&quot;Who can...&quot; 
ICANN. Yes it can be whenever they want.  No one ever stops them.  They added several in 2001.  Now they&#x27;ve opened the floodgates.<p>&quot;At no real cost...&quot;  
True.  Except the cost of running one of the 13 server addresses.  And IMO it could be a dog and no one would notice.  I think the A server (198.41.0.4) is really all anyone needs.  The cost of a new TLD to ICANN is the cost of editing a text file.<p>&quot;By what authority...&quot; 
None.<p>&quot;, why are they allowed...&quot; 
A question I have been asking for over 20 years.
Answer: Because we let them?<p>You can say no to ICANN.  Run your own root on 127.x.x.x.  You can edit the root.zone to be just as you want it.  Want to delete a silly TLD (e.g., .loans)?  Edit a text file.  Want to add your own new TLD?  Edit a text file.  The cost?  Editing a text file.<p>I recall a former Board member of ICANN admitting he himself ran his own root for many years.<p>ICANN&#x27;s ability to make millions in profit from TLD&#x27;s relies on an interesting prerequisite.  All DNS admins have to use a root.hints file that points to the (13) addresses serving ICANN&#x27;s root.zone.  Often they have no idea this root.hints file even exists, let alone have the guts to edit it.  The root server addresses to use are chosen by the authors of the DNS software, e.g., the software automatically downloads root.hints from ICANN to bootstrap itself.<p>If admins or users choose to use a different list of root server addresses (e.g., 127.x.x.x, 10.x.x.x., etc.), all bets are off.<p>So how do you stop ICANN from making millions posing as a pseudo licensing authority for registries?  One way is to stop using ICANN&#x27;s root.hints and use a different root.zone that you control.  If enough people do this then one day ICANN has no relevance.<p>Right.  Not gonna happen.  I&#x27;m probably one of only a small number of users who will ever run their own root.