Public Suffix list

December 31, 2015

I was always wondering, why domains from United Kingdom are registered under domain. Why not just under .uk?

It is up to each of the top level domain (TLD; i.e.: .uk) registrars to decide whether to allow registration of second level domains (i.e. or to create other specific rules (i.e. Although is one of the most known ones, there are more exotic ones, i.e. These are calles public suffixes (or earlier - effective TLDs).

Besides the logical mismatch of domain names, such situation also creates a technical issue - setting cookies to the whole domain instead of the local scope.

As stated in RFC6265, HTTP cookie can have an attribute Domain, telling under which domain the cookie is included in each request from the user agent (web browser) to the server. I.e. setting a cookie from domain it is possible either to limit the cookie validity to the domain, or to the whole domain. In regular scenario, when whole 2nd level domain is controlled by the same owner, it might be a legit activity, but since and can be controlled by totally different owners, this situation would allow to set the cookies for the whole domain (as the TLD is the same

The same situation might happen not only with TLDs, but with hosting providers as well. Especially with those who allow their customers to use a 3rd level domain (i.e.

The similar issues might occur with wildcard SSL certificates, i.e. issuing wildcard certificate for the whole public suffix. Validating/invalidating an SSL certificate of the whole public suffix seems to be also under consideration (RFC6125 section 7.2).

Since there is no easy way to distinguish which part of the particular domain is a publix suffix (especially, considering 4th level domain scenarios), the publix suffix list has been created: It is maintained by Mozilla foundation and is used by the most common web browsers. According to the learn page at these are the main use cases of the list for the browsers:


Chromium/Google Chrome (pre-processing, parser)


Internet Explorer

More generic list of use cases can be found at

The use of this list is also suggested in RFC6265, saying that “If feasible, user agents SHOULD use an up-to-date public suffix list”.

As modern browsers are dependent on such single sources of truth (like this list, or HSTS preload list) it becomes more clear why browser updates are such frequent, and it leverages the importance of using up-to-date browsers to ensure the proper workflow and security of the web.