Add gv.uy to public suffix list

[chengdada123]

Added entries for gv.uy and its submission details.

Public Suffix List (PSL) Submission

Checklist of required steps

• Description of Organization

• Robust Reason for PSL Inclusion

• DNS verification via dig

• Each domain listed in the PRIVATE section has and shall maintain at least two years remaining on registration, and we shall keep the _psl TXT record in place in the respective zone(s).

Submitter affirms the following:

• This request was not submitted with the objective of working around other third-party limits.

• The submitter acknowledges that it is their responsibility to maintain the domains within their section. This includes removing names which are no longer used, retaining the _psl DNS entry, and responding to e-mails to the supplied address. Failure to maintain entries may result in removal of individual entries or the entire section.

• The Guidelines were carefully read and understood, and this request conforms to them.
• The submission follows the guidelines on formatting and sorting.

• A role-based email address has been used and this inbox is actively monitored with a response time of no more than 30 days.

Abuse Contact:
abuse@mailto.al

• Abuse contact information (email or web form) is available and easily accessible.

  URL where abuse contact or abuse reporting form can be found:
  https://nic.gv.uy/news/abuse

---

For PRIVATE section requests that are submitting entries for domains that match their organization website's primary domain, please understand that this can have impacts that may not match the desired outcome and take a long time to rollback, if at all.

To ensure that requested changes are entirely intentional, make sure that you read the affectation and propagation expectations, that you understand them, and confirm this understanding.

PR Rollbacks have lower priority, and the volunteers are unable to control when or if browsers or other parties using the PSL will refresh or update.

(Link: about propagation/expectations)

• Yes, I understand. I could break my organization's website cookies and cause other issues, and the rollback timing is acceptable. Proceed anyways.

---

Description of Organization

GV.UY is a platform that provides developers with free third-level domain registration, free web hosting, and free containers and virtual machines. Anyone can register and use a third-level domain ending in gv.uy for free. Our free web hosting and VPS services greatly assist them in learning, testing, and even production use.

I am Cheng, the technical lead of gv.uy, responsible for all platform affairs, including domain maintenance and improvement.
Organization Website:

https://nic.gv.uy

Reason for PSL Inclusion

Our users have used our free facilities to build websites and perform other operations. Since we support subdomain-based registration, this means that each website under a subdomain can operate independently. For security reasons, we need to restrict cookies to their respective subdomains and ensure data isolation between subdomains to prevent potential security risks.
**Number of users this request is being made to serve:**1000+

Our user base has exceeded 1000+ and continues to grow. We have registered over 900 subdomains, and we strictly limit each account to registering only one subdomain.

Related pull requests: None

DNS Verification

dig +short TXT _psl.gv.uy
       "https://github.com/publicsuffix/list/pull/2718"

gv.uy has an expiration date of 10 years.

[groundcat]

• Expiration (Must STAY >2y)
  • WHOIS shows registration 2025-11-19
• Organization description
  • GV.UY provides free domains, hosting, VPS to developers
• Reasoning/PSL Inclusion
  • Cookie isolation for independent subdomains: Valid security use case
  • 3rd party limits
  • 1000+ users, 900+ subdomains
• Email address
• DNS Verification
  • References PR Add gv.uy to public suffix list #2718 correctly
• Abuse contact
  • Listed at https://nic.gv.uy/news/abuse, but the redirect from https://gv.uy falls into an infinite loop on a loading page displaying "加载中..." - I assume this should redirect to your organization website https://nic.gv.uy/ with the contact information? Sophos marks gv.uy as spam - you might want to resolve this with them.

[chengdada123]

@groundcat
Hello, thank you for taking the time.

Regarding the domain expiration date, it's likely due to registry restrictions that you cannot check the expiration date through Whoise. I have provided a screenshot of the domain registration website; the domain has been renewed until November 19, 2035. I would be happy to provide more information, such as an invoice, if needed.

Regarding the redirection issue with https://gv.uy, it's likely due to an excessively long redirect time we previously set. We have updated the website and no longer use redirects. In fact, most users access our services through https://nic.gv.uy.

Regarding the issue you mentioned where Sophos marked gv.uy as spam, I believe this is a false alarm. We have been monitoring activity on this subdomain and monitoring security vendors' marking behavior through VirusTotal. We have not found any signs of abuse. We have contacted the security vendor Sophos and are working to resolve this issue.

Thank you for your reply.

[groundcat]

Thanks for the quick fixes!

[fakeboboliu]

I just received an email warning that the gv prefix might be confused with government-related subdomain listings.

I have already invited the email sender to discuss the concerns here with the stakeholders. If they ultimately does not show up, I will consider republishing the email in full here to avoid any potential security issues.

[chengdada123]

@fakeboboliu
Thank you for raising this question, and I appreciate your concern about potential ambiguity. I understand the sender's concerns.

To clarify, the prefix "gv" has no government-related connotations and does not represent or imply any government or official organization. It was chosen primarily for its brevity and memorability, without any other special considerations. In fact, our organization name, official website, and logo consistently use the full domain name "GV.UY," rather than using "gv" as a standalone name or promotional material.

I also strongly agree that now is indeed the appropriate time to conduct a compliance review. As the project grows and the user base increases, a server hold triggered by the registry due to compliance issues would pose a significant risk to public domain extension projects.

I will patiently await the investigation results, and I thank you again for anticipating and raising this issue.

[groundcat]

In the private section of PSL there is already a suffix (introduced by PR #844) using the “gv” string, which corresponds to a private DDNS service rather than a government entity.

list/public_suffix_list.dat

Lines 12402 to 12406 in a081401

	// ASEINet : https://www.aseinet.com/
	// Submitted by Asei SEKIGUCHI <mail@aseinet.com>
	user.aseinet.ne.jp
	gv.vc
	d.gv.vc

Meanwhile, in the ICANN section, there do appear to be two countries that use “GV” instead of “GOV” or other variants as their official suffix. This is similar to how some countries, such as Japan, use “ed” rather than “edu,” even though “edu” has become the more widely adopted convention.

list/public_suffix_list.dat

Line 234 in a081401

gv.at

list/public_suffix_list.dat

Line 183 in a081401

gv.ao

Perhaps the wiki guidelines could be updated to clarify under what circumstances certain strings like “gov,” “mil,” or “police” (and their multilingual variants) should receive additional scrutiny. Beyond that, I’m not sure what more the PSL project itself can reasonably do.

In this particular case, if the requester or their organization has no intention of causing confusion - unlike cases such as #2473, which is more clearly misleading - then it might be acceptable, as with gv.vc (#844).

@dnsguru WDYT?

[chengdada123]

@groundcat :
Hello, Sophos security vendor has relabeled it, please check.

[chengdada123]

Hello:

As you can see, our platform is experiencing rapid user growth. With this surge in users, cross-domain issues and cookie isolation have become critical security concerns that urgently need to be addressed. Adding our subdomains to the Public List of Domains (PSL) will enable browsers to recognize our subdomains as top-level domains, effectively mitigating these issues and significantly improving the platform's overall security.

Currently, to reduce security and abuse risks, we have temporarily suspended new user registration (including registration via OAuth2 and GitHub) and further strengthened security checks and abuse detection mechanisms across the platform. In the future, we may implement an invitation-only registration system or a more stringent review process.

We earnestly request the review team to consider and merge our application as soon as possible.

We will do our utmost to ensure the platform's security and stability, providing our customers with long-term, stable services.

Thank you very much for taking the time to carefully consider our application.