publicsuffix.zone

What It Is

publicsuffix.zone is a Public Suffix List DNS Query Service operated by SSE, an IT security consulting company based in Berlin, Germany. It turns the Public Suffix List—which applications would normally need to download, parse, and keep updated—into DNS queries: query the PTR record for $DOMAIN.query.publicsuffix.zone to get the corresponding public suffix. For example, supertux.github.io returns github.io.

Core Capabilities and Integration

Its main value is reducing the complexity of PSL integration. The PSL is commonly used for security decisions around browser cookie scope, certificate issuance, and multi-tenant authoritative DNS. Traditionally, applications must maintain the PSL text file, implement a multi-step matching algorithm, and keep it updated. This service instead performs matching through DNS zones, CNAMEs, wildcards, and PTR records. If a domain matches multiple rules, the page notes that TXT records may also show rules that were applied but overridden.

Languages, API, and Ecosystem

The API is extremely lightweight: it is essentially a standard DNS query, so it can be integrated with dig or any DNS client. The page also provides psl-dns for Python, supporting both library and command-line usage. The “Try it” example uses Google’s DoH resolver, but that does not mean Google is required. In terms of ecosystem, the PSL zone is hosted on deSEC, and the service is operated for free by SSE.

Pricing and Deployment

The documentation clearly states that the service is provided free of charge. It does not disclose any paid plans, request limits, SLA, or enterprise support. For self-hosting, the page says users can contact the project via GitHub if they want to run a local copy, but it does not publicly provide a complete deployment guide. As a result, there is still some uncertainty for highly regulated or offline environments.

Pros, Cons, and Best-Fit Users

The advantages are that it uses a universal protocol, is easy to integrate, and removes the need to maintain a local PSL. It is especially suitable for security teams, certificate systems, DNS platforms, and backend services that need quick public suffix checks. The downsides are that DNS resolvers can see the queried domains, so privacy-sensitive use cases should be cautious. In addition, the page only explicitly provides a Python tool, with limited information on multi-language SDKs, error handling, rate limits, and availability guarantees.

Access from China and Alternatives

The page does not provide information about availability from mainland China, so access should be considered unknown. If direct access is unstable or privacy is a concern, you can use a local PSL parsing library inside your application, contact the project team about deploying a local copy, or directly maintain the Mozilla Public Suffix List and use PSL libraries from the relevant language ecosystem.