.co, .xyz, .app: When New Extensions Actually Make Sense (And When They're a Trap)

Someone drops a .co domain in a domain flipping forum and half the thread calls it worthless. Someone else pays $4,000 for a clean .xyz and wonders why the traffic never moves. Both of them are making the same mistake — judging an extension before looking at the actual domain underneath it.

The extension conversation is one of the most polarized in SEO, and most of it is noise. Let me give you the version that actually helps you make a decision.

The Misconception That's Costing People Money

The dominant belief is that .com wins everything and everything else is a compromise. That is true in branding. It is not universally true in SEO or domain investment. Google has been explicit since 2015: new generic TLDs are treated the same as .com or .org in ranking systems. What they penalize is spam, poor history, and thin content — not the string after the dot.

Where people get burned is treating that statement as a green light to buy any non-.com without scrutiny. A .xyz with 800 spammy backlinks pointing to a former crypto pump site is not a neutral starting point just because Google doesn't hate .xyz structurally. The extension is clean; the domain's history is rotten.

Where .co Actually Has a Real Track Record

.co has the most legitimate case of the three. It's the ccTLD for Colombia but has been marketed globally for over a decade as a startup-friendly alternative. Overstock rebranded to o.co. Twit.tv ran campaigns on it. AngelList domains have used it. That matters — not because authority transfers from those brands, but because .co has a documented history of real businesses building real sites on it.

When I look at a .co domain in DomainScope, the history check often reveals something useful fast: was this a legitimate startup, a parked page, or a redirect farm? A .co with two years of archived product pages, organic referring domains from SaaS review sites, and a clean anchor profile is a different asset than a .com with the same surface metrics but three years of casino affiliate content buried in the Wayback Machine.

The extension didn't make it valuable. The history did.

.app Is a Special Case Worth Understanding

.app is a Google Registry TLD that requires HTTPS — it's hardcoded into browser preload lists. That's a technical floor that generic TLDs don't have. For anyone building an actual application or developer tool, a clean .app domain is a credible, purpose-built choice. The problem is that a lot of .app domains were registered speculatively, never developed, and dropped — which means the Wayback history is either empty or sparse, and the backlink profile is thin.

Thin isn't necessarily bad. An empty .app domain with zero backlinks and zero Wayback entries is a blank slate, not a red flag. What you're paying for is the keyword value and the extension fit, not inherited authority. Treat it accordingly — it's a new build, not a domain investment with SEO legs already in place.

The Real Problem With .xyz

I'll be direct: .xyz has an image problem that is partially earned. It was heavily promoted through cheap bulk registrations, which attracted a disproportionate amount of spam. One 2019 Spamhaus report placed .xyz among the top extensions for abusive registrations. That history has made spam filters and some SEOs reflexively skeptical.

But there are clean .xyz domains. Alphabet runs abc.xyz as its official corporate site. There are .xyz domains with genuine editorial backlinks, stable Wayback histories showing real blogs or tools, and organic traffic that survived algorithm updates without collapsing. The extension alone does not tell you which one you're looking at.

When I run a .xyz through DomainScope, the spam signal check and anchor diversity score do more work than they do on a .com review — precisely because the base rate of problematic histories is higher. You're not passing on .xyz categorically; you're raising your evidence threshold before you commit.

The Framework That Actually Works

Stop asking "is this extension trustworthy?" and start asking "does this specific domain have a clean, purposeful history that matches what I want to build?"

A .co with three years of genuine SaaS backlinks beats a .com with two years of link farm footprints. A .app with zero history is a clean build opportunity. A .xyz with verified editorial links and no spam anchor clusters is a legitimate SEO asset — just one that requires more evidence to confirm than a .com would.

The extension sets the context. The data makes the call.

Before you pass on a non-.com or, worse, overpay for one based on surface metrics, run the full history — backlinks, Wayback, registration chain, traffic penalties. If a domain you're considering is a .co, .xyz, or .app, that's your cue to look harder, not to walk away. The deals that other people dismiss on reflex are exactly where undervalued inventory hides.

Read next: Playing Global TLDs: .com, .io, .ai, and .co Strategy · Turning Domain Trading Into a Business, Not a Hobby

Want to vet a domain right now? Analyze it free on DomainScope →