.pw Domain: The Professional Web Rebrand and Its Reputation Problem

.pw is the country-code domain for Palau, a Pacific island nation of around eighteen thousand people, and it has been marketed since 2013 under the backronym Professional Web — which is why almost nobody who registers one has any connection to Palau.

That repositioning made .pw cheap and globally open, and cheap and globally open is a combination that attracts a specific kind of registrant. The result is a domain with a real reputation problem that registrar pages will not mention. This post covers what that actually means in practice, because the answer is more nuanced than avoid it and less comfortable than it is fine.

Table of contents

• What .pw is and how it became Professional Web
• The spam reputation, and how much of it is still true
• What to check before you build on one
• If you use it anyway, configure mail properly
• When .pw makes sense
• How this fits the rest of the stack
• FAQ

What .pw is and how it became Professional Web

Palau’s ccTLD was delegated in 1997 and did essentially nothing for fifteen years. In 2013 the registry relaunched it globally with the Professional Web positioning, aggressive registrar pricing, and no restriction on who could register.

This is a well-worn playbook for small-nation ccTLDs. Tuvalu’s .tv, Montenegro’s .me, Anguilla’s .ai and Guernsey’s .gg all did versions of the same thing: a coincidentally useful two-letter code turns into an export product, and the registry income becomes materially significant to a very small economy.

What made .pw different from those was price. .tv and .ai went premium. .pw went cheap — often the cheapest non-free option on a registrar’s list. That single decision shaped everything that followed.

There is no residency requirement, no local presence, no business registration. Registration is open worldwide through standard registrars, and the whole process is identical to registering a .com.

The spam reputation, and how much of it is still true

Within months of the 2013 relaunch, .pw appeared near the top of spam-source rankings by TLD. The mechanism is not mysterious: bulk-registration abuse follows price. When a domain costs very little, burning through hundreds of them for phishing campaigns is economically viable in a way it is not at fifteen dollars each.

The registry responded — anti-abuse policies, faster takedowns, registrar-level controls — and the raw abuse numbers came down substantially from that peak. That part is genuine and worth saying plainly.

But reputation systems have long memories and coarse granularity. Some spam filters, corporate email gateways, and web proxies still apply a TLD-level penalty to .pw, and a TLD-level penalty does not care that your particular domain is clean. You inherit the neighbourhood’s score.

The practical consequence is asymmetric. Web traffic is mostly fine — browsers do not block by TLD and search engines evaluate domains individually. Email is where it hurts, and it hurts most in exactly the enterprise environments where you least want your invoice to land in a quarantine folder.

What to check before you build on one

If you are considering .pw for anything that matters, run these checks first rather than discovering the answers in production.

1. Send test mail from the domain to accounts on the major consumer providers and, more importantly, to a corporate address behind a commercial gateway. Check whether it lands in inbox, spam, or nowhere.
2. Look up the specific name you want in the common domain-reputation and blocklist services. A previously-registered name may arrive with baggage that has nothing to do with you.
3. Check the WHOIS creation date. A name that has been registered and dropped repeatedly is a name that has been used for something, and drop-catch cycles are a reliable signal of prior abuse.
4. Search the domain string. If the previous owner did something memorable, it is generally still on the first page of results.

If the domain is only ever going to serve a website and never send mail, the reputation issue shrinks to near zero and the price advantage is real. If it is going to send transactional email — password resets, receipts, notifications — the deliverability risk is the dominant consideration and it is not one you can engineer away entirely.

If you use it anyway, configure mail properly

Every domain should have complete mail authentication. On a domain with an inherited reputation problem it moves from good practice to the minimum entry fee.

• SPF, listing exactly the hosts permitted to send for the domain and ending in -all rather than ~all once you are confident the list is complete.
• DKIM, with the signing key published and the signature applied by whatever actually sends your mail.
• DMARC, starting at p=none with an rua address so you can read the reports, then tightening to quarantine and eventually reject once the reports are clean.
• A dedicated subdomain for transactional mail, so that a reputation problem on marketing sending does not take password resets down with it.

If the domain will never send mail, say so explicitly in DNS: an SPF record of v=spf1 -all and a DMARC policy of p=reject. That is a clear statement that any mail claiming to be from you is forged, and it prevents your unused domain being used to spoof.

None of this overrides a TLD-level filter. It does mean that every filter which evaluates the domain on its own merits will find nothing wrong, which is the most you can control.

When .pw makes sense

It makes sense for short-lived projects, internal tools, redirects, and anything where the domain is a technical handle rather than a brand people read. A staging environment on a cheap domain is a perfectly sensible use of eight dollars.

It makes sense as a domain hack where the letters carry meaning, though .pw reading as password is a joke that has been made by a great many people already.

It does not make sense as the primary domain for a business that sends email to customers or that needs to look established to a cautious buyer. The saving over a normal domain is a few tens of dollars a year, and one email that fails to reach a client costs more than that.

Which is the general shape of the domain decision: the name is a rounding error against the running cost of the thing it points at, so optimising the name for price is usually optimising the wrong variable.

How this fits the rest of the stack

A cheap domain does not make a cheap project. The service that answers the request, the database behind it, the storage and the bandwidth are where the recurring cost sits, and they are the numbers worth modelling before you build. The RunxBuild hosting calculator lays those out together so the monthly figure is not a surprise. Whatever the name after the dot, RunxBuild handles the custom domain and its certificate as part of the deploy, so pointing the record is the last DNS step rather than the first of several.

Useful related references:

• What Is a .link Domain, and When Does It Fit a Project?
• Domain Squatting: What It Is, What You Can Do, and What Is Not Worth Doing
• What Is a Parked Domain? And Why Yours Might Be a Liability
• Custom domains and certificates on RunxBuild

FAQ

Is a .pw domain safe to use?

Technically yes — it resolves normally, gets certificates normally, and browsers do not treat it specially. The risk is reputational rather than technical: some email gateways and web proxies still apply a penalty at the TLD level, which affects your domain regardless of how clean it is.

Does .pw stand for password?

No. It is Palau’s country code, delegated in 1997. The registry markets it as Professional Web, which is a backronym applied at the 2013 global relaunch, and the password reading is a coincidence people enjoy.

Will email from a .pw domain get delivered?

It varies by recipient. Consumer providers largely evaluate the individual domain, so a properly authenticated .pw with clean sending history generally delivers. Corporate gateways are more likely to apply TLD-level scoring. Test against a real corporate address before committing to it for transactional mail.

Can anyone register a .pw domain?

Yes. There is no residency, business, or local-presence requirement, and registration goes through ordinary registrars exactly as it does for a .com.

Does using .pw hurt search rankings?

Search engines evaluate domains individually rather than penalising a whole TLD, so a legitimate site on .pw can rank normally. The reputation issue shows up in email filtering and some corporate web proxies, not in organic search.