Yes, the TLD matters, as a secondary factor after authentication, list quality and volume. Use .com first, with .net, .org and .co close behind. A few low-abuse premium extensions (.io, .sh, .vc, .to) are good choices for a single apex domain with subdomains under it. Avoid cheap, bulk-registered TLDs: in Spamhaus's latest Domain Reputation Update, .cfd had 17.5% of its entire zone listed as malicious or suspicious, against roughly 0.3% for .com by our calculation from the same report.
Why the TLD matters at all
A top-level domain (TLD) is the last part of a domain name: .com, .net, .io. Filters don't publish how they score them, but the logic is easy to follow. Spammers churn through huge numbers of cheap domains, and they concentrate on whichever extensions are cheapest and least policed at the time. When a large share of the domains on one TLD are abusive, filters and blocklists treat new senders on that TLD with more suspicion, and legitimate senders on it pay for their neighbors.
It is still a secondary factor. A .com with broken authentication, an unverified list and 100 cold emails a day per mailbox will land in spam. A well-run domain on a reputable extension gets the benefit of the doubt it needs.
What the abuse data says
The most useful public data is Spamhaus's twice-yearly Domain Reputation Update. The October 2025 to March 2026 edition, published April 15, 2026, ranks TLDs two ways.
By share of the TLD's zone that Spamhaus listed as malicious or suspicious (the fairer measure, because it adjusts for size). Spamhaus treats 5% listed as a red flag and says anything above 10% is clearly a problematic TLD:
| Rank | TLD | Listed domains | Zone size | Share of zone listed |
|---|---|---|---|---|
| 1 | .cfd | 93,940 | 535,716 | 17.54% |
| 2 | .qpon | 8,157 | 67,024 | 12.17% |
| 3 | .icu | 46,350 | 476,188 | 9.73% |
| 4 | .bid | 3,278 | 38,586 | 8.50% |
| 5 | .xin | 4,931 | 62,251 | 7.92% |
| 8 | .bond | 59,271 | 1,147,185 | 5.17% |
By number of listed domains, the biggest zones lead simply because they are big: .com (506,482), .top (270,121), .cn (252,852), .cc (94,415) and .cfd (93,940). The same report gives zone sizes for the largest gTLDs, so the share can be worked out. By our arithmetic from Spamhaus's figures:
| TLD | Listed domains | Zone size | Share listed (our calculation) |
|---|---|---|---|
| .org | 31,057 | 12,342,109 | about 0.25% |
| .com | 506,482 | 168,024,226 | about 0.30% |
| .net | 43,593 | 12,803,743 | about 0.34% |
| .xyz | 47,547 | 8,205,754 | about 0.58% |
| .top | 270,121 | 11,398,102 | about 2.4% |
Read these as relative risk, not as inbox rates. They describe how much abuse lives on each extension, which is what drives filters' default suspicion. They say nothing about any one well-run domain. Spamhaus also notes that the data reflects only the abuse it observed.
Two trends from the same report are worth knowing: listings on .xyz grew 20% on the previous six months, and .io entered Spamhaus's top 20 ccTLDs by listings for the first time (2,194 listed domains, #18), which Spamhaus links to strong growth in new .io registrations.
TLD tiers for cold email
| Tier | Extensions | Use for | On Winnr |
|---|---|---|---|
| Best default | .com | Anything, including your primary sending domains | Classic purchase, about $13 one-time |
| Strong alternatives | .net, .org, .co | Extra sending domains, or when the .com is taken | Classic purchase, one-time, price shown before you buy |
| Premium low-abuse | .io, .sh, .vc, .to | One apex domain carrying several subdomains | Subdomain Strategy only; cost more than the standard four |
| Avoid | .cfd, .icu, .top, .xyz, .bond, .shop, .online, .site, .info and other cheap bulk TLDs; .ai and most new vanity TLDs | Not cold email | Not registrable through Winnr |
.com is the safest choice: filters treat it as neutral, and recipients don't look twice. .net and .org are old, stable and widely accepted (.org reads slightly unusual for commercial outreach). .co has growing commercial use and works well as a .com backup. These four are what Winnr registers through its Classic domain purchase, and connecting domains you already own isn't limited to them.
The premium extensions: .io, .sh, .vc, .to
Earlier versions of this guide put .io in a "middle tier" alongside country codes such as .uk and .de. That undersold it, and it didn't match how Winnr actually uses these extensions. Here is the reconciled view.
