Organizational Domain


We often want to know whether two hostnames are controlled by the same person, or not.

One case for that is cookie privacy in web browsers. We want pages at and and to all be able to set and read cookies for each other – so a user only needs to log in once for pages or images on all of them to work well together.  So we allow all of them to access cookies for “*”.

But we don’t want and to be able to access each other’s cookies. (Both for privacy reasons and for security, so a hostile page at can’t steal authentication cookies for from the user).

Loosely, we want to be able to say that and are sort of the same, while and aren’t.

At first that looks pretty simple to do, especially if you’re in the US. Two hostnames are the same if they’re in the same domain. The relevant domains here are obviously and And there’s an obvious way to find the domain: it’s the last two words in the hostname, sometimes called the second level domain and top level domain.

For the second-level domain would be “blighty”, the top-level domain would be “com” and the domain would be “”. We can say that any hostname that ends in “” is in that domain, and reasonably assume that they’re controlled by the same person.

But … if we’re looking at then the domain is “”. Our simple algorithm to find the “domain” doesn’t work.

You’d think that somebody would have thought about this when designing the domain name system, wouldn’t you? But no. They didn’t.

In DNS there’s not really any such thing as a “domain” or a “subdomain”. It’s all hostnames. “”? Hostname. “”? Hostname. “com”? Hostname. “.”? Hostname. And DNS doesn’t provide any information about common ownership between hostnames, at all.

So if we want to find the “domain” for a hostname we’re going to have to come up with some other way of doing it. One obvious approach would be to manually maintain a list of all the possible “top level domains” under which people can register a domain. That’d be quite ridiculous and excrutiatingly painful to maintain. So that’s what we did.

The Public Suffix List is a list of over 8,000 “top level domains”. It has both real ones like “.com”, “”, “.zippo” and “.” under which people can register domains, but also domains under which many independent customers can use their own subdomains such as “” or “”. Using this list you can finally define a unique “domain” part of any hostname. That’ll often be the same as the intuitive idea of a domain – “”, “” or “”. Sometimes it won’t be – “”, “” or “” – but in those cases it’s a better description of the subdomains that are under the control of a single user.

 The public suffix list is included in every web browser, to handle cookie security. It’s useful for other things too. We use it in several of our internal data-clustering tools to canonicalize URLs and MXes. And it’s a critical part of DMARC.

One of the first new concepts DMARC exposes you to is “aligned domains”.

“DMARC passes if either the message is validly DKIM signed and the DKIM d= domain aligns with the domain in the From: field, or if the message passes SPF with a domain that aligns with the domain in the From: field.”

DMARC defines two different sorts of alignment between domains. The less interesting one is “strict alignment”, communicated via adkim=s or aspf=s fields in the DMARC record. Strict alignment just means the domains are identical. The much more interesting one is “relaxed alignment”, communicated via adkim=r or aspf=r. With relaxed alignment then two domains are aligned if they’re in the same Organizational Domain – which is the extended, formalized definition of a domain as defined by the Public Suffix List.

You knew there was going to be something email-related eventually, right?

About the author


This site uses Akismet to reduce spam. Learn how your comment data is processed.

  • You say ‘In DNS there’s not really any such thing as a “domain” or a “subdomain”. It’s all hostnames.’
    That’s the opposite of my understanding. If I’m right, there aren’t really any hostnames. They are all domain names. A quick scan of RFC1034 doesn’t tell me I’m wrong, although I haven’t found a definitive statement.
    Of course I’m not a DNS expert and your expertise is probably greater than mine.

  • Yes, you’re right, the terminology used in the RFCs is mostly domain name (or label).
    The distinction I’m trying to draw is that there’s no concept in DNS of splitting a domain into a “domain part” and a “host part”. The word domain carries a lot of baggage along with it – top-level domain, second-level domain, sub-domain, and domain name (e.g. “the domain of is”), mostly coming from the domain registration space where distinguishing between “the bit you pay for”, “the bit we control” and “the bit you control” is useful. “Hostname” doesn’t have that problem.

By steve

Recent Posts


Follow Us