Learn more about the Public Suffix List

The Public Suffix List is a cross-vendor initiative to provide an accurate list of domain name suffixes, maintained by the hard work of Mozilla volunteers and by submissions from registries, to whom we are very grateful.

The usefulness of this can be seen if we take the example of cookies. In the past, browsers used an algorithm which only denied setting wide-ranging cookies for top-level domains with no dots (e.g. com or org ). However, this did not work for top-level domains where only third-level registrations are allowed (e.g. co.uk ). In these cases, websites could set a cookie for .co.uk which would be passed onto every website registered under co.uk .

Since there was and remains no algorithmic method of finding the highest level at which a domain may be registered for a particular top-level domain (the policies differ with each registry), the only method is to create a list. This is the aim of the Public Suffix List.

Software using the Public Suffix List will be able to determine where cookies may and may not be set, protecting the user from being tracked across sites.

As well as this, the Public Suffix List can also be used to support features such as site grouping in browsers. By knowing where the user-controlled section of the domain name begins and ends, browsers can group cookies and history entries by site in a way that couldn't easily be done before.

Some people use the PSL to determine what is a valid domain name and what isn't. This is dangerous, particularly in these days where new gTLDs are arriving at a rapid pace, if your software does not regularly receive PSL updates, because it will erroneously think new gTLDs are not valid. The DNS is the proper source for this information. If you must use it for this purpose, please do not bake static copies of the PSL into your software with no update mechanism.

Uses

These are some of the uses of the list we know about. If you are using it for something else, you are encouraged to tell us, because it helps us to assess the potential impact of changes. For that, you can use the psl-discuss mailing list, where we consider issues related to the maintenance, format and semantics of the list. Note: please do not use this mailing list to request additions to the PSL's data.

Firefox

Restricting cookie setting

Restricting the setting of the document.domain property

Sorting in the download manager

Sorting in the cookie manager

Searching in history

Domain highlighting in the URL bar

In the future it may be used for, for example, restricting DOM Storage allowances on a per-domain basis.

Restricting cookie setting

Determining whether entered text is a search or a website URL

Determining whether wildcard subdomains are allowed in Origin Trial tokens

Opera

Restricting cookie setting

Restricting the setting of the document.domain property

Internet Explorer

Restricting cookie setting

Domain highlighting in the URL bar

Zone determination

ActiveX opt-in list security restriction

Other Apps

Qt uses it to restrict cookie setting from version 4.7.2 onwards.

Crawler-Commons is a suite of tools for building a web crawler, and it uses the PSL.

Libraries

C, Perl and PHP: regdom-libs includes libraries for working with the Public Suffix List.

C: libpsl, a fast offline PSL lookup library in C

C: Faup, a command line tool with a C library and Python bindings

C#: Nager.PublicSuffix

Elixir: publicsuffix-elixir

Erlang: publicsuffix_erlang

Go: x/net/publicsuffix

Go: tldextract

Go: publicsuffix-go

Haskell: publicsuffix-haskell

Java: regdom-libs has a Java port too

Java: Guava - Google's core Java libraries - has a PSL-using class

Java: Java API for the Public Suffix List

JavaScript: publicsuffixlist.js

JavaScript: tld.js

TypeScript: tldts

Lua: lua-psl

.NET: Louw.PublicSuffix.

Objective-C: KKDomain

Perl: Domain::PublicSuffix

PHP: php-domain-parser

PHP: TLDExtract

Python: publicsuffix2

Python: publicsuffixlist

Python: dnspy - claims to be more flexible.

Ruby: publicsuffix-ruby gem

Rust: publicsuffix

Swift: Dashlane/SwiftDomainParser

There's also a list of libraries in various languages in the comments on this Stack Overflow question.

Standards

DMARC

CAB Forum Baseline Requirements. The Baseline Requirements ban the issuance of wildcard certs where the wildcard is the next label immediately after a registry-controlled label, and suggests using the "ICANN DOMAINS" section of the Public Suffix List for determining what's registry-controlled.

HTML 5 (document.domain)

Other