The Public Suffix List is “just a list”

\n A couple weeks ago, Sam{\" \"}\n asked me how much I knew about the Public Suffix List. Many people have\n asked me this when they hear I’m writing a book about domains. To date\n my answer has been: not much.\n

\n The Public Suffix List{\" \"}\n has this paradoxical vibe of being pretty casual but rather important.\n The volunteers who maintain the list call it “a globally used resource”\n and warn that any change will affect “tens of millions, perhaps hundreds\n of millions” of people on the internet. But they also say:\n

\n
The PSL is just a list.
\n

\n It really is{\" \"}\n \n just a file\n {\" \"}\n on a public GitHub repository. OK, but I’ll back up—suffix{\" \"}\n here means a domain name ending, like:\n

.com
.co.uk
.omg.lol
.cincinnati.oh.us

\n And public{\" \"}\n means anyone can register a domain under that suffix, like:\n

rotatingsandwiches.com
economics.co.uk
adam.omg.lol
nguyen.cincinnati.oh.us

\n The list is around 10,000 of those public suffixes.\n

Cookies, beer, and pizza

\n The first answer to “why does this list exist?” is: cookies.\n Browsers—Chrome, Safari, Firefox, et al.—look to the PSL to figure out\n whether a domain like evil.co.uk should be able to set a cookie on\n co.uk. Without the PSL, if evil.co.uk set a cookie on co.uk, it could be\n passed on to bank.co.uk. But because co.uk is on the PSL, evil.co.uk\n can’t set that cookie (phew).\n

\n About half of suffixes on the list are run by countries. The .us\n registry, for example, has entries for each state on the list: ak.us for\n Alaska, al.us for Alabama, ar.us for Arkansas, and so on\n (\n how’d they come up with those state abbreviations, anyway\n ?). Italy has hundreds of suffixes under .it. Japan has even more\n than Italy for .jp (like, way more).\n

\n The next thousand or so suffixes on the list are generic top-level\n domains like .com, .app, .beer and .pizza. And finally, about a third of\n suffixes are run by companies. Amazon has a whole bunch. Apple, Google,\n OpenAI, Anthropic, Cloudflare, GitHub, Figma, Shopify, Lovable, Replit,\n Vercel—they all have domains on the list.\n

\n A company requests to add a domain to the PSL when they issue subdomains\n under it. For example, at Val Town we hand out val.run domains to\n users—someone makes a website on garden.val.run and someone else makes\n one on abottom.val.run. Those websites can’t share cookies because we\n submitted val.run to the PSL (royal “we”—it was Tom).\n

\n The list is a shared resource, and the maintainers hint that any company\n serving less than “thousands of users” with their suffix won’t be\n approved.\n

\n
\n Expanding the file size even in small ways increases the overhead for\n everyone.\n
\n

\n Browsers use the PSL for more than just cookie security. They can sort\n or group your browsing history by public suffix, or use it to determine\n whether what you type into the address bar is a search query or a URL.\n Other software uses the PSL, too. Your email provider could use it to\n determine whether to auto-hyperlink the example domains I used above.\n There isn’t, as far as I’m aware, a standard ruleset dictating how\n browsers and other software must use the list, or how quickly they have\n to adopt changes. As the PSL maintainers write, “Browsers do what\n browsers do, diversely, and the PSL is not the boss of them.”\n

Rather important, pretty casual

\n The Mozilla Foundation stewards the Public Suffix List. I am not sure\n how many maintainers actually work for Mozilla, though. They’re\n volunteering under the umbrella of Universal Acceptance, ICANN’s\n initiative to have all domain names equally accepted across the internet\n (example: signup forms should accept valid email addresses with domain\n names in languages and scripts other than English).\n

\n I get the sense from the PSL’s{\" \"}\n \n README\n {\" \"}\n and{\" \"}\n \n Guidelines\n {\" \"}\n that the maintainers are a thinly staffed team of volunteers who are,\n unsurprisingly, burdened with low effort slop. They ask submitters to\n “be extremely thorough and patient.” But I imagine the maintainers are\n the extremely thorough and patient ones, to whom the courtesy isn’t\n always returned.\n

\n It’s kind of hard to believe that important parts of internet\n infrastructure run like this: a plain text file maintained by a group of\n volunteers online. The Domain Name System itself was created to replace\n a centralized list, hosts.txt, with domain names and corresponding IP\n addresses. DNS is remarkably stable, and I’m interested in the human\n work that goes into this sort of thing, expert volunteers maintaining\n these complex systems. But as the maintainers remind us—they repeat it\n four times, actually—the Public Suffix List is, after all, just a list.\n

\n \n P.S. I want to talk to people who work on or with the PSL, or know\n about it. If that’s you (or your coworker/friend/whomever), reply and\n teach me. Tell me what’s interesting or hard or fragile or\n underappreciated.\n \n