VeriSign (VRSN): Moat Analysis

31 August 2026. First assessment. Written against VeriSign's Q2 2026 results of 23 July, the .com cooperative agreement with the US Department of Commerce as it stands, and the delegation of .web into the root zone.

This document asks one question: how strong is the moat, and is it still intact. It contains no price, no position and no target. VeriSign runs the registry for .com, the single most valuable piece of naming real estate on the internet, at a 68% operating margin, under a contract that grants it that role exclusively. That combination is exactly why the moat has to be judged on its own, before any price is looked at.

0. Verdict

Field	Reading
Strength	Exceptional in durability, with an unusual ceiling on its own pricing. A contractual monopoly over the internet's default namespace, impossible to replicate, but whose price is set by an external authority rather than by VeriSign
Condition	Intact. The contracts are in force, the domain base is at a record, and the price path is contractually fixed and being taken
Verdict	Verdict | Exceptional / Intact / Level 3 demand. Declined at the third gate: the moat is exceptional and undamaged, but the demand rests on domains staying central to the internet, which is durable but not guaranteed to survive a shift in how people navigate
Security	Moderate. No competitor can reach the mechanism, but the mechanism exists because two external bodies, the US government and ICANN, grant it, and they set the terms
Pricing authority	Constrained by contract. Real and rising, but capped at a rate the Department of Commerce permits, not chosen by VeriSign
Demand anchoring	Level 3. The demand VeriSign serves is the use of the domain name system, .com as the internet's addressing standard. That is deeply embedded and has a real annual renewal cycle, but it rests on a technological and habitual trajectory, not on a biological necessity or a permanent human drive, and it is exposed to a structural shift in how the internet is navigated (see A4). Durable, but without the guarantee level 1 or level 2 carries
Class A conditions	0 of 6 triggered. The contractual framework is intact and the price path is set through the current terms
Class B gauges	0 of 6 triggered. Domain base at a record, new registrations at an all-time high, margins expanding
Decision	Not eligible for a Layer 2 entry, and the gate it fails is demand, not the moat. The moat is exceptional and intact, contractually guaranteed and technically unassailable. What holds it out of the buy list is the third gate: the demand rests on the domain staying central to how the internet is navigated, which is level-3, durable with a real renewal cycle but resting on a technological and habitual trajectory rather than a biological or human-drive anchor. If AI and new navigation shift the internet away from typed domains, the demand could plateau permanently without the monopoly ever being breached, and a drawdown then would not reliably reverse. A flawless, contractually protected monopoly on demand that could structurally erode is not a drawdown that can be waited out on faith

In one line: the company that owns the deed to .com by contract, earns a monopoly's margins on it, and depends for both the deed and the price on a government that could, in principle, change either.

Why the verdict reads this way. VeriSign's Q2 2026 numbers are the fingerprint of a monopoly: revenue up 6% to $435 million, a 68% operating margin, a record 12.7 million new registrations, a domain base of 179.1 million, and 29 years of 100% uptime on the .com and .net resolution system. On the numbers this is as clean a monopoly as exists. And unlike most names in this set, the mechanism and the numbers agree: the moat is genuinely intact, because VeriSign's exclusive right to run .com is written into a contract and its technical position is unassailable. What holds the verdict just below the theoretical top is not a threat to the monopoly but a permanent feature of it: VeriSign does not set its own price. The wholesale fee for a .com domain is governed by a cooperative agreement with the US Department of Commerce, and VeriSign can only raise it at the rate that agreement permits. It has a monopoly whose pricing is regulated, which is an extraordinarily durable position with a ceiling that a truly unconstrained monopoly would not have.

How strength and condition are judged is in the annex.

1. What the company does

VeriSign operates the registries for .com and .net, the databases that make those domain names work. Every time someone types a .com address, VeriSign's systems are what translate it into the location of the right server, and every .com domain that exists is registered through VeriSign's registry.

The business is narrow and deep. VeriSign does not sell domains to the public; registrars like GoDaddy do that. VeriSign sits one level up, as the wholesale operator of the registry itself, and charges a fee for every .com and .net domain registered or renewed, per year, to the registrars. Because it runs the registry that every registrar must use for these domains, it earns a fee on all 179 million of them, with almost no cost per additional domain. The result is a 68% operating margin and enormous free cash flow, almost all of it returned to shareholders.

How the money is actually made

VeriSign charges a fixed annual wholesale fee per domain, currently $10.26 for a .com, rising to $10.97 in November 2026. Multiply a small fee by 179 million domains, renewed annually, and the result is roughly $1.75 billion of highly predictable revenue at a cost base that barely moves whether the registry holds 170 million or 180 million names.

The economics are almost pure operating leverage. Running the registry, the servers, the security, the 100% uptime, costs roughly the same regardless of how many domains sit in it, so each additional domain and each price increase falls almost entirely to profit. This is why the operating margin sits at 68% and free cash flow nearly doubled year on year to $213 million in the quarter.

