Public Suffix List faces calls for a safer successor

The Public Suffix List, or PSL, faces renewed criticism over the way browsers and other security systems decide where one independently controlled internet domain ends and another begins. A commentary published by CircleID argues that the volunteer-maintained text file has become a security liability because different users receive different versions, consumers interpret it inconsistently and domain operators cannot directly declare their own boundaries.

The PSL contains one suffix per line. A public suffix is a domain ending beneath which separate people or organisations may register or control names. Its ICANN section includes top-level domains and registry-operated endings such as “com,” “net” and “co.uk.” Its PRIVATE section covers services such as “github.io,” where addresses including “alice.github.io” can contain material controlled by mutually untrusted users. Mozilla devised the approach in the mid-2000s so Firefox could enforce cookie isolation, meaning one site would not improperly share small pieces of browser data with another site treated as independent.

The list subsequently became the de facto reference for many more domain-boundary decisions. Browsers bundle a snapshot into each release, so different versions may carry different copies. The CircleID commentary says version skew is common, rollbacks are extremely difficult and individual consumers do not always apply the boundaries in the same way. Browsers now use the list for site-isolation protections and for separating state and storage, the saved information associated with different sites.

Other systems have also adopted it. Certificate authorities, organisations that issue digital certificates for secure website connections, use it for purposes including rate-limit calculations. Let’s Encrypt is cited as one example. Receivers implementing Domain-based Message Authentication, Reporting and Conformance (DMARC), an email-authentication policy, have used it to identify an organisational domain. WebAuthn, the web standard behind passkeys and other strong sign-in methods, checks a site’s Relying Party Identifier against it. That identifier establishes which website is allowed to use a credential. The commentary says many other uses have developed even though PSL volunteers have acknowledged that the file was not designed for every role it now performs and that available maintenance resources are insufficient.

The central criticism concerns operator control. If a shared parent domain is missing from the PSL, a browser may apply a less restrictive policy to its hostnames. That can matter when separate, untrusted users publish content on different subdomains. According to the commentary, operators cannot independently require the enhanced isolation associated with PSL recognition. They must request inclusion, and current acceptance practices reportedly require platforms to demonstrate user populations numbering in the many thousands. The author argues that this disadvantages small services and start-ups.

That model differs from other web and DNS security mechanisms controlled by a domain owner. The commentary points to CAA and TLSA, which express certificate-related policy; DS records, which connect a domain to DNSSEC, the system used to verify that DNS answers are authentic; HSTS, which instructs browsers to require HTTPS; and CSP, which limits what resources a web page may load. These can be configured through DNS records or web headers. The PSL has no equivalent self-service declaration, leaving its boundary decisions in an external file.

The article places substantial responsibility on browser developers. Every major browser reportedly ships a PSL version, while Mozilla is described as providing more meaningful support than most. Browser makers have resisted DNS-based alternatives because of concerns about extra lookup delays and data integrity. DBOUND, an effort to develop a standard way to discover domain boundaries, did not achieve enough consensus to progress from its working group. A co-editor involved with that work said browser developers had made clear that they did not want another DNS lookup for cookie boundaries and considered a static bundled list adequate.

File size has also influenced curation. PSL volunteers have said browsers want the list kept small, encouraging restrictions on which private suffixes qualify. The commentary challenges that argument by comparing the PSL’s roughly 10,000 entries with browser HSTS preload lists containing approximately 95,000 to 172,000 entries. It also cites a report that eligible Chrome installations may download a 4GB Gemini model. In the author’s view, limiting PSL growth protects browsers from pressure to build a replacement while favouring larger platforms.

There is already one significant example of moving away from the list. RFC 9989, the latest DMARC specification identified in the commentary, no longer requires the PSL. The earlier RFC 7489 had described the dependency as imperfect and anticipated adopting a more reliable and secure method if one became generally available. An RFC 9989 co-editor explained in a response that DMARC users, software developers and vendors worked together after a decade of experience, analysed whether the change would be disruptive and agreed to update their tools.

The call to retire the PSL is disputed. One respondent argued that criticism should be directed primarily at browsers and raised through standards organisations including the IETF, CA/Browser Forum, W3C or WHATWG rather than at volunteers. The RFC 9989 co-editor also questioned whether the PSL’s limitations constitute a wider problem beyond specific use cases. The commentary nevertheless concludes that replacement is obstructed less by technical feasibility than by the difficulty of aligning browser, certificate-authority and DNS stakeholders, with no single standards body positioned to coordinate all of them.

For readers reviewing resolver privacy separately from browser boundary handling, AEU DNS provides private, secure DNS for everyone. A private DNS service does not replace the PSL embedded in browsers, so website owners with multi-user subdomains still need to monitor browser behaviour, list status and relevant standards.

The practical issue is not that the PSL has suddenly failed, but that a list created for browser cookie separation now influences certificates, email authentication, passkeys and multiple forms of browser storage isolation. Whether it should be abolished remains contested, but its static distribution, inconsistent versions and lack of direct operator control are concrete limitations that any successor would need to address.