# zz.ac: free domains without phishing

> A reputation-building registry with domains, shell accounts and mailboxes.

By Zsolt Bizderi · Published 2026-08-10
Canonical: https://ambientnode.uk/zz-ac-free-domains-without-phishing

In July, [Freenom came back](https://webhosting.today/2026/07/27/freenom-is-back-and-no-longer-free-the-free-domain-registry-behind-years-of-phishing/).

Freenom used to give away free domains in five country-code extensions, including the infamous Tokelau's .tk, which by 2016 was the largest ccTLD on the planet at over 31 million registrations. By 2022 its extensions accounted for more than 60% of all reported phishing domains across every ccTLD on the internet.

Meta [sued](https://krebsonsecurity.com/2023/03/sued-by-meta-freenom-halts-domain-registrations/) and registrations were halted. Phishing on those extensions collapsed to below 15% overnight. The company later settled, promised to exit the domain business, and 12.6 million domain names stopped resolving. On 23 July 2026 Freenom resumed selling .tk, .cf and .gq, but they are charging €8.22 a year for them now.

So, what now?

***

## The ZZ.AC Project

zz.ac is a free domain registry operated as [nic.zz.ac](https://nic.zz.ac/) by Tao, a veteran technologist in China who runs the domain himself and remains its sole maintainer. The purpose of the project is to give hobbyists a free, short domain for learning and experimenting, with enough oversight to avoid turning it into another Freenom. Registration is open to anyone.

.ac reads as academic, and zz is the one two-letter code in ISO 3166-1 permanently reserved for no country at all, so ZZ.AC is an academic namespace belonging to everyone and nowhere.

***

## Reputation Building & Delegation

The anti-abuse stack builds on your reputation instead of an economic barrier. Anyone can apply, but you register under your real details, and you have to state what the name means and what you intend to do with it. Applications are reviewed, and once approved you have ten days to publish an HTTPS site on your main domain. Automated checks verify this, and domains get reclaimed if they don't. Bulk abuse relies on names becoming dormant or being used once and discarded, so having to actually build and maintain something is the barrier.

Registrants cannot set NS records by default, so you cannot delegate to your own nameservers or third-party DNS. Delegation only works when the delegate has something to lose, and a free registry giving NS records to strangers has no such guarantee. It is what happened to us.kg, heavily exploited for phishing and [suspended](https://securityonline.info/kg-domain-drama-us-kg-briefly-suspended-now-restored/) twice within three months by the Kyrgyz registry as a result.

This is a temporary measure. The [deSEC](https://desec.io/) integration is the working example of how this operates: you host your zone there, zz.nic holds the API token, and periodically polls your records. If it detects NS entries or wildcards, they are removed. The same is planned for registrants running their own authoritative servers, who will need to add zz.nic as a slave node so it can pull the child zone and audit it.

DNSSEC is part of this, the zz.ac zone is signed with Ed25519 in split KSK/ZSK mode, and once delegation opens up, zz.nic plans to synchronise CDS/CDNSKEY from child zones automatically and make DNSSEC a requirement for anyone running their own.

## VPS Access

Every registrant can also claim a Linux account on a shared host with an unprivileged user, no root, and your own network namespace.

The network was built with anti-abuse practices at its core. Your namespace has no routable address and no default route, just link-local on the veth pair, fe80::1/64 on the host end and fe80::2/64 on yours. So, nothing at layer 3 leaves and outbound HTTP goes through TinyProxy on the host, with the proxy variables pre-set in your shell. Inbound arrives via Caddy, which pulls your name out of the Host header and reverse-proxies to [fe80::2%ve-$domain]:8080. Both directions are forced through a proxy the operator controls. You can't port scan or run a tunnel because there's no socket to do it with. The proxy also logs which domains each user reaches, so scraping activity can be identified retrospectively.

Applying is done entirely through DNS. You can point a subdomain at the host with lab CNAME h1.lab.zz.ac., then publish your SSH public key as a TXT record at \_sshpk.lab. After submitting the subdomain in the domain management panel, it queries both records and verifies them, then provisions the account. You then ssh example@lab.example.zz.ac, with the username fixed to your main domain label.

Once in, your service listens on port 8080. No root access means no system packages, so Nix is the recommended route, and rootless podman is available if you want containers.

## The Ecosystem

Beyond domain management and VPS access, you also get yourdomain@zz.ac as a mailbox, @yourdomain:zz.ac on Matrix, yourdomain@zz.ac on ActivityPub, and a profile page at zz.ac/@yourdomain. The wider platform is fediverse-native by design:

* **Matrix:** Live on a tuwunel instance at matrix.zz.ac, with an Element client at chat.zz.ac. The project's Telegram group is being retired in favour of #nic:zz.ac.
    **ActivityPub:** Migrating from Mastodon to GoToSocial.
* **Zmail:** A @zz.ac mailbox on Postfix, Dovecot and rspamd with passkey-bound accounts.
* **DDNS:** Per-subdomain tokens with a declared purpose. Supports A, AAAA and ACME DNS-01, so you can issue certificates for a home server behind a blocked port 80.
* **The resolution layer:** Two nameservers; dm-us.dns.zz.ac is self-hosted, on a CN2-GIA line for latency into mainland China. ng-zz.dns.zz.ac points at ns-global.zone, anycast almost everywhere except China. Hurricane Electric was dropped because its AXFR took five to ten minutes, too slow to be useful for DDNS.

***

## Supporting the project

Tao has written openly about what happens if he stops, with everything under zz.ac disappearing with him. The plan is to move from a solo project to a team and eventually a legal entity, on the grounds that a public suffix cannot stay one person's private property. So if the idea appeals, you can become a maintainer. Contributors are welcome, otherwise the simplest support is to claim a name at [nic.zz.ac](https://nic.zz.ac) and actually build something on it.

Relevant links, mostly in Chinese, but browser translation handles it pretty well:

* [Why zz.ac exists](https://tao.zz.ac/dns/zz-3.html)
* [Main user guide](https://tao.zz.ac/zz/hello.html)
* [Delegation, deSEC, and why NS records are earned](https://tao.zz.ac/dns/zz-desec.html)
* [tiny-vps for registrants](https://tao.zz.ac/zz/free-host.html)