Google's John Mueller confirmed on Bluesky this week that it's possible to disavow entire top-level domains using Google's disavow file. Not individual domains. Not subdomains. Entire TLD extensions like .xyz, .top, or .buzz, wiped from your link profile in a single line.
The syntax is "domain:xyz" in the disavow file. One line, and every link from every domain on that extension gets flagged for Google to ignore.
This capability doesn't appear in Google's official documentation. Glenn Gabe pointed that out in the same thread, and Mueller didn't dispute it. He also called it "a big hammer" and said he's not sure it should be documented at all, given how aggressive the action is.
Before getting into when and how to use this, it's worth stepping back and covering what the disavow tool actually does, because the tool itself is widely misunderstood and frequently misused.
What the Disavow Tool Is (and Isn't)
Google's Disavow Links Tool is a feature inside Google Search Console that lets site owners tell Google to ignore specific backlinks when evaluating a site's rankings. It works through a plain text file (disavow.txt) that gets uploaded to Search Console, containing a list of URLs or domains that should be excluded from Google's link signal calculations.
Google introduced the tool in 2012, shortly after the Penguin algorithm update started penalizing sites with manipulative or unnatural link profiles. At the time, many websites had built links through paid placements, link schemes, or low-quality directories, and Penguin was wiping out their rankings overnight. The disavow tool gave webmasters a way to signal to Google which links they wanted excluded from the equation, particularly when the links couldn't be removed at the source.
The tool accepts two types of entries. Individual URLs can be listed one per line to disavow specific pages. Full domains can be disavowed by prefixing them with "domain:" (for example, domain:spammysite.com), which covers every link from every page on that domain. Comments can be added with a # prefix for internal documentation.
The file gets uploaded to Search Console for a specific property, and it can take a few weeks for Google to incorporate the changes as it recrawls and reprocesses the affected pages. Full impact on rankings, if any, can take anywhere from two to six months to show up.
One important distinction: the disavow file is a request, not a command. Google treats it as a strong suggestion, but uploading a disavow doesn't guarantee that those links will be ignored immediately or at all. It's a signal that gets factored into Google's broader link evaluation process.
Most Sites Don't Need a Disavow File
This point gets repeated often by Google, and it's worth emphasizing because the SEO industry has developed a culture of routine disavow maintenance that Google explicitly discourages.
Mueller has said directly that the disavow tool is not part of normal site maintenance and that most sites never need to use it. Google's algorithms, including SpamBrain (the AI-driven spam detection system), are designed to identify and ignore spammy or manipulative links automatically. Random junk links from unrelated sites, foreign-language spam, and low-quality directory links are generally handled by the algorithm without any intervention from the site owner.
The term "toxic backlinks" is largely marketing language used by SEO tools to sell auditing features. Google doesn't use that term internally. A link being low-quality doesn't automatically mean it's hurting a site's rankings, because in most cases Google simply ignores it.
The situations where the disavow tool is genuinely useful are narrow. A manual action has been issued by Google for unnatural links pointing to the site. There's a confirmed pattern of manipulative link building (paid links, PBNs, link schemes) from the site's history that needs to be cleaned up. Or there's an active negative SEO attack with a high volume of spammy links being pointed at the site deliberately.
Outside of those scenarios, using the disavow tool carries real risk. Disavowing links that are actually helping a site's rankings, even if they look low-quality on the surface, can result in traffic losses that take months to recover from.
How the Disavow File Works in Practice
The process for using the disavow tool involves a few steps that are straightforward but require care.
The first step is auditing the backlink profile. Google Search Console's Links report shows referring domains and linking pages. Third-party tools like Ahrefs, Semrush, or Moz can provide more detailed views, including spam scores and link quality indicators. The goal is to identify links that are clearly manipulative, not just links that look unfamiliar or low-authority.
Each link needs to be evaluated individually. A domain with a low authority score isn't automatically harmful. A link from a foreign-language site isn't automatically spam. The evaluation should focus on whether the link was placed manipulatively, whether the linking site has any real content or purpose, and whether the link is part of a pattern (dozens of links from similar-looking sites, all with optimized anchor text, for example).
Once the list is assembled, the disavow file is formatted as a plain text file encoded in UTF-8 or 7-bit ASCII. One entry per line. URLs are listed as-is. Domains are prefixed with "domain:" to cover the entire domain. Comments start with # and are ignored by Google but useful for documenting why specific entries were added.
The file is uploaded through the Disavow Links Tool page in Search Console. It applies only to the specific property it's uploaded to. If a site has both http and https properties, the file needs to be uploaded to each. Uploading a new file replaces the existing one entirely, so any updates should include the full list, not just new additions.
