Domain extraction method for distinguishing ICANN domain suffixes and private suffixes

[ownthink]

Problem Statement

Currently, when parsing domain names (e.g., from HTTP requests or URL lists), applications often need to know:

• Whether a suffix is an ICANN-managed TLD (like .com, .co.uk) — for security policies, cookie scoping, or TLS certificate validation.
• Whether it’s a private suffix (like *.github.io, *.cloudfront.net) — for dynamic subdomain assignment, where the parent domain is effectively a "user-controlled" zone.

However, the Public Suffix List (PSL) itself does not expose this distinction in a single function. The current psl_is_public_suffix2() only returns a boolean (whether a domain is a public suffix), but does not tell which category it belongs to.

Why this is needed

• For browser cookie policies, ICANN suffixes are treated differently from private ones (e.g., co.uk vs github.io).
• For security scanners, detecting "registered domain" requires stripping private suffixes first in some contexts, but not in others.
• For data analytics, grouping by ICANN TLDs vs private suffixes gives different insights.

Possible Solution

• Provide a domain extraction method similar to Python's tldextract, which can distinguish whether a domain suffix is a private suffix:

>>> import tldextract
>>> 
>>> tldextract.extract("d3i9t3h8gsbtc5.cloudfront.net")
ExtractResult(subdomain='d3i9t3h8gsbtc5', domain='cloudfront', suffix='net', is_private=False)
>>> 
>>> tldextract.extract("d3i9t3h8gsbtc5.cloudfront.net", include_psl_private_domains=True)
ExtractResult(subdomain='', domain='d3i9t3h8gsbtc5', suffix='cloudfront.net', is_private=True)
>>> 
>>> 

[rockdaboot]

Hm, I think you can do this with some wrapper code around psl_is_public_suffix2().

Can you add more details, and maybe a problem statement and why this is the preferred solution? (Feel free to amend the issue description).
Maybe share a link to the exact design/algorithm docs? Otherwise, we never have confidence that the Python function and our C function stays in sync.

[ownthink]

Hi @rockdaboot, Thanks for your quick response and for pointing me to psl_is_public_suffix2(). I’ll clarify the problem statement and the preferred solution below.

…

--- Problem Statement Currently, when parsing domain names (e.g., from HTTP requests or URL lists), applications often need to know: · Whether a suffix is an ICANN-managed TLD (like .com, .co.uk) — for security policies, cookie scoping, or TLS certificate validation. · Whether it’s a private suffix (like *.github.io, *.cloudfront.net) — for dynamic subdomain assignment, where the parent domain is effectively a "user-controlled" zone. However, the Public Suffix List (PSL) itself does not expose this distinction in a single function. The current psl_is_public_suffix2() only returns a boolean (whether a domain is a public suffix), but does not tell which category it belongs to. Why this is needed · For browser cookie policies, ICANN suffixes are treated differently from private ones (e.g., co.uk vs github.io). · For security scanners, detecting "registered domain" requires stripping private suffixes first in some contexts, but not in others. · For data analytics, grouping by ICANN TLDs vs private suffixes gives different insights.

------------------ Original ------------------ From: Tim Rühsen ***@***.***> Date: Sun,Aug 2,2026 4:09 AM To: rockdaboot/libpsl ***@***.***> Cc: Yener ***@***.***>, Author ***@***.***> Subject: Re: [rockdaboot/libpsl] Domain extraction method for distinguishing ICANN domain suffixes and private suffixes (Issue #287) rockdaboot left a comment (rockdaboot/libpsl#287) Hm, I think you can do this with some wrapper code around psl_is_public_suffix2(). Can you add more details, and maybe a problem statement and why this is the preferred solution? (Feel free to amend the issue description). Maybe share a link to the exact design/algorithm docs? Otherwise, we never have confidence that the Python function and our C function stays in sync. — Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>

[rockdaboot]

Thanks, amended the PR description with your text.

Just one question regarding

The current psl_is_public_suffix2() only returns a boolean (whether a domain is a public suffix), but does not tell which category it belongs to.

psl_is_public_suffix2() takes a type (PSL_TYPE_ICANN or PSL_TYPE_PRIVATE or both combined), so you can specify in which section of the PSL the lookup happens. Isn't this enough for tackling the problem?

Maybe you also need psl_registrable_domain2() and psl_unregistrable_domain2() that take a type as an additional param?

That would keep the library changes trivial. While a psl_tld_extract() function is complex (e.g., multiple return values require a struct and memory allocations), especially without a specification.

[ownthink]

The use case is to distinguish the extraction methods for ICANN domain suffixes and private suffixes. The standard we follow is to use the BEGIN ICANN DOMAINS and END ICANN DOMAINS markers in public_suffix_list.dat to differentiate them. This implementation is written in Go:

https://github.com/ownthink/tldextract/blob/main/tldextract.go

	icann := false
	for {
		line, err := readLine(br)
		if err == io.EOF {
			break
		}
		line = strings.TrimSpace(line)
		
		if strings.Contains(line, "BEGIN ICANN DOMAINS") {
			icann = true
			continue
		}
		if strings.Contains(line, "END ICANN DOMAINS") {
			icann = false
			continue
		}
		
		if line=="" || strings.HasPrefix(line, "#") || strings.HasPrefix(line, "//"){
			continue
		}

[ownthink]

The Python implementation of tldextract is indeed very convenient, and it has a large user base. If libpsl needs to be modified, it will definitely require some marking/annotation.