Why the contract is the whole business

VeriSign's right to operate .com is not something it won in a market and must keep defending. It is granted by contract, and the contract is the business.

Two agreements govern it. VeriSign holds the registry agreement with ICANN, the body that coordinates the internet's naming system, which gives it the operational role. And .com uniquely sits under a cooperative agreement between VeriSign and the US Department of Commerce, through the NTIA, which governs the pricing. This second agreement is what makes .com different from every other domain: its price is not set by VeriSign or by the market, but permitted by the US government at a defined rate. As management puts it, .com is the only top-level domain in the entire industry regulated by a cooperative agreement with the Department of Commerce.

That is why the contract is the moat and also the ceiling. The contract guarantees the monopoly, which no competitor can touch. The contract also caps the pricing, which VeriSign cannot exceed. Both facts flow from the same source, and both are the subject of the register below.

Where the money came from in Q2 2026

Revenue was $434.6 million, up 6% year on year, from growth in the domain base and prior price increases. Operating income was $296.3 million, a 68.2% operating margin. Net income was $216.5 million and diluted EPS $2.38, up 7.7%. The domain base reached 179.1 million .com and .net names, up 5.1% year on year, with a record 12.7 million new registrations in the quarter, up 21%. The renewal rate was 75.2%, down slightly. Free cash flow was $213 million. A $0.71 wholesale price increase on .com, to $10.97, is locked in for November 2026. VeriSign also had .web delegated into the root zone, with a launch expected late 2026 or 2027, and raised full-year revenue guidance to $1.745 to $1.755 billion.

2. The moat

VeriSign's moat is a contractual monopoly deepened by .com's position as the internet's default namespace, with reinforcing layers around it. The honest work is being precise about why it is exceptionally durable and where its one real limit, self-pricing, comes from.

Layer	Mechanism	Why it works
Foundational	The contractual monopoly over .com and .net	Exclusive right to operate the registries, granted by contract, that no competitor can obtain
Foundational	.com as the coordination standard for the internet	.com is the default namespace the whole world assumes, so leaving it is not a real option for holders
Reinforcing	The switching cost of a domain	A business's domain is its identity, its email, its links; changing it is disruptive and risky, so renewals are near-automatic
Reinforcing	Near-zero marginal cost and operating leverage	Each domain and each price rise falls almost entirely to profit
Reinforcing	Technical trust and reliability	29 years of 100% uptime on critical infrastructure that a replacement would have to earn
Optional	New TLDs, .web, and security products	Real options, .web with pricing freedom .com lacks, but not what the core moat rests on

Foundational: the contractual monopoly

This is the moat, and it is as durable as a monopoly gets, because it does not depend on out-competing anyone. VeriSign has the exclusive contractual right to operate the .com registry. No competitor can offer a .com domain, because there is only one .com registry and VeriSign runs it by agreement with ICANN and the US government. This is not a market position that must be defended quarter by quarter; it is a granted right, renewed on terms, that competitors cannot bid away because .com is not re-tendered in any ordinary sense.

The .com registry agreement contains a presumptive right of renewal, which means that so long as VeriSign meets its operational obligations, and 29 years of perfect uptime is the evidence it does, the contract renews. This is why the monopoly has persisted for decades and why it is reasonable to treat it as durable rather than contested. The right is not permanent in the absolute sense, no contract is, but it is structured to continue, and the practical bar for losing it is failure to perform, which VeriSign has never come close to.

Three things follow, and the third is the defining limit.

The monopoly produces monopoly economics: a 68% operating margin, near-total operating leverage, and predictable recurring revenue, because every .com in the world pays VeriSign a fee every year.

The monopoly is technically and legally unassailable by any competitor: there is no second .com, no way to build one, and no route by which a rival could offer the same product.

And the monopoly's pricing is not the monopoly's to set. Because .com sits under the Department of Commerce cooperative agreement, the wholesale price is capped at a permitted rate. VeriSign has a monopoly whose single most valuable lever, price, is held by an external authority. That is the one feature that separates it from a fully unconstrained monopoly, and it is why the strength reading, though exceptional in durability, is qualified.

Foundational: .com as the coordination standard

The contract grants exclusivity, but what makes the exclusivity so valuable is that .com is the default namespace of the internet. When a person thinks of a website, they assume .com. When a business chooses a domain, .com is the one it wants, and the alternatives are fallbacks. This is a coordination standard exactly like a language: .com is valuable because everyone treats it as the default, and everyone treats it as the default because everyone else does.

This deepens the moat well beyond the contract. Even if a competitor could somehow offer an alternative, holders would not move, because the value of a .com is that the whole world recognises it. A business's customers, links, search rankings and email are all built on its .com, and a different extension is not an equivalent. The standard is why the switching cost is so high and why renewal rates, around 75% overall and far higher for established commercial domains, are so durable. The contract keeps competitors out; the standard keeps holders in.