The TLD-Level Disavow: What Mueller Confirmed
The Bluesky thread started with a question about a client receiving around 50 spammy redirect links per week from .xyz domains. The links didn't actually point to the site in a traditional sense, but the volume was consistent enough to raise concern.
Mueller's response was measured. He said it's fine to set up and use a disavow file if someone is conflicted and wants to be sure. He noted that if the bulk of problem links come from a few TLDs, the whole TLD can be disavowed. The syntax follows the same "domain:" prefix pattern, just applied to the TLD itself rather than a specific domain.
When another SEO in the thread expressed surprise that blanket TLD disavow was even possible, Mueller confirmed the mechanic but added an important constraint: using "domain:xyz" (or any TLD) is a blanket action, and there's no way to carve out exceptions for specific domains within that TLD. If a legitimate site on .xyz happens to link to the site being cleaned up, that link gets disavowed along with everything else on the extension.
Mueller's own characterization is worth keeping in mind. He called it "a big hammer" and said he's not sure it should be recommended in documentation because all TLDs have at least some good sites on them. The feature exists, but it's designed for situations where the tradeoff is clearly worth it.
When TLD-Level Disavow Makes Sense
The use case is narrow but real. Certain TLD extensions carry a disproportionate amount of spam traffic. Extensions like .xyz, .top, .buzz, .club, .icu, and .tk have been used heavily for spam operations, PBNs, and link schemes because of their low registration costs and minimal oversight. When a site is receiving a steady stream of manipulative links from one of these extensions and there are no legitimate referring domains on it, disavowing the whole TLD saves the time of adding domains one by one as new spam sites appear.
Before pulling the trigger, the backlink profile should be exported and filtered by the TLD in question. If even one or two high-quality referring domains sit on that extension, the blanket disavow could undo months of link-building or digital PR work. That's the core risk Mueller flagged, and it's not a small one.
The practical checklist before using TLD-level disavow looks something like this. Export the full backlink profile from Search Console and at least one third-party tool. Filter by the target TLD extension. Review every referring domain on that extension for legitimacy. Confirm that no guest posts, editorial placements, or earned media coverage lives on a domain using that TLD. Only then submit the TLD-level disavow entry.
If there are legitimate sites on the extension, the better approach is domain-level disavow for each spam domain individually, which is more time-consuming but preserves the links that are actually helping.
Common Disavow Mistakes to Avoid
Since the disavow tool is one of the few Google tools that can actively hurt a site if used incorrectly, the common mistakes are worth listing.
Disavowing links that aren't actually harmful is the most frequent error. SEO tools flag links as "toxic" based on proprietary scoring systems that don't reflect how Google actually evaluates links. A low domain authority score doesn't mean a link is harmful. A link from a site in a different language doesn't mean it's spam. If the link wasn't placed manipulatively and the linking site has real content, it's probably fine.
Using the disavow tool as routine maintenance is another common mistake. Google has been explicit that this isn't how the tool is intended to be used. Regular "disavow audits" where borderline links get removed from the profile can gradually strip away legitimate link equity that took time and effort to build.
Disavowing competitors' domains is a mistake that comes up more often than it should. If a competitor links to a site (even a competitor in a different niche), that's a real editorial link. Disavowing it because the linking domain is a competitor makes no sense from a link signal perspective.
Not keeping documentation is a practical mistake that causes problems later. The disavow file supports comments with the # prefix, and using them to note why each entry was added (and when) makes it possible to review and revise the file over time. Without documentation, there's no way to know whether a domain was added because of a genuine spam pattern or an overzealous audit.
Forgetting that the disavow file replaces, not appends, catches people too. Every upload replaces the previous file entirely. If a new domain needs to be added, the updated file needs to include everything from the previous version plus the new entries. Uploading a file with only the new domains wipes out the previous disavowals.
What This Means for Link Strategy
The TLD-level disavow confirmation is a useful addition to the toolkit for sites dealing with persistent spam from specific extensions. But it doesn't change the fundamentals of how link profiles should be managed.
The best defense against needing a disavow file in the first place is building a link profile that's grounded in real editorial value. Links earned through useful content, genuine digital PR coverage, and relevant guest posting placements don't trigger manual actions and don't need to be defended against. The sites most vulnerable to link spam problems tend to be the ones with thin link profiles where a burst of junk links can shift the overall composition.
A strong, diverse backlink profile acts as its own insulation. When the majority of referring domains are clearly legitimate and editorially earned, a few hundred spam links from .xyz domains are noise that Google's algorithms handle without intervention. The disavow tool, including the TLD-level option, is there for the cases where that noise becomes a pattern that needs manual correction.
Mueller's framing in the Bluesky thread is the right one to end on: "The disavow file is a tool, not a religion." Most sites don't need it. For the ones that do, knowing the TLD option exists can save hours of link-by-link cleanup. Just check the backlink profile first.