Website Domain Name Request

The Website Domain Policy explains how the executive branch of the Commonwealth of Massachusetts manages official government website domain names. Website domain names are also known as web addresses, unique resource locators, or URLs. Specifically, it defines standards and processes relevant to Mass.gov , State.ma.us, their subdomains (e.g., example.mass.gov), and any requests for official government websites.

The purpose of this policy is to:

• Uphold a high standard of quality for constituents’ experience interacting with the Commonwealth over the internet
• Build trust between constituents and the websites that provide government services
• Protect constituents from private websites masquerading as government websites for nefarious purposes

It is enforced and maintained by the Chief Digital Officer and the Director of Digital Governance and Policy. The Chief Digital Officer, the Chief Information Security Officer and the Assistant Secretary issue the policy.

As of 2021, all official Commonwealth government websites must have a ‘Mass.gov’ domain, like "unemployment.mass.gov" or "paidleave.mass.gov.” The Executive Office of Technology Services and Security (EOTSS) manages and approves all Mass.gov domain names.

All websites must comply with the website domain policy.  All public-facing (constituent serving) websites must also comply with the Enterprise Digital Accessibility Policy. 

Examples of digital assets with constituent facing user-interfaces that need an approved domain, and compliance checks before launching the project:

• Websites
• Web-based software
• Mobile applications
• Artificial intelligence (AI) products
• Virtual and augmented reality experiences
• Digital maps

What to expect throughout this process

1. Conduct intake meeting: After you submit this Service Now request, we will schedule a 30-minute intake meeting to go over your request, the domain policy requirements, and the assessment process.
2. Agree on domain name: Once the domain name is agreed upon, your agency DSO can submit DNS requests for non-production domains.
3. Assess site against policy requirements:
4.  
   1. During your project’s UAT phase, we assess the site against the website domain policy’s standards and requirements.
   2. Production URLs will not be enabled until the site or application is assessed against the policy’s standards and requirements.
   3. We need access to your test environment to perform the assessment, which can take 5 to 8 weeks to complete.
   4. We schedule a meeting to review the assessment findings and prioritize issues. Please account for time in your project plan to remediate issues found to avoid delays in your launch.
5. Remediate issues found: Next, you will use the results of the assessment to remediate gaps in compliance. All critical and significant issues must be addressed before moving to Production.
6. Validate remediation: We validate that the issues have been remediated and have additional protocols to address non and partial compliance in partnership with agency Secretariat Accessibility Officers.
7. Approve ticket: Once we approve your Service Now ticket, your agency DSO can submit the DNS request for the production domain and the SSL certificate request in ServiceNow.

How Mass Digital provides support

• We help you select a domain name that is easy to understand and uses plain language
• We guide you through the assessments and provide actionable feedback
• We work with you to ensure your site is compliant or has an agreed to plan to reach compliance by your launch date
• We provide user research, design and accessibility consultations, code pens, playbooks and toolkits to build compliant sites and applications faster

Domain naming guiding principles

• People shouldn't have to understand the state bureaucracy to find what they're looking for, avoid agency and product acronyms
• Put constituents first
• Design for simple, intuitive, and consistent user experiences.
• Use plain language whenever possible
• Move away from .org and .com to .gov reinforcing trust and security

All public-facing (constituent serving) websites must also comply with the Enterprise Digital Accessibility Policy

Acceptable Use of Information Technology Policy

Website Domain Policy