The asymmetry that defines it, and where the limit sits

The strongest moats are the ones where the only party who can damage the mechanism is the company itself. VeriSign's monopoly is nearly untouchable by any competitor, but it is unusual in that the party who defines both its existence and its price is external: the US government and ICANN.

This is not a threat in the way a competitor is a threat. The government has renewed the arrangement for decades and has every reason to value a stable, secure, perfectly reliable operator of critical internet infrastructure. But it is a dependency, and it cuts two ways. The same authority that grants the monopoly sets the price, so VeriSign's pricing power is permitted rather than owned, and the terms of renewal, including the allowed price path, are periodically negotiated and are subject to political and regulatory attention. Security therefore reads moderate: no competitor can reach the mechanism, but the mechanism is a grant from two external bodies who set its terms, which is a different and more benign dependency than a rival, yet a real one.

Reinforcing: the switching cost of a domain

A domain name is a business's identity. Its website, its email addresses, its printed materials, its search-engine history and its inbound links are all tied to it. Changing it is not like switching a supplier; it is like changing a company's name and address at once, with a risk of losing traffic and trust. This makes renewals close to automatic for any domain that matters, and it is why the renewal rate is stable and high for commercial names. The switching cost is what turns the annual fee into a near-perpetual annuity per domain.

Reinforcing: operating leverage

The registry costs roughly the same to run at 179 million domains as at 170 million, so growth in the base and increases in price fall almost entirely to profit. This is the mechanism behind the 68% operating margin and the near-doubling of free cash flow, and it means the business converts its monopoly into cash with extraordinary efficiency. It is reinforcing rather than foundational because it amplifies the monopoly's value rather than creating it.

Reinforcing: technical trust and reliability

Twenty-nine years of 100% availability on the .com and .net resolution system is not a marketing line; it is a genuine barrier. The registry is critical internet infrastructure, and the standard of reliability, security and stability VeriSign has maintained is part of why the government and ICANN have every reason to keep renewing it, and part of why any hypothetical replacement would be a risk no one wants to take. Reliability is a reason the contract renews, which folds back into the foundational layer.

Optional: new TLDs, .web and security products

VeriSign has had .web delegated into the root zone and expects to launch it, and it is developing security products. The interesting feature of .web is that, as management notes, it is governed by a standard ICANN registry agreement rather than the Department of Commerce cooperative agreement, so VeriSign has complete wholesale pricing flexibility on it and can sell premium names, which it cannot do for .com. This is a real option and a genuine contrast: .web is a smaller opportunity but with the pricing freedom .com lacks. These are placed as optional because none is material to revenue today and the core moat rests entirely on .com and .net. They are recorded so their promise is never read as evidence about the core, and so that if .web becomes material, a later revision reclassifies it deliberately.

Governance, as it bears on the moat

Governance is a normal, disciplined US public-company structure with a long-tenured leadership and a shareholder-return focus, and it is not the relevant defence for the moat. Its quality is not a flaw, but no governance structure protects against the one real dependency, the government and ICANN setting the terms. Governance provides no guard against that, and it is more useful to say so than to score it as though it did. What governance does provide, relevant to the moat, is a demonstrated commitment to the operational excellence, the 100% uptime, that keeps the contract renewing.

Evidence of strength: the competitive record

The strength of the moat is shown by the fact that there is no competitive record to speak of, which is itself the evidence. For decades, no competitor has taken a .com registration from VeriSign, because none can: there is one .com registry and VeriSign holds it. The domain base has grown through cycles to a record 179 million, and the monopoly has never been contested in the market, because it is not contestable in the market. This is the record of a granted monopoly rather than a won one.

The honest counterweight is that a granted monopoly's durability is only as good as the grant, so the relevant record is not competitive but contractual: how the arrangement has been renewed and repriced over time. That record is favourable, decades of renewal and permitted price increases, but it is subject to periodic negotiation and to political scrutiny of both the price and the exclusivity, which is where the real, if slow, risk lives. The absence of competition proves the monopoly; the terms of the contract determine its value.

Evidence of strength: pricing power

VeriSign's pricing power is real, demonstrated and, uniquely in this set, explicitly capped. It has a locked-in right to raise the .com wholesale price to $10.97 in November 2026, and it has taken permitted increases repeatedly, each one falling almost entirely to profit because the cost base does not move. That is genuine, contractually secured pricing power that a competitor cannot undercut.

The qualification is fundamental and is the reason the verdict does not call pricing unconstrained. The price is permitted by the Department of Commerce at a defined rate, not set by VeriSign at the level a monopolist would choose. A true unconstrained monopoly over the internet's default namespace could price far higher; VeriSign cannot, because the cooperative agreement caps it. So the pricing power reads strong and contractually secured on the upside, but constrained by an external authority on the ceiling, which is a genuinely unusual combination: guaranteed but capped.

