If you pay ICANN hundreds of thousands of dollars, you can get basically any .word domain.

I believe the only actual requirement is that it has to be 3 characters or longer, as two characters are reserved for countries.

Actually, no — it's an evaluation fee, simply to review your application; and they will reject applications that don't meet their criteria.

One of those criteria is that you actually do something with the gTLD — per their FAQ:

> ICANN expects all new gTLDs to be operational. One of the reasons ICANN is opening the top-level space is to allow for competition and innovation in the marketplace. The application process requires applicants to provide a detailed plan for the launch and operation of the proposed gTLD. gTLDs are expected to be delegated within one year of signing a registry agreement with ICANN.

A few highlights from the full evaluation criteria (https://newgtlds.icann.org/sites/default/files/evaluation-qu...):

- They will reject applications made by known cybersquatters

- They will reject your TLD string if it has rendering problems on major OSes (e.g. if its codepoints aren't covered by at least fallback fonts)

- They will reject your registration policies if they're incoherent or unenforceable

- They will reject your application on behalf of a community if you can't provide sufficient references establishing that you actually represent the interests of that community

- They will reject your application if you haven't outlined to their satisfaction a plan for continuity/migration of control of the gTLD from your organization to some other organization in case of the bankruptcy/dissolution/etc of your organization (note: this is a separate thing from the technical considerations of registry fail-over et al, which are more something that most applicants would have a technical registry partner fill out on their behalf)

---

In all, the process actually seems quite thorough — but as with regular domain-name registration, it's a default-accept, not a default-deny, policy. The more arbitrary gTLDs that have been established so far all just-so-happen to be "innocent" of all of the disqualifiers.

Specifically, I think, given the criteria, that any multinational company could probably expect to be able to acquire its own name and trademarks as gTLDs without much fuss; and recognized leaders/stewards of any major religion (or other non-country-endemic sociocultural group) could likely get any jargon term specific to that religion/subculture as a gTLD. Those two cases together cover most of the "weirdness" in approved applications.

One assertion I might make after reviewing the evaluation criteria, is that very few of the criteria look at the gTLD string itself. Almost any gTLD string is a potentially valid registration. Almost all of the evaluation process is set up to establish whether you, the applicant, have a valid claim for stewardship over the given gTLD string.

Application fee with ICANN: $185k, non-refundable,

Yearly fee: $25k

Technical backend with Verisign: $200k per year

Add maybe $100k of lawyer fees.

Imagine having the domain cyber[.]threat

Would be kind of cool, most attacked domain on the web, probably