.io, .sh, .vc and .to are country-code TLDs that are widely used commercially, priced well above the bulk-registration TLDs, and have low abuse relative to them. That makes them a good fit for one specific shape: the Subdomain Strategy, where you register one apex domain and Winnr provisions up to 5 subdomains under it, each a full email domain with its own MX, SPF, DKIM and DMARC and up to 10 mailboxes. You register far fewer domains, and the ones you do register sit on extensions that blocklists rarely see abused. Winnr sells these four only through that route, and they cost more per domain than .com.
Two honest caveats. First, ".io entered Spamhaus's top 20" is a signal to keep watching as .io grows; its listing count is still tiny next to the gTLDs above. Second, the Subdomain Strategy concentrates more mailboxes on one registered domain, so a listing on that apex affects every subdomain under it. It is a different risk shape from many separate .com domains, not a strictly safer one, which is why it is offered as an alternative, not as the default.
If you don't want a premium extension, the Subdomain Strategy also works on .com, .net, .org and .co.
TLDs to avoid
- Cheap bulk-registration TLDs (.cfd, .icu, .top, .xyz, .bond, .shop, .online, .site, .info and similar). They dominate Spamhaus's concentration rankings, and filters treat them with suspicion by default. A warmed, authenticated domain on one of them still starts behind a fresh .com.
- .ai, .app, .dev and other new or provider-specific extensions. Not necessarily abusive, but not worth the risk for cold email. Keep .ai for your website if you like, and send from a .com.
- Country codes for regions you don't operate in with poor reputations (for example .ru or .cn). Spamhaus lists .cn and .ru among the top ccTLDs by listings.
Choosing and mixing TLDs
- Start with .com for every domain you can, then fill gaps with .net, .co and .org rather than a cheaper extension.
- Mixing standard extensions is fine. getacme.com, acmehq.net and tryacme.co spread risk without adding TLD risk.
- Don't save money on the TLD. On Winnr every domain is a one-time purchase, so the difference between a .com and a cheap extension is a few dollars once. A domain that underperforms costs far more in lost replies.
- Size the fleet before you buy. At 5 mailboxes per domain and 10 to 20 cold emails per mailbox per day, each domain carries 50 to 100 cold emails a day. The cold email calculator gives you the domain count; how many domains you need explains the math.
- Need to send this week? Pre-warmed mailboxes come on aged domains with their mailboxes already warmed, and each listing shows its TLD, age and a live blocklist check.
Frequently Asked Questions
Does the TLD really affect deliverability?
Yes, as a secondary factor. Filters treat TLDs with heavy abuse more cautiously by default. Authentication, list quality and volume matter more, but an all-else-equal domain on a cheap, heavily abused TLD starts behind a .com.
Which TLD is best for cold email?
.com, with .net, .org and .co close behind. For a single apex domain carrying several subdomains, the low-abuse premium extensions .io, .sh, .vc and .to are also good choices.
Is .io safe for cold email?
Yes, used sensibly. .io is widely used commercially and has low abuse compared with cheap bulk TLDs. It did enter Spamhaus's top 20 ccTLDs by listings for the first time in the October 2025 to March 2026 report, with 2,194 listed domains, as .io registrations grew, so it is worth watching. On Winnr it is offered through the Subdomain Strategy.
Does .xyz hurt email deliverability?
It starts with more suspicion than a .com. .xyz is the second-largest gTLD by new registrations in Spamhaus's latest report, and its listings grew 20% on the previous six months. Winnr doesn't register .xyz for cold email.
Can I use a domain on another TLD that I already own?
Yes. Connecting a domain you already own to Winnr isn't limited by extension. The TLD list only covers what Winnr will register for you.
Should I use .ai for cold email?
Keep .ai for your website if you like, and send cold email from a .com or another standard extension. Winnr doesn't register .ai domains.
Sources
- Spamhaus, Domain Reputation Update, October 2025 to March 2026 (published April 15, 2026; figures from the full report). Shares marked "our calculation" divide Spamhaus's listed-domain counts by the zone sizes given in the same report.
- Winnr Help Center, TLD guide (which extensions Winnr registers) and Subdomain Strategy.
Related guides: Aged vs new domains, IP vs domain reputation and cold email best practices.