Evidence of strength: the financial fingerprint

The numbers are the fingerprint of a monopoly with operating leverage. A 68% operating margin, a domain base at a record, new registrations at an all-time high, free cash flow nearly doubling, and over 100% of free cash flow returned to shareholders over the trailing year. There is no customer concentration in the usual sense, revenue comes from 179 million domains through many registrars, and the recurring, renew-or-lose-your-identity nature of the product makes the revenue exceptionally predictable.

One caution governs the read, and it is milder than for most names in this set, because here the mechanism and the numbers genuinely agree: the monopoly is intact and the numbers reflect it. The caution is that the single most important variable, the contract terms including the permitted price path, is not in the numbers at all. The financials will look pristine right up until any adverse change in the contract, because the contract is renegotiated periodically and its terms, not the current quarter, determine the long-run value. Strong numbers are not evidence about the next renewal.

Alternative explanations

A moat claim is only worth anything if the competing explanations fit the data worse.

It is just a regulated utility, not a moat. This is close to right and is a useful framing, but it understates the position. A regulated utility typically has a capped return on a defined asset base. VeriSign has a 68% operating margin and near-zero marginal cost, which is far better economics than a typical utility, because the "regulation" caps the price per domain but not the return, and the operating leverage is extraordinary. It is a monopoly with a price ceiling, which is better than a utility and worse than an unconstrained monopoly.

New TLDs will erode .com. Hundreds of new top-level domains have launched over the past decade, and .com's dominance and domain base have grown to records through all of them. The coordination standard has held: .com remains the default, and the alternatives are fallbacks. This explanation has been tested repeatedly and failed.

The monopoly is at the mercy of the government and could be taken away. This overstates a real dependency. The contract has a presumptive right of renewal tied to performance, VeriSign has 29 years of perfect performance, and the government has strong reasons to value a stable operator of critical infrastructure. The dependency is real and shows up in the price ceiling and periodic negotiation, but the wholesale removal of the monopoly is a remote scenario, not a base case.

AI and new ways of navigating the internet will make domains obsolete. This is the deepest long-term uncertainty, and it cannot be dismissed, but the near-term evidence runs the other way: management attributes part of the record registrations to AI-driven demand, as new applications and businesses need domains. Whether a shift in how people reach content eventually reduces the centrality of the domain is a real long-run question with no signal yet, and it is carried as a standing uncertainty rather than a current threat.

The preferred explanation is that VeriSign's moat is a contractual monopoly over the internet's default namespace, technically unassailable and economically extraordinary, whose durability rests on a government grant that also caps its pricing, and whose one real long-term question is whether the domain itself stays central to how the internet is used. That account fits the record domain base, the monopoly margins, the absence of competition, the permitted-but-capped pricing, and the specific external dependency on the government and ICANN.

3. What could break it

3a. Who can break it

The register follows from one question: who takes the decision that damages this moat, and would their action be visible in the numbers?

Mechanism	Actor	Visible in the numbers?
The contractual monopoly	The US government and ICANN, at renewal	No. It is a contract event, not a revenue line
The permitted price path	The Department of Commerce	Yes, at the next repricing, as a changed price trajectory
.com as the standard	A slow shift in how the internet is navigated	Only very late, as the base stops growing
The switching-cost annuity	A collapse in the value of domains generally	Late, as renewal rates fall
Operational trust	VeriSign itself, via a failure	Immediately, and it would jeopardise the contract

The two rows that matter most say no, or only at a contract event. The monopoly and its price are set by the government and ICANN at renewal and repricing, and those are contractual events that do not show up in the quarterly numbers in advance; the numbers look identical the quarter before a favourable or an unfavourable renewal. A clean set of quarters is not evidence about the next contract. The one row VeriSign controls, operational trust, is the one it has protected perfectly for 29 years, and maintaining it is precisely what keeps the contract renewing.

Note the contrast the register is built to capture: VeriSign has no competitor who can break it, which is what makes the monopoly exceptional, but it has two external bodies who define its terms, and their decisions surface in contract language, not in revenue. The condition that catches this watches the renewals and the repricing, not the income statement.

3b. Class A: mechanism conditions

These describe events, each with an actor. A trigger here is a structural change to the moat, not a cyclical dip in registrations. The reasoning behind the class split is in the annex.

