> Shouldn't gov.uk just stick to domains under .gov.uk?(!) Would make it easier to work out who's actually gov.uk and who's merely pretending :) Much smaller s

> Shouldn't gov.uk just stick to domains under .gov.uk?(!) Would make it easier to work out who's actually gov.uk and who's merely pretending :) Much smaller scale example: Where I work, our production web app is at `<subdomain>.<charity>.ac.uk`. DNS and SSL certs are managed centrally by IT. We open a support ticket, someone in IT gets it done. DNS entries are usually done within a few hours, but they like to purchase SSL certs in batches so if we need a cert for a new domain/subdomain it could take a few days or weeks. It's useful for us to spin up multiple different dev/test/staging copies of our app, which are otherwise nearly identical to production in terms of how the infrastructure is set up. These are short-lived and used for internal user acceptance testing before we roll out changes to the live app - they're only accessible on the local network (so, via VPN or onsite), but we want to reduce friction to our users, as the ones doing the acceptance testing are domain experts (i.e. scientists, researchers, electrical engineers) but don't want to be tinkering around with software dev stuff like "editing /etc/hosts" and "accepting self signed SSL certificates". We don't want to wait around for a whole sprint length's amount of time waiting on new temp subdomains when we've got new stuff to demo to people. It's a lot easier to just claim a domain name of our own (i.e. `.ga` and `.ml` are free) and set them up with external DNS management (have used cloudflare before, because it's easy to do letsencrypt DNS challenge method with it), and use letsencrypt for the SSL certs. We could theoretically ask IT to let us manage the DNS ourselves for everything under `<subdomain>.<charity>.ac.uk`, i.e. they point that subdomain to an `NS` record to an authoritative DNS server that we run ourselves, and we could ask them for some wildcard certificates so we could do stuff like `staging-env-123.<subdomain>.<charity>.ac.uk`. But our team is small, and we don't really _want_ to manage yet another service (our own DNS)* and have it adequately locked down to appease "cyber essentials" and so forth :-) and neither do IT want to defer DNS to "knowledgeable, but still users" users of the corporate network. And wildcard certificates are iffy from a security standpoint also. *In practise this'd be letting kubernetes components manage it, but k8s is so bloody brittle and oh god I cannot keep up with all of this devops stuff there's like 5 of us stop making us run servers on top of servers. It would not surprise me if there's similar gatekeeping of .gov.uk subdomains and SSL certs, necessary-for-security bureaucracy given their high profile, which slows down the deployment of temp. staging / "internal user acceptance testing" environments, and so the internal dev teams at some point went "fuck it, we'll buy a new domain ourselves" and someone paid for the govuk.digital domain using a Government Purchase Card and claimed it on the relevant Project Code. EDIT: Reading comments about buy-your-own-domain being "shadow IT". Salient points about random people in the org paying for third-party services with a company credit card and then leaving. It's important to get in the "bus factor" mindset with this stuff, e.g. "if I got hit by a bus today, would anything fuck up in work if I wasn't there to remember login details?". Make sure logins for things are shared with the whole team in a secure way, make use of tools which support organisation accounts, have a shared mailbox etc.... oh and make sure the companies/services gets registered as a supplier with finance.