There is something almost absurd about .md.
To most people in Moldova, it is a country-code domain.
For developers, .md usually means something much less geopolitical:
Markdown.
README.mdSECURITY.mdCHANGELOG.mdAGENTS.mdCLAUDE.md
Files. Documentation. Instructions. Things that are supposed to sit quietly inside a folder and not participate in international relations.
Unfortunately, the Internet had other plans.
Because .md is also Moldova’s country-code top-level domain, almost any ordinary Markdown filename can simultaneously be a real Internet domain.
README.md can be a file.
And readme.md can be a website.
Welcome to one of the Internet’s stranger namespace collisions.
When your README decides to become a website
Normally, when a developer writes:
SECURITY.md
there is not much philosophical uncertainty involved.
It is a file.
Except some software sees the final .md, checks its list of valid top-level domains and thinks:
Ah. Moldova.
In April 2026, a Claude Code bug report documented exactly this kind of behaviour. A filename such as CODE_STANDARDS.md could be partially converted into a clickable HTTP link because .md was recognised as Moldova’s ccTLD.
The reporter’s workaround was beautifully sophisticated:
put the filename in backticks.
Twenty-first-century software engineering occasionally looks like this.
The problem is not unique to .md. Extensions such as .io, .ai, .dev and others can collide with domain names too.
But .md is special because Markdown files are everywhere.
And now AI coding tools have made them even more important.
We no longer have only README.md.
We have things like:
AGENTS.mdPROMPT.mdMEMORY.mdSKILLS.mdINSTRUCTIONS.md
Files increasingly read not merely by humans, but by software capable of doing things.
Suddenly a funny naming collision becomes slightly less funny.
94 out of 102
A 2026 investigation tested 102 common Markdown-style filenames against the Moldovan namespace.
94 were already registered as .md domains.
That does not mean 94 malicious domains exist.
Quite the opposite: the researchers explicitly corrected an earlier, more alarming interpretation and found that many domains belonged to unrelated legitimate owners.
The problem is not that Moldova secretly built an army of evil Markdown files.
The problem is much simpler.
The filenames exist.
The domains exist.
And software occasionally cannot tell the difference.
That is all you need for a namespace collision.
Developers have begun teaching software to ignore Moldova
The obvious solution is to improve the software.
Require https:// before assuming that something is a website.
Do not automatically transform every word ending in a valid TLD into a link.
Treat file-like strings as files unless there is a good reason not to.
That is already happening.
In July 2026, markdown-it 15 switched to a new version of its linkification library where fuzzy links are no longer enabled by default.
In other words, software is gradually learning that seeing .md does not necessarily mean:
Pack your bags. We’re going to Moldova.
Some security researchers go further.
Their defensive suggestion for environments that have absolutely no reason to access Moldovan websites is wonderfully brutal:
block the entire .md zone at DNS level.
No .md.
No ambiguity.
No problem.
Of course, there is a minor side effect.
You have also deleted Moldova from that network.
The researchers themselves acknowledge this and recommend allowlisting legitimate Moldovan sites where access is needed.
Still, it is difficult not to appreciate the irony.
A country-code domain has become something certain developers are advised to configure their computers not to see.
Meanwhile, Moldova has another namespace problem
And then politics enters the server room.
The idea of reunification between the Republic of Moldova and Romania has existed for decades, with supporters, opponents and plenty of people somewhere in between.
It has not disappeared.
In June 2026, a legislative proposal concerning negotiations on union with Moldova was even tacitly adopted by Romania’s Chamber of Deputies after the deadline for debate and voting expired.
That does not mean Romania decided to unite with Moldova. The Romanian government and parliamentary committees had issued negative opinions on the proposal, and it still faced the Senate.
In Chișinău, Moldovan Parliament Speaker Igor Grosu described the initiative as a provocation, while also acknowledging that union remains an idea meaningful to part of Moldovan society.
So no, reunification is not an established future event.
But the movement exists.
The political pressure exists.
The subject keeps returning.
And if history ever does move in that direction, .md has a completely different problem waiting for it.
Not Markdown.
ISO 3166-1.
Countries get ccTLDs. Former countries lose them.
Country-code domains are not simply nice two-letter brands invented by registries.
Their eligibility is generally tied to the ISO 3166-1 list of countries and territories.
That matters enormously.
If, in some future political settlement, Moldova ceased to exist as a separate ISO 3166-1 entry and its MD code were removed, .md would lose the basis for remaining a ccTLD.
At that point the retirement process would begin.
And then its disappearance would no longer be political speculation.
It would become DNS administration.
Under IANA’s current ccTLD retirement policy, the standard retirement period is five years. An extension can be granted, but the total period is generally limited to ten years.
Registrations are expected to wind down.
Users migrate.
The registry prepares the shutdown.
And eventually IANA removes the delegation from the DNS root.
That final line is worth reading again.
Removed from the DNS root.
Not sold.
Not transferred to Romania.
Not quietly left running forever because somebody owns a nice two-letter domain.
Removed.
And suddenly… the Markdown problem fixes itself
Imagine the final day.
Years of migration have passed.
Companies have moved their websites.
Email addresses have changed.
Old links have been redirected where possible.
The registry has completed its retirement plan.
Then .md disappears from the root.
Now consider:
README.md
Yesterday, it could theoretically be both a Markdown filename and a globally resolvable domain name.
Today?
It is just a filename.
SECURITY.md
Just a file.
AGENTS.md
Just a file.
PROMPT.md
Just a file.
The namespace collision that caused developers to modify parsers, change linkification behaviour, use backticks and even contemplate DNS-level blocking has lost one half of the collision.
The solution arrived.
Nobody installed it.
Of course, computers will take a little longer to notice
Nothing involving computers dies quite that cleanly.
Old TLD lists would survive.
Libraries would remain outdated.
Some regular expression written in 2019 would probably continue insisting that .md is a valid TLD until approximately 2074.
Caches exist.
Legacy software exists.
Some forgotten corporate appliance running Java 8 definitely exists.
So README.md would not magically stop being interpreted as a URL everywhere at exactly midnight.
But DNS would have settled the argument.
There would simply be nowhere for README.md to resolve.
The domain side of the ambiguity would be gone.
And eventually the software would catch up.
Probably after somebody opens an issue on GitHub.
A remarkably Internet way to solve a problem
That is what makes the .md story so strange.
Nobody designed this collision.
Moldova received .md.
Markdown adopted .md.
Both decisions made perfect sense independently.
Then software became clever enough to automatically recognize domains.
Then Markdown became ubiquitous.
Then AI agents began reading Markdown configuration files.
And suddenly two letters assigned to a small European country decades ago became a developer-security edge case.
Engineers responded in the traditional way:
settings.
Exceptions.
Parser changes.
Backticks.
DNS rules.
More settings.
Then history may eventually offer a completely different solution.
I try to understand…
If Moldova were ever reunited with Romania and the MD country code consequently retired, the troublesome namespace would begin its own countdown.
Five years.
Perhaps ten.
Then darkness.
And one of the Internet’s strangest technical problems would mostly disappear for a reason nobody designing a Markdown parser could possibly have anticipated.
Not because programmers finally defeated the bug.
Because the country behind the TLD was no longer represented by that country code.
There is something almost poetic about it.
And slightly ridiculous.
Which, admittedly, describes a surprising amount of Internet infrastructure.
“There are only two hard things in Computer Science: cache invalidation and naming things.”
— Phil Karlton
.md somehow managed to involve both… plus geopolitics.
Leave a Reply