#	Condition	Actor	Observable event	Reading now
A1	The .com registry agreement is not renewed or is opened to competition	ICANN, US government	A move to re-tender .com or remove the presumptive renewal	Clean. Presumptive renewal intact, 29 years of performance, no move to re-tender
A2	The permitted price path is cut or frozen	Department of Commerce, NTIA	A repricing of the cooperative agreement below the current trajectory	Clean. Current path in force; $10.97 locked for Nov 2026. The key contract watch
A3	.com loses its status as the default namespace	Internet users, over years	A durable shift of new registration and preference away from .com	Clean. .com base and new registrations at records
A4	A shift in how the internet is navigated makes domains less central	Users, AI platforms	Traffic and identity moving to systems that bypass domains	Clean, a slow watch. AI is currently adding domain demand, not removing it
A5	An operational or security failure jeopardises the contract	VeriSign	A material outage or breach of the critical registry	Clean. 29 years of 100% uptime
A6	A regulatory or antitrust intervention forces structural change	Regulators	An antitrust action against the pricing or exclusivity	Clean but worth watching, given periodic political attention to .com pricing

On A1 and A2, the distinction that carries the verdict. The two contract conditions are the whole risk, and they are different in kind. A1, losing the monopoly itself, is remote: the presumptive renewal is tied to performance, VeriSign has never failed, and there is no appetite to destabilise critical infrastructure by re-tendering .com. A2, a worse permitted price path, is the more realistic version of the contract risk: at a future repricing, the Department of Commerce could allow a slower rate of increase, which would not touch the monopoly but would cap its growth. Neither is triggered, and the current terms are favourable and in force, but A2 is where the periodic negotiation actually bites, and it is the condition to watch most closely, because it is the one that can change without anything going wrong operationally.

On A4, the deepest slow watch. The long-term question is not competitive but structural: whether the domain name stays central to how people and machines find things on the internet. If navigation shifts to AI assistants, apps, or systems that do not rely on typed domains, the centrality of .com could erode over many years. Today the evidence runs the other way, AI is adding registration demand, but it is the one path by which the moat could slowly lose value without any contract change or competitor, and it is carried as the deepest uncertainty.

Calibration. A1 and A2 are well defined and clean, with decades of favourable precedent, and A2 is the live contract watch. A3, A5 and A6 are clean and well understood. A4 has no precedent and no timeline, so it is reasoned rather than observed. The file does not overstate the near-term likelihood of any of them, and does not understate that A2 and A4 are where the real, slow risk lives.

3c. Class B: gauges

These are measurements. A number has two causes, the mechanism and the cycle of internet and business formation, and the number alone cannot tell you which moved. A gauge never rejects the moat on its own; it obliges the attribution test in 3e.

#	Gauge	What it isolates	Expected direction if the moat erodes	Reading now
B1	Domain base size	The core annuity	Falls as .com loses holders	Clean. Record 179.1 million
B2	New registrations	Forward demand for .com	Falls as new businesses choose alternatives or skip domains	Clean. Record 12.7 million, up 21%
B3	Renewal rate	The switching-cost annuity's strength	Falls as domains lose value to holders	Watch. 75.2%, down 30bp, minor and mix-driven
B4	Operating margin	The operating leverage	Falls only on cost shocks, not demand	Clean. 68.2%, expanding
B5	Realised price per domain	Whether the permitted price path is being taken	Flat or falling would signal a pricing constraint	Clean. $10.97 locked for Nov 2026
B6	.com share of new registrations vs other TLDs	.com's standing as the standard	Falls as alternatives gain among new registrants	Clean. .com dominance intact through the TLD expansion

Why the renewal-rate dip is not a trigger. The renewal rate slipped 30 basis points to 75.2%, and on a naive read a falling renewal rate at a subscription business is a warning. Here it is close to noise, because it is mix-driven: a record surge of new registrations brings in a cohort of first-time registrations, which always renew at lower rates than established domains, so a wave of new names mechanically dilutes the blended renewal rate even as the underlying business strengthens. B3 becomes informative only if the renewal rate on established, non-first-time domains falls, which it is not. The current dip is a sign of strong new-registration growth, not weakening retention.

B2 and B5 are the ones that matter. B2, new registrations, is the forward demand signal for whether .com stays the default choice, and it is at a record. B5, realised price, confirms the permitted price path is being taken. Those two, together with the contract watches A1 and A2, are the live picture; the rest confirm a monopoly operating at full strength.

3d. Comparator sets

Both sets are fixed here, in advance, so a later reading cannot pick the comparison that suits the conclusion.

Macro peers, which share the internet and business-formation cycle and separate a demand slowdown from a mechanism problem: the broader internet-infrastructure and registrar group, and general business-formation trends. If VeriSign's new registrations soften while business formation softens too, it is the cycle; if VeriSign's base alone weakens, it is company- or .com-specific.

Mechanism peers, which test the actual threats rather than the cycle: the other TLD registries and the new generic TLDs, as the test of whether .com holds as the standard, and, for the deeper threat, the emerging ways of navigating the internet that could bypass domains. The instructive point is that the mechanism peer for the contract risk is not a company at all, it is the regulatory framework itself, ICANN and the Department of Commerce, whose decisions are the real variable and which no ordinary competitor analysis would capture.

