effective Top-Level Domain

web security

Definition

effective Top-Level Domain (eTLD)

The eTLD is the longest public-suffix portion of a domain name — the part owned by a registry rather than by any individual registrant. It is defined by the Public Suffix List, maintained by Mozilla, which lists public suffixes specifically so that browsers can tell where a registry’s boundary stops and a registrant’s domain begins.

A plain TLD is always an eTLD: com, org, at are eTLDs. But multi-label suffixes can also be eTLDs when a registry administers names one level lower, e.g. ac.at (Austrian academic) or co.uk (UK commercial). Conversely, the PSL sometimes demotes a whole shared-hosting domain to an eTLD so that each user is isolated: github.io is an eTLD, hence lavish.github.io is its own registrable domain rather than a subdomain of one github.io registrant.

The eTLD is the input to the eTLD+1 rule that defines a site: append exactly one registrant-controlled label to obtain the registrable domain.

Why a list rather than just “the last label”

Intuition

“Last label” would give ac.at-style registries a free hand to merge every Austrian university into one site, and would not isolate users on github.io. The Public Suffix List encodes, per suffix, where the registry boundary actually is — one or more labels deep — so the eTLD+1 cut lands on a single registrant’s domain instead of on a shared registry.