.EXPOSED Domain Extension

Rules and conditions for registering a .EXPOSED domain

The .EXPOSED domain is operated by the registry Identity Digital (formerly Donuts). As such, its registration is subject to certain international compliance rules, including enhanced validations related to government sanctions and the management of reserved domain names.

Extended validation based on the OFAC list (U.S. sanctions)

The registry applies enhanced validation based on the OFAC (Office of Foreign Assets Control) sanctions list issued by the United States government.

How does this validation work? During registration (or contact creation), the system checks:

• the country
• the state / province (when this field is provided)

If the country + state/province combination matches a region listed under OFAC sanctions, the operation is automatically rejected.

The registry is not permitted to provide services to individuals or entities located in territories subject to U.S. government sanctions.

Reserved domains and the Allocation Token system

Some .EXPOSED domain names may be temporarily reserved by the registry (e.g., pioneer programs, direct sales, strategic partnerships).

In these cases:

• the domain remains in a reserved status
• the final registrant cannot register it immediately through a standard registrar

Solution: Allocation Token

The registry has implemented a feature called an Allocation Token:

• Donuts / Identity Digital generates a unique allocation token
• this token is provided to the future registrant
• during registration, the token allows the user to:
  • bypass the reserved status
  • complete the domain registration with the registrar of their choice

Without this token, registering a reserved domain is not possible—even if the domain name appears to exist technically.

General eligibility

Subject to the rules outlined above:

• the .EXPOSED domain is open to everyone
• there are no requirements regarding:
• residency
  • official academic status
  • institutional accreditation

It can be registered by:

• individuals
• businesses
• training centres
• organizations
• educational platforms
• anywhere in the world, excluding sanctioned regions.

Registry refusal or deletion rights

The registry reserves the right to:

• refuse a registration
• block the creation of a contact
• or delete an existing domain

if the information provided:

• violates OFAC rules
• circumvents geographic restrictions
• or breaches registry policies

These actions may be taken without a grace period, in accordance with international legal obligations.