sse-secure-systems/psl-dns

Query the Public Suffix List (PSL) via DNS and check the PSL status of a domain.

psl-dns's Issues

Reduce number of queries by using qtype ANY in favor of PTR and TXT

Canonicalize hostnames and rules (case-insensitivity)

The formal algorithm says:

The domain and all rules must be canonicalized in the normal way for hostnames - lower-case, Punycode (RFC 3492).

psl-dns needs to take this into account.

PyPi installation missing /commands/

After running pip3 install psl_dns the command line utilities (e.g. psl-dns_query) fail to run with the output ModuleNotFoundError: No module named 'psl_dns.commands'. This appears to be because the directory $PYTHONPATH/psl_dns/commands is not installed.

Add discriminator for ICANN and PRIVATE sections

The PSL is devided in several sections, currently ICANN and PRIVATE. https://publicsuffix.org/list/ explains:

While some applications, such as browsers when considering cookie-setting, treat all entries the same, other applications may wish to treat ICANN domains and PRIVATE domains differently. For example, Certification Authorities checking for wildcard misissuance would not issue a ".com" wildcard cert ("com" is in the ICANN domains list) but could legitimately issue a ".appspot.com" wildcard cert to the domain owner, in this case Google ("appspot.com" is in the PRIVATE domains list).

psl-dns currently does not expose this information to the user. In this issue, I'd like to collect reasons for and against adding some sort of discriminator.

Improve privacy

Some ideas to prevent DNS operators from learning queried names:

• Run a version of the service with each label hashed. (Think about how to salt. Parent label?) The client can determine the public suffix by comparing the number of labels in his question and the answer.
• Can something like k-anonymity be done?
• ...?