3e. The attribution test

Run this every time a Class B gauge moves. All three must come back clean for the cause to be recorded as cyclical rather than mechanical.

1. Is there a nameable external cause with a date? For soft new registrations, is it a slowdown in business formation and internet growth, or is it .com losing preference to alternatives?

2. Do the macro peers move with it? If registrar and business-formation trends soften together, it is the cycle. If .com alone weakens, it is .com-specific.

3. Is the mechanism side unchanged? Is the contract intact, is the permitted price path being taken, and is .com still the default for new commercial registrations?

   
   

The escalation rule is not a fixed count of quarters. A cyclical attribution holds only while the named cause is present and verifiable. When internet and business formation recover and VeriSign's registrations do not, or when the weakness is clearly a shift away from .com rather than a soft cycle, the cause is no longer the cycle and the matter escalates to a Class A judgement regardless of the calendar.

One caution specific to VeriSign. The dangerous mechanisms, a worse contract and a slow erosion of the domain's centrality, are not cyclical and will not show cleanly in the registration gauges for a long time. So the attribution test does its normal work on the cyclical gauges, but the real watch is the contract, A1 and A2, tracked through the renewal and repricing process, and the slow structural question, A4, tracked through how the internet is navigated, not inferred from the current record numbers. Waiting for the base to shrink before recognising a contract or structural problem would be very late.

How this document is revised. On any development in the .com cooperative agreement or the ICANN registry agreement, including any repricing or renewal terms, whatever the calendar. On any regulatory or antitrust action touching .com pricing or exclusivity. On any material shift in how the internet is navigated that bears on the centrality of domains. On the quarterly results. And on anything unforeseen where the question of whether to revise even arises. For this moat, the contract and the regulatory framework matter more than the quarterly numbers.

4. What cannot be seen

Two things carry real weight and have no clean, timely signal. Listing them stops "every gauge at a record" from being read as "nothing to watch".

The terms of future contract renewals and repricings. The entire value of the moat rests on a contract that is periodically renegotiated, and the permitted price path is set by the Department of Commerce. Whether future terms are as favourable as the current ones, whether the allowed price increases continue at the present rate, and whether political attention to .com pricing leads to a tighter cap, are all decisions made in a negotiation, not signals visible in the business. The numbers will look pristine regardless, right up until any repricing changes the trajectory. This is the nearest-term real uncertainty and it has no gauge.

Whether the domain stays central to the internet. VeriSign's moat assumes that finding things online continues to run through domain names. If the way people and, increasingly, AI systems navigate the internet shifts toward assistants, apps, or addressing systems that do not depend on typed domains, then the centrality of .com could erode slowly over many years, reducing the value of the monopoly without any contract change or competitor. Today AI is adding domain demand, but the long-run direction is genuinely unknown, and this is the deepest structural uncertainty in the file. It has no clean signal and no timeline.

Two structural limits are worth stating plainly. The domain-centrality question, A4, has no precedent and no timeline, so it is reasoned rather than observed. And this is a moat whose existence and price are both granted by external authorities, which is an unusual dependency: benign, decades-favourable, but real, and different from a moat the company holds entirely in its own right.

5. Assumptions

#	Assumption	Status
1	The internet keeps growing and businesses keep needing domains	High confidence near term, the deepest long-run uncertainty
2	The .com registry agreement continues to renew on its presumptive terms	High confidence. Performance-based, 29-year record
3	The permitted price path continues at roughly the current rate	Moderate to high confidence. Set by the Department of Commerce, the key contract variable
4	.com remains the default namespace against new TLDs	High confidence. Tested repeatedly and holding
5	Operational reliability is maintained, protecting the contract	High confidence. 29 years of 100% uptime
6	Domains stay central to how the internet is navigated	Moderate confidence long term. AI adds demand now, direction unknown

6. Basis of this assessment

This is the first Layer 1 written on VeriSign, so there is no prior verdict to move from. It records the starting position that future revisions will read against.

The moat is judged a contractual monopoly over the internet's default namespace, deepened by .com's position as the coordination standard the whole world assumes and by the high switching cost of a domain. Strength reads exceptional in durability: the monopoly is granted by contract with a presumptive right of renewal, it is technically and legally unassailable by any competitor, it is protected by 29 years of perfect operational performance, and it throws off monopoly economics at a 68% operating margin. The one qualification, which is unusual and material, is that VeriSign does not set its own price: the .com wholesale fee is permitted by the US Department of Commerce under a cooperative agreement, so the monopoly's single most valuable lever is held by an external authority. That is why the strength, though exceptional in durability, carries a ceiling a fully unconstrained monopoly would not have, and why security and pricing authority read moderate and constrained.

