M-23-10 DOTGOV Act Guidance

EXECUTIVE OFFICE OF THE PRESIDENT

OFFICE OF MANAGEMENT AND BUDGET

WASHINGTON, DC 20503

THE DIRECTOR

Februrary 8, 2023

M-23-10

MEMORANDUM FOR THE HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES

FROM: Shalanda D. Young

SUBJECT: The Registration and Use of .gov Domains in the Federal Government

This memorandum provides guidance to Federal agencies on the acceptable use and

registration of Internet domain names as required by the DOTGOV Online Trust in Government

Act of 2020.

The policy requirements in this memorandum apply to all Federal agencies.

Introduction

For the American people, the use of the .gov domain is a critical indicator that they are

accessing official information, services, and communications. When .gov domains are used for

websites, people have greater confidence that the information on those sites is authoritative and

trustworthy. When .gov domains are used for email, people have greater confidence that the

contents of that email are safe and secure. As a result, the .gov domain contributes to increased

public trust in online government information and services, as well as safer operations and

communications among all branches and levels of government.

Public trust in the .gov domain is contingent on clear and consistent use of government

domains (i.e., “.gov” or “.mil”). A good government domain name should be memorable for the

American people, not longer than necessary, and describes the relevant government organization

or service in an unambiguous way.

The Use of .gov by Agencies

The internet has become a primary means by which the public receives information and

services from the Federal Government. Therefore, it is critical that the Federal Government’s use

of internet infrastructure employs high standards of quality to maintain public trust. Because the

use of a .gov domain is limited solely to U.S.-based government organizations and publicly

controlled entities, the public reasonably assumes that any Federal information, services, and

communications that use the .gov domain are official and authoritative. Thus, agencies generally

must use the .gov or .mil domain for official communications, information, publications, delivery

of services, design of online content, and development of digital products and tools. Agencies

should make use of the .gov domain in ways that directly meet the needs of their diverse

missions, customer segments, and digital product strategies.

Pub. L. No. 116-260, §§ 901-07.

As used in this memorandum, “agency” has the meaning given in 44 U.S.C. § 3502.

As of April 2021, .gov domains are free of charge to all eligible registrants, including

agencies. Agencies should register new domains, reuse existing domains, and retire unused

domains to meet their operational needs; clearly communicate information; and deliver

trustworthy and recognizable public services. Agencies should be good stewards of .gov and .mil

domains to meet the expectations of the public and ensure a high level of trust.

Agency Actions:

• Effective on the date of this memorandum, agencies must use government domains (i.e.,

.gov or .mil) for all official communications, information, and services, except for third-

party services operated by non-governmental entities on non-governmental domains that

are needed to effectively interact with the public. Examples of such third-party services

include social media services, source code collaboration, and vulnerability disclosure

reporting systems.

• Agencies must continue to report utilization of non-.gov domains, including hostnames

used by internet-accessible information systems, as required by M-22-09, Moving the

U.S. Government Toward Zero Trust Cybersecurity Principles.

o OMB will review all usage of non-.gov domains by agencies, with the goal of

limiting the use of non-.gov domain names for official communication,

information, and service delivery. OMB may require an agency to provide a

rationale for the continued use of a non-.gov domain name, and, if appropriate,

may direct an agency to cease the use of a non-.gov domain name.

• Agencies must comply with all applicable .gov domain requirements on the .gov

Registry's site.

Within 180 days of the date of this memorandum, agencies should review

previously registered domains to ensure compliance with these domain requirements,

including domain naming conventions, and identify to OMB any domains that do not

meet these requirements.

Requirements to Register or Renew a .gov Domain

To register or renew a .gov domain, agencies should follow the process and the domain

name requirements for Federal agencies on the .gov Registry's website at https://get.gov.

• Domain name requests must have the approval of the agency’s Chief Information Officer

or the head of the agency, and must include a detailed description of what the domain

will be used for, who the intended audience is for the domain (including primary users),

an explanation as to why this specific domain name is needed, and a brief description as

to how this domain will conform to OMB policies and requirements.

OMB will review domain requests and may contact the submitting agency with any questions

during this process.

Agencies can establish .gov domain names for any legitimate purpose and can register

domains as needed to most effectively meet their mission. However, .gov domain names are a

shared resource across all U.S.-based government organizations, and agencies have a

Requirements for Federal agencies’.gov domains can be found at:

https://home.dotgov.gov/registration/requirements/

responsibility to consider carefully how potential domains might impact the public and how they

interact with government information and services.

OMB reviews domain requests to ensure that agencies are following relevant policies and

domain name requirements, to help avert or resolve potential domain-naming conflicts between

agencies, and to reduce confusion arising from overuse of similar domain names and

misaligment between a domain name and its intended use. In areas of domain name conflict,

OMB will seek resolution with the agencies involved. OMB may deny a domain name request or

a domain name renewal, or may request that an agency transfer ownership of an existing domain

to another agency to remediate potential conflict or confusion.

Rescissions

This memorandum rescinds the OMB memorandum entitled Policies for Dot Gov

Domain Issuance for Federal Agency Public Websites (Dec. 8, 2014). It also supersedes section

4 of OMB Memorandum M-11-24, Implementing Executive Order 13571 on Streamlining

Service Delivery and Improving Customer Service (June 13, 2011), and section 9 of OMB

Memorandum M-17-06, Policies for Federal Agency Public Websites and Digital Services (Nov.

8, 2016).

Assistance

All questions or inquiries concerning this memorandum should be addressed to the OMB

Office of the Federal Chief Information Officer (OFCIO) via email: ofcio@omb.eop.gov. For

management of current domains and other issues, please reach out to the .gov Registry at

[email protected].