Public Suffix List

A relay serves every tunnel under one domain, its own setting (LINK_DOMAIN, Change a setting): <app>.<user>.<domain>. Unless that domain is on the Public Suffix List (PSL), browsers can't keep one user's apps apart from another's. This page has why, the entry the tunnels' domain would take, and what the list's maintainers require of one.

Why it matters

Browsers treat everything under one "registrable domain" as the same site. Without an entry, that is the tunnels' domain, so every user's tunnel (app.alice.<domain>, app.bob.<domain>) is the same site as every other, and as anything else served under that domain. The relay already strips cookie Domain attributes that would cross tunnels (Keeping tunnels apart). A PSL entry fixes the root cause in browsers. Each tunnel becomes its own site, so SameSite cookies, storage partitioning and site isolation separate users' apps the way they separate unrelated websites.

Others with entries

Similar services already have entries: ngrok.io and ngrok-free.app (ngrok), trycloudflare.com (Cloudflare Tunnel), github.io (GitHub Pages).

What the list requires

The PSL maintainers (CONTRIBUTING, Guidelines) decline or delay requests that miss any of these:

  • Enough users. They decline "smaller, private projects with <2000 stakeholders". A relay only for friends doesn't qualify.
  • A role-based email address on the domain, such as security@<domain> or psl@<domain>, monitored, with replies within 30 days. A personal address is not accepted.
  • A public abuse contact. Link's is so@local.link, on the terms page (www.local.link/terms).
  • At least 2 years left on the domain's registration, and a commitment to keep more than 1 year left.
  • Terms of use covering abuse, strongly advised for a domain open to other people's content. Link's are at www.local.link/terms.
  • A DNS record proving the request comes from the domain's owner: a TXT record at _psl.<domain> naming the request, kept for as long as the entry exists.

An entry takes months to reach browsers, and removing one is just as slow.

The entry

*.<domain> makes every <user>.<domain> a public suffix, so each <app>.<user>.<domain> is its own site. Separating users is the point, and the wildcard also separates one user's apps from each other. Share links are served on <user>.<domain> itself, which the entry makes a public suffix. <domain> itself stays a normal registrable domain for the relay.