Condition reads intact. No condition has fired. The contracts are in force, the domain base is at a record 179.1 million, new registrations are at an all-time high, margins are expanding, and the permitted price increase to $10.97 is locked in for November 2026. No competitor can reach the mechanism, and the two external bodies that define it, the US government and ICANN, have renewed the arrangement favourably for decades.

Every Class B gauge reads clean, with the minor renewal-rate dip explained as new-registration mix rather than weakening retention. The live watches are not in the numbers: A2, the permitted price path at future repricings, is the key near-term contract variable, and A4, whether the domain stays central as the internet's navigation evolves, is the deepest long-term structural question. Both are tracked as events and directions, not read from the current record numbers.

The verdict is Exceptional / Intact. It is one of the most durable monopolies in existence, contractually guaranteed and technically unassailable, held just below the theoretical top only because its own pricing is set by an outside authority rather than chosen. It is not a situation whose long-run value can be assumed without watching the contract, because the grant that creates the monopoly also caps it and is periodically renegotiated, and because the deepest question, whether domains stay central to the internet, is structural and will not show in the numbers until late.

On the third gate, demand anchoring reads level 3, and this is the gate that declines the name. VeriSign passes the two gates that decline most names: its moat is exceptional and its condition is intact. What holds it out of the buy list is the demand axis. The demand VeriSign serves is the use of the domain name system, with .com as the internet's default addressing standard, and while that is deeply embedded and has a genuine annual renewal cycle, it is not anchored in a biological necessity or a permanent human drive. It rests on a technological and habitual trajectory. If the way people and machines navigate the internet shifts away from typed domains, toward AI assistants, apps, or addressing systems that do not rely on domains, the same risk A4 already carries, the demand under the monopoly could plateau permanently without the contract ever lapsing or a competitor ever emerging, and a drawdown in that world would not reliably reverse. That is the level-3 profile: durable, probably enduring, but resting on a trajectory continuing rather than on a necessity that cannot stop, and it is why the demand gate declines a monopoly that is otherwise as clean as any in the set.

Future revisions are dated and appended below.

Annex: how this assessment is made

These are the rules the document is written under, kept separate so the file above stays about VeriSign and the rules cannot quietly change to suit a conclusion.

Judging strength

Strength is settled before condition, because the fields behind the condition axis only measure whether a moat is undamaged, not whether there was much of a moat to begin with. Three questions, all about how hard the moat is to attack rather than how well the company is trading. Is there a substitute the market could actually move to? Could a competitor replicate the position? Has it been attacked, and what happened?

VeriSign's answers are as clean as any on durability, with one qualification on a different dimension. There is no substitute a holder can move to, because .com is the default namespace and an alternative extension is not an equivalent. A competitor cannot replicate the position, because there is one .com registry and it is granted to VeriSign by contract, not won in a market. And it has never been successfully attacked, because it is not contestable in the market at all. That is exceptional durability on all three counts. The qualification is not about the moat's depth but about its pricing: uniquely in this set, the monopolist does not set its own price, because an external authority caps it. That does not lower the strength of the moat, which is about how defensible the position is, but it is why security and pricing authority, on the condition axis, read moderate and constrained, and why the file describes the strength as exceptional in durability with a ceiling on self-pricing.

Exceptional means all three answers come back clean and the strength is self-holding. VeriSign qualifies on durability. The external pricing cap is captured on the condition axis as constrained pricing authority and moderate security, not as a reduction in strength, because the distinction the verdict exists to preserve is exactly this: how deep the moat is, versus who controls its terms.

The Layer 2 gate requires three things together: exceptional strength, intact condition, and demand anchored at level 1 or level 2. VeriSign passes the first two, and passes them cleanly, yet it is declined at the third: its demand is level 3. It shows that the demand gate is not redundant with the moat gates. A contractually guaranteed, technically unassailable monopoly can still fail to qualify, because whether the market returns after a fall is a separate question from how strong or intact the moat is, and for VeriSign that separate question, whether domains stay central to the internet, is the binding one.

The verdict

The verdict is two judgements held apart, because collapsing them into a single grade hides the thing that matters most. One axis is strength: how deep was the moat to begin with, scored exceptional, strong, or ordinary. The other is condition: is it still whole, scored intact, impaired, or broken.

Keeping them separate is deliberate, and VeriSign shows a specific use of it: a moat can be exceptional in durability while carrying a permanent constraint on its pricing that is not damage at all. The external price cap is not an impairment, the moat is fully intact, but it is a real limit that belongs somewhere in the verdict. Putting it on the condition axis, as constrained pricing authority and moderate security, records it accurately without pretending the moat is weaker or damaged than it is. A single grade would force a choice between overstating the depth and understating the constraint; the two axes hold both.

