What Is a Public Suffix?

Stairwell shows you a value called eTLD+1 in several places, and it is the answer to a question that turns out to be surprisingly hard: given a hostname, which part of it does one person actually control?

That question matters every time you block something, allow something, or claim two hostnames belong to the same operator. Get the boundary wrong in one direction and you block a hosting provider that half the internet uses. Get it wrong in the other and you block one hostname while the operator moves to the next one before lunch.

How are domain names structured?

As a hierarchy, read right to left.

At the root is the root zone, written as a single dot. You almost never see it, because it is silent. The name is really stairwell.com. with a trailing dot, and every tool quietly drops it.

Below the root are top level domains, or TLDs: .com, .net, .org, .io, .uk. Below a TLD sit the names people register, which is where stairwell.com comes from.

So the intuitive rule is "one level below the TLD is the thing somebody bought". That rule is right often enough to be dangerous, because the exceptions are common and they are exactly where attackers operate.

Where does the intuitive rule break?

Two places, and they break it in the same way.

Country code registries with their own structure. The UK registry does not let the public register names directly under .uk. It created .co.uk and people register below that, which is how google.co.uk exists. So for a .co.uk name, the part somebody owns is three labels, not two. Plenty of registries do something similar, and there is no pattern you can compute. You have to know.

Providers who hand out subdomains. If you deploy an app on a platform that gives you a name under its own domain, you get something like mikes-service.appspot.com, and somebody else gets pauls-service.appspot.com. Technically the registered domain is appspot.com and it belongs to the platform. Practically, appspot.com behaves exactly like a TLD: anyone can claim a name under it, and two names under it have nothing to do with each other.

Both cases are the same problem. The level at which the public can claim a name is not always one level below the TLD.

So what is a public suffix?

A public suffix is the point in the hierarchy at or below which anyone can claim a name.

.com is a public suffix. So is .co.uk. So, for practical purposes, is appspot.com, even though it sits under .com and somebody registered it.

The eTLD+1 is that public suffix plus the one label to its left: the smallest piece that one party actually controls. The name is literal. The public suffix behaves as an effective top level domain, and you take one more label.

Read the last row against the third. Both hostnames have four labels. Their eTLD+1 values have a different number of labels, because the boundary is a fact about the registry rather than a fact about the string. You cannot find it by counting dots, which is the single most useful thing on this page.

Where does the answer come from?

From the Public Suffix List, a shared resource maintained by Mozilla and used across browsers, security tooling, and libraries. It has two sections: the ICANN section, which holds the real registry rules such as .com and .co.uk, and the private section, where providers like the app-hosting example above register themselves so the rest of the world treats their domain as a boundary.

Two honest limits. The list is not complete, because it depends on providers adding themselves, so a service that hands out subdomains and never submitted an entry will be scored as an ordinary domain. And it changes: entries are added continually, so the eTLD+1 of a name can change as the list learns about a provider. Stairwell tracks the list rather than a snapshot of it.

Why does this matter for an investigation?

Because eTLD+1 is the right unit for three decisions you make constantly.

Blocking. Malware talks to admin.foobar.appspot.com. Block the full hostname and the operator uses a different one immediately. Block appspot.com and you have blocked an entire hosting platform, including services your business depends on. The defensible answer is foobar.appspot.com, the eTLD+1, which is exactly the part that operator controls and no more.

Attribution. Two hostnames sharing an eTLD+1 are one party. Two hostnames sharing only a public suffix are strangers who happened to pick the same provider. This is the difference between a finding and a coincidence, and it is the mistake most often made when someone groups indicators by "domain" without defining the term.

Allow lists. The same boundary works in reverse. Allowing an eTLD+1 covers every subdomain your vendor might add tomorrow, without extending trust to everything else on their provider's platform.

The general rule that falls out of all three: make blocking and allow decisions at eTLD+1 boundaries. Narrower and you are chasing hostnames. Broader and you are making a decision about somebody else's customers.

What about hostnames, domains, and subdomains?

Worth pinning down, because these words are used loosely and the looseness causes real errors.

• A domain name is a name registered directly under a public suffix. stairwell.com, google.co.uk, and paul-service.appspot.com are domain names.
• A hostname is any name in the hierarchy, including a domain name. www.stairwell.com and foo.bar.stairwell.com are hostnames but not domain names.

So every domain name is a hostname, and most hostnames are not domain names. When somebody says "block the domain", ask which they mean.

Where do I see this in Stairwell?

• Backstory investigations group hostnames by eTLD+1, so a graph shows one node per operator rather than one node per hostname, and a campaign using forty subdomains reads as one thing. See Backstory.
• Copy actions on a hostname offer the eTLD+1 alongside the full name, and a defanged form of each, so the value you paste into a ticket or a blocklist is the one you meant.
• The REST API exposes a utility that returns the eTLD+1 for a name, singly or in bulk. It is the least glamorous endpoint Stairwell offers and it saves the most time, because everyone who joins network data to their own data writes this badly at least once. See REST APIs.
• Network Intelligence, where the subdomain list on a hostname panel is how you go from one host to the shape of a whole domain.

What should I read next?

• Network Intelligence, for the resolution history that turns a domain into a timeline.
• Someone Reported a Suspicious Domain, for the whole workflow, where this boundary decides what you carry into a blocklist.
• What is a threat report?, since a report's hostname indicators are worth reading with this distinction in mind.