2022
10 | href: '#2022'
11 | - text: 2021
12 | href: '#2021'
13 | - text: 2020
14 | href: '#2020'
15 | - text: 2019
16 | href: '#2019'
17 | - text: 2018
18 | href: '#2018'
19 | - text: 2017
20 | href: '#2017'
21 | ---
22 | ### 2023
23 |
24 | * *November 17th*: **A new registrar**: We've emailed all .gov registrants with instructions on how to access the new .gov registrar.
25 |
26 | * *October 13th*: **[A temporary pause]({{ site.baseurl }}/updates/2023/10/13/transition-update/)**: new domain requests are paused until January 2024.
27 |
28 | * *September 6th:* **[Infrastructure as a (public) service]({{ site.baseurl }}/updates/2023/9/6/infrastructure-as-a-public-service/)**. In fall 2023, we'll launch a new registrar: a better way to get and manage a .gov domain.
29 |
30 | * *February 8th*: **[Updated requirements]({{ site.baseurl }}/registration/requirements/#executive-branch)** for federal executive branch agencies via [OMB Memorandum 23-10](https://www.whitehouse.gov/wp-content/uploads/2023/02/M-23-10-DOTGOV-Act-Guidance.pdf). The update details how domains are requested and which may be approved.
31 |
32 | * *January 31st*: **[The .gov zone file is available](https://czds.icann.org/home)** via ICANN's Centralized Zone Data Service. Learn more in [last September's blog post]({{ site.baseurl }}/updates/2022/9/14/making-infrastructure-less-invisible/#publishing-the-gov-zone-file).
33 |
34 | ### 2022
35 |
36 | * *September 14th:* **[Making infrastructure less invisible]({{ site.baseurl }}/updates/2022/9/14/making-infrastructure-less-invisible)**. Invisible consistency tends to be a trait of good infrastructure, but it doesn't have to be hidden.
37 |
38 | ### 2021
39 |
40 | * *July 21st:* **[About .gov, for elections]({{ site.baseurl}}/about/elections)**. We've added a page to help the election community learn about .gov.
41 |
42 | * *June 30:* **[A request for information](https://sam.gov/opp/78749b4fc58145568148dbdecfa83f6d/view)**. We released an RFI to gather feedback on our objectives for .gov's next phase.
43 |
44 | * *April 27:* **[A new day for .gov]({{ site.baseurl }}/2021/4/27/a-new-day-for-gov/)**. Domains are available to qualifying U.S.-based government organizations *at no cost*, and the registration requirements have been updated.
45 |
46 | * *March 8:* **[.gov is moving to CISA]({{ site.baseurl }}/2021/3/8/moving-to-cisa/)**. The .gov TLD is moving to the Cybersecurity and Infrastructure Security Agency.
47 |
48 | ### 2020
49 | * *June 21:* **[An intent to preload]({{ site.baseurl }}/2020/6/21/an-intent-to-preload/)**. HSTS preloading can protect individual domains names, but it can also be applied to a top-level domain.
50 |
51 | ### 2019
52 | * *July 17:* **[DNS change notifications]({{ site.baseurl }}/help/#will-i-be-notified-if-a-change-is-made-to-my-dns-information)**. Authorized .gov domain contacts will receive a system-generated email when a change is made to their DNS in the .gov registrar.
53 |
54 | ### 2018
55 | * *October 29:* **[GSA steps up security for .gov](https://digital.gov/2018/10/29/gsa-steps-up-security-for-dotgov/)**. This guest post on digital.gov summarized many of this year's activities.
56 | * *October 1:* **[Doing the 2-step]({{ site.baseurl }}/2018/10/1/doing-the-2-step/)**. We added a new feature – and made it mandatory – to improve the security of .gov registrar accounts.
57 | * *August 21:* **[Opt-in to preload your domains]({{ site.baseurl }}/management/preloading/)**. New .gov domains can opt-in to HSTS preloading at the time of registration.
58 |
59 | * *April 17:* **[Increasing the security of passwords](/2018/4/17/increase-security-passwords/)**. We minimize the threat of password reuse by ensuring that passwords found in data taken from past public breaches cannot be used.
60 |
61 | ### 2017
62 | * *January 19:* **[Automatic HTTPS enforcement for new executive branch .gov domains](https://www.cio.gov/2017/01/19/automatic-https.html)**. A guest post on cio.gov. As new executive branch domains are registered, they will be submitted to web browsers for “preloading.”
63 |
--------------------------------------------------------------------------------
9 | 
22 | 
32 |