Three questions feed the condition axis, answered in a fixed order so it cannot be talked into a softer reading afterwards. Can anyone outside the company reach the mechanism? That is security. Has anything altered the mechanism itself? That is condition, intact, impaired or broken. Does anyone else have a say in the price? That is pricing authority, unconstrained, constrained or contested. VeriSign reads moderate security, intact condition, and constrained pricing, because an outside authority sets the terms but nothing has altered the mechanism.

Below all of it sits a rule the verdict cannot override. If the foundational layer is broken, the name is rejected whatever the axes would otherwise say. For VeriSign the foundational layer, the contractual monopoly, is intact. Impaired would require an adverse contract change, a worse price path or a move against the exclusivity; broken would require the loss of the .com monopoly itself. Neither is close, and the presumptive renewal tied to a 29-year performance record is why.

Judging demand anchoring

Strength and condition together answer whether the company keeps its share of the market. They do not answer whether the market returns after a fall, and that is a separate question that decides whether a drawdown can be waited out at all. A moat can be fully intact while the demand beneath it shrinks permanently, so demand anchoring is judged on its own axis, on two tests: biology, is the underlying demand rooted in a permanent human or physical necessity or drive, and precedent, is there a history of similar demand collapsing and not returning.

The levels run from one to four. Level 1 is anchored in a physical or biological necessity that never stops. Level 2 is anchored in a permanent human drive that can fall cyclically but always returns. Level 3 is anchored in an established infrastructure or habit with a replacement cycle, probably durable but with no biological guarantee. Level 4 is anchored in a moment, a build-out or a specific medium that may never return to its peak. Only level 1 and level 2 are eligible for a Layer 2 entry, because only there does a drawdown reliably reverse.

VeriSign reads level 3. The demand it serves is the use of the domain name system, with .com as the internet's default address, and the peeling matters here. The deeper human need, to have an identity and be findable, is close to permanent and might look level 2. But the exact layer VeriSign serves is narrower: the typed domain as the addressing mechanism, and that specific medium is not guaranteed the way the underlying need is. It is established infrastructure with a real annual renewal cycle, which makes it durable and clearly not a one-time build-out, so it is level 3 rather than level 4. But it rests on a technological and habitual trajectory, how the internet is navigated, that could shift: if AI assistants, apps, or new addressing systems come between users and typed domains, the centrality of .com could erode slowly, and the demand under an untouched monopoly could plateau. That is the level-3 profile, durable but trajectory-dependent, and under this framework only level 1 and level 2 clear the gate. So VeriSign, with a contractually guaranteed monopoly and a fully intact condition, is declined on the demand axis alone: a flawless moat is not a buy if its market may not return after a fall.

Why the conditions are split in two

A Class A condition describes something someone did, or a structural event with an actor. A Class B gauge is a number, and a number has two causes, so it cannot on its own tell you which moved.

For VeriSign the split does specific work, because the two most important conditions, the contract and the domain's long-run centrality, are invisible in the numbers. A1 and A2 are decided in contract negotiations, and A4 unfolds over many years in how the internet is used; none shows up in the quarterly registration figures, which look pristine either way. A file scored on the gauges would call VeriSign flawless and be blind to a repricing or a slow structural shift. A file scored on the events holds the contract watches open regardless of how strong the quarter looked. A Class A trigger is a structural verdict; a Class B move only ever obliges investigation.

When a cyclical explanation expires

"It is the business-formation cycle" will be available whenever new registrations soften, and will often be partly true, since domain demand tracks internet and business growth. The rule is that the cyclical attribution holds only while the named cause is present and verifiable. When business formation recovers and VeriSign's registrations do not, or when the weakness is clearly a shift away from .com rather than a soft cycle, the cycle no longer explains it and the matter escalates. Divergence in the recovery is the sharpest signal, and a weakness specific to .com rather than shared with internet growth is not a cyclical signal at all.

Revision

The document is revised whenever something might have changed, and for this moat that means the contract and the regulatory framework carry more weight than the quarterly numbers. Any development in the cooperative agreement or the ICANN registry agreement, any repricing, or any regulatory action on .com pulls a revision forward regardless of when the last one was. Class A is walked in full every time, because the whole lesson of this name is that every gauge can be at a record while the one thing that determines long-run value, the contract terms, is decided outside the numbers. The assignment of a condition to Class A or B is fixed before a trigger, never during the revision that reports one.

A note on what this document is and is not. This is written for the author's own investment process and published in that form. It reflects the analysis, assumptions and judgment of the author at the date of writing and nothing more. Nothing here is investment advice, a recommendation tailored to any reader, or an offer to buy or sell any security. Valuation figures, scenarios and price levels are illustrative analyst assumptions unless explicitly sourced to company reports or other primary data. Investing involves risk, including loss of capital, and past performance is no guarantee of future results. Any reader considering an investment should do their own work and consult a qualified adviser who knows their situation. The author may hold, or may come to hold, positions in the securities discussed.