Root Domain Extractor

The Root Domain Extractor identifies the registrable domain (effective TLD+1) from any hostname using the Public Suffix List. Enter a hostname like app.staging.example.co.uk and the tool returns example.co.uk as the root domain, correctly handling complex TLD structures where simple string splitting produces wrong results.

Understanding Root Domain Extraction

Every hostname on the internet has a registrable domain -- the part that someone actually purchased from a domain registrar. For www.example.com, the registrable domain is example.com. That seems obvious when the TLD is a simple .com, but the internet has thousands of TLDs with varying structures. For www.example.co.uk, the registrable domain is example.co.uk, not co.uk and not example. For myapp.herokuapp.com, the registrable domain is myapp.herokuapp.com because herokuapp.com is a public suffix where individual users register subdomains. Getting this wrong has real consequences for security, cookie scoping, and domain analysis.

The reason simple string manipulation fails is that TLD boundaries are not consistent. You cannot just split on the last dot, or the last two dots, or count a fixed number of labels from the right. The suffix co.uk is two labels, pvt.k12.ma.us is four labels, and com is one label. Cloud services add another layer of complexity: amazonaws.com, github.io, and azurewebsites.net are all public suffixes even though they look like regular domains. The only reliable way to determine the boundary between the public suffix and the registrable domain is to consult the Public Suffix List.

This tool uses Mozilla's Public Suffix List, which catalogs over 9,000 public suffixes including ICANN-managed TLDs, country-code TLDs with multi-level structures, and private suffixes used by cloud and hosting providers. It correctly identifies the root domain for any hostname, regardless of TLD complexity, and also shows you the subdomain portion and the public suffix used for the determination.

How to Extract the Root Domain from a Hostname

1. Enter one or more hostnames (e.g., app.staging.example.co.uk)
2. The tool looks up the public suffix using Mozilla's Public Suffix List
3. It isolates the registrable domain by combining the label immediately before the public suffix with the suffix itself
4. Review the output showing the root domain and the remaining subdomain portion

Root Domain Extraction Examples

Why Simple String Splitting Fails

A common mistake is splitting on the first or last dot to find the root domain. This approach fails for multi-level TLDs:

Naive approach for "www.example.co.uk":
  Split on last dot     -> root = "co.uk"      (WRONG - that's the TLD)
  Split on first dot    -> root = "example.co.uk" (correct by accident)

Naive approach for "www.bbc.co.uk":
  Split on first dot    -> root = "bbc.co.uk"  (correct by accident)

Naive approach for "app.staging.example.co.uk":
  Split on first dot    -> root = "staging.example.co.uk" (WRONG)

The Public Suffix List is the only reliable way to determine TLD boundaries. It catalogs over 9,000 public suffixes including country-code TLDs, generic TLDs, and private suffixes used by cloud services.

When to Use the Root Domain Extractor

• Cookie security analysis -- Browsers use the public suffix list to determine cookie domain scope; this tool shows you the same boundaries
• Certificate SAN review -- Identifying which registrable domains appear in Subject Alternative Names
• Domain reputation lookups -- Threat intelligence feeds require the registrable domain, not subdomains
• Firewall rule creation -- Building domain-based allow/block rules that cover all subdomains of a registered domain
• Domain ownership mapping -- Grouping many hostnames by their registrable domain to understand organizational ownership
• Log analysis -- Aggregating web traffic or DNS logs by root domain rather than individual hostnames

How the Public Suffix List Works

The Public Suffix List (PSL), maintained by Mozilla, defines the boundaries between public suffixes and registrable domain names. It contains three types of entries:

ICANN Domains

Standard TLDs managed by ICANN, including:

• Generic TLDs: com, net, org, info, app, dev
• Country-code TLDs: uk, de, jp, au
• Multi-level country TLDs: co.uk, com.au, co.jp, ac.uk

Private Domains

Suffixes operated by private organizations that allow public registration of subdomains:

• github.io -- GitHub Pages custom domains
• amazonaws.com -- AWS service endpoints
• azurewebsites.net -- Azure web app hostnames
• herokuapp.com -- Heroku application domains

Under the private suffix github.io, the domain myproject.github.io is treated as a registrable domain, meaning myproject.github.io is the root, not github.io.

Exception Rules

Some entries use exception syntax (prefixed with !) to carve out special cases where a label that would otherwise be part of the public suffix is itself a registrable domain.

Root Domain Extraction in Practice

The most important application of root domain extraction is security. Browsers use the Public Suffix List to enforce cookie domain boundaries, preventing a site at evil.co.uk from setting cookies for all of .co.uk. If you are building any kind of security tool that makes decisions based on domain ownership, you need PSL-based extraction, not naive string splitting. A hostname-based blocklist that blocks malware.example.com should also block other.example.com because they share the same registrable domain and likely the same owner, but it should not block example.co.uk because co.uk is a public suffix with thousands of independent registrants.

When analyzing logs or threat data, grouping by root domain is far more useful than grouping by full hostname. An attacker might use dozens of subdomains under a single registrable domain (c2-1.evil.com, c2-2.evil.com, payload.evil.com), and grouping by root domain reveals that all of this activity traces back to one registration. Conversely, treating each full hostname as independent would obscure the pattern.

Be aware of the distinction between ICANN suffixes and private suffixes. For most security and ownership analysis, you want to use ICANN suffixes only. Under ICANN rules, myapp.github.io and yourapp.github.io are separate registrable domains owned by different people. But under a broader ownership view, they are both subdomains of GitHub's infrastructure. Some tools and libraries let you choose which PSL section to consult, and the right choice depends on your use case.

Frequently Asked Questions

What is the difference between a root domain and a TLD?

The TLD (top-level domain) is the public suffix itself, like com or co.uk. The root domain (registrable domain) is the TLD plus one additional label -- the name someone actually registers. For www.example.co.uk, the TLD is co.uk and the root domain is example.co.uk.

How are cloud provider domains like *.amazonaws.com handled?

Cloud provider domains are listed as private suffixes in the PSL. For s3.us-east-1.amazonaws.com, the public suffix is amazonaws.com (private), so the root domain is us-east-1.amazonaws.com. This matches how browsers scope cookies for these services.

Does this tool perform DNS lookups?

No. Root domain extraction is performed entirely offline using the Public Suffix List data. No DNS queries are made. The tool determines structural domain boundaries, not whether a domain actually exists or resolves.

Why does myapp.github.io show as the root domain instead of github.io?

Because github.io is listed as a private suffix in the PSL. GitHub allows users to register subdomains under github.io for GitHub Pages, making each user's subdomain a separate registrable domain. This is the same reason browsers prevent one GitHub Pages site from reading cookies set by another.

How often is the Public Suffix List updated?

Mozilla maintains the PSL as a community-driven project with frequent updates. New TLDs, cloud provider suffixes, and corrections are merged regularly. The tool uses a periodically updated copy of the list to reflect current TLD boundaries.

Related Tools

• Subdomain Extractor - Extract the subdomain portion from hostnames in bulk
• FQDN Validator - Validate fully qualified domain names
• Hostname Validator - Validate hostnames per RFC 1123 standards
• URL → Hostname Extractor - Extract hostnames from URLs in bulk
• BIND Zone A/AAAA Generator - Generate BIND zone A and AAAA records from CSV