6 ms·

Always use subdomains. Businesses only ever need a single $10 domain for their entire existence.

salad-tycoon 2y ago
A lot of interesting and informative rebuttals to this comment but no one anticipated the obvious counter argument. Businesses only ever need two $10 domains, usercompany.com and company.com, just in case they ever want to host user generated content.
ganoushoreilly 2y ago
I actually think they need 2, usually need a second domain / setup for failover. Especially if the primary domain is a novelty TLD like.. .IO which showed that things can happen at random to the TLD. If the website down it's fine, but if you have systems calling back to subdomains on that domain, you're out of luck. A good failover will help mitigate / minimize these issues. I'd also keep it on a separate registrar. Domains are really cheap, I try to just pay for 5-10 year blocks (as many as I can), when I can just to reduce the issues.
shafoshaf 2y ago
And a second for when your main domain gets banned for spam for innocuous reasons.
playingalong 2y ago
I think it's a sane practice to keep the marketing landing page on a separate domain than the product in case of SaaS.
- declan_roberts 2y ago
  Why? I always get frustrated when I end up in some parallel universe of a website (like support or marketing) and I can't easily click back to the main site.
  - playingalong 2y ago
    The non-technical reason is that these are usually owned by different teams in your org (after you mature beyond a 5-person startup). The technical perspective is that things like wildcard subdomains (e.g. to support yourcustomername.example.com), or DNSSec if your compliance requires it, etc. cause an extra burden if done for these two use-cases at a time. > can't easily click Http pages don't have problems with having a link to example.net from within example.com. Or the opposite. Seems like an unrelated problem.
  - thayne 2y ago
    One potential reason is that marketing teams often want to do things that are higher risk than you may want to do on your main application domain. For example, hosting content (possibly involving a CNAME pointing to a domain outside your control) on a third party platform. Using a framework that may be less secure and hardened than your main application (for example WordPress or drupal with a ton of plugins) using third party Javascript for analytics, etc.
- stagalooo 2y ago
  Could you elaborate on why? The companies I have worked for have pretty much all used domain.com for marketing and app.domain.com for the actual application. What's wrong with this approach?
  - darkr 2y ago
    If there’s any scope for a user to inject JavaScript, then potentially this gives a vector of attack against other internal things (e.g admin.domain.com, operations.domain.com etc)
    - CountVonGuetzli 2y ago
      Also, if for example the SaaS you’re running sends a lot of system emails that really shouldn’t end up in spam filters, you can’t afford to let things like marketing campaigns negatively influence your domain’s spam score. Easier and safer to have separate domains.
craftkiller 2y ago
Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com. https://github.blog/engineering/githubs-csp-journey/ https://github.blog/engineering/githubs-csp-journey/
- joelanman 2y ago
  interesting, why is this?
  - deleted 2y ago
    [deleted]
  - varun_ch 2y ago
    I can think of two reasons: 1. it's immediately clear to users that they're seeing content that doesn't belong to your business but instead belongs to your business's users. maybe less relevant for github, but imagine if someone uploaded something phishing-y and it was visible on a page with a url like google.com/uploads/asdf. 2. if a user uploaded something like an html file, you wouldn't want it to be able to run javascript on google.com (because then you can steal cookies and do bad stuff), csp rules exist, but it's a lot easier to sandbox users content entirely like this.
    - wiradikusuma 2y ago
      I'm wondering, many SaaS offer companyname.mysaas.com. Is that totally secure?
      - _cenw 2y ago
        If it's on the PSL it gets treated similarly to second level "TLDs" like co.uk.
        mhio 2y ago
        PSL = Public Suffix List https://publicsuffix.org/ https://publicsuffix.org/
theendisney 2y ago
I felt the need to get in addition to (shall we say) foo-bar.nl the foobar.nl the foo-bar.com and foobar.com because I dont want a competitor picking up those and customers might type it like that.
oasisbob 2y ago
Don't forget about infrastructure domains, static-asset domains, separation of product domains from corporate domains ... there are plenty of good reasons to use multiple domains, especially if you're doing anything with the web where domain hierarchies and the same-origin policy are so critical to the overall security model.
frosting1337 2y ago
For whatever it's worth, subdomain takeovers are also a thing and bug bounty hunters have been exploiting it for years.

A lot of interesting and informative rebuttals to this comment but no one anticipated the obvious counter argument. Businesses only ever need two $10 domains, usercompany.com and company.com, just in case they ever want to host user generated content.

ganoushoreilly 2y ago

I actually think they need 2, usually need a second domain / setup for failover. Especially if the primary domain is a novelty TLD like.. .IO which showed that things can happen at random to the TLD. If the website down it's fine, but if you have systems calling back to subdomains on that domain, you're out of luck. A good failover will help mitigate / minimize these issues. I'd also keep it on a separate registrar. Domains are really cheap, I try to just pay for 5-10 year blocks (as many as I can), when I can just to reduce the issues.

shafoshaf 2y ago

And a second for when your main domain gets banned for spam for innocuous reasons.

playingalong 2y ago

I think it's a sane practice to keep the marketing landing page on a separate domain than the product in case of SaaS.

declan_roberts 2y ago
Why? I always get frustrated when I end up in some parallel universe of a website (like support or marketing) and I can't easily click back to the main site.
- playingalong 2y ago
  The non-technical reason is that these are usually owned by different teams in your org (after you mature beyond a 5-person startup). The technical perspective is that things like wildcard subdomains (e.g. to support yourcustomername.example.com), or DNSSec if your compliance requires it, etc. cause an extra burden if done for these two use-cases at a time. > can't easily click Http pages don't have problems with having a link to example.net from within example.com. Or the opposite. Seems like an unrelated problem.
- thayne 2y ago
  One potential reason is that marketing teams often want to do things that are higher risk than you may want to do on your main application domain. For example, hosting content (possibly involving a CNAME pointing to a domain outside your control) on a third party platform. Using a framework that may be less secure and hardened than your main application (for example WordPress or drupal with a ton of plugins) using third party Javascript for analytics, etc.
stagalooo 2y ago
Could you elaborate on why? The companies I have worked for have pretty much all used domain.com for marketing and app.domain.com for the actual application. What's wrong with this approach?
- darkr 2y ago
  If there’s any scope for a user to inject JavaScript, then potentially this gives a vector of attack against other internal things (e.g admin.domain.com, operations.domain.com etc)
  - CountVonGuetzli 2y ago
    Also, if for example the SaaS you’re running sends a lot of system emails that really shouldn’t end up in spam filters, you can’t afford to let things like marketing campaigns negatively influence your domain’s spam score. Easier and safer to have separate domains.

craftkiller 2y ago

Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com. https://github.blog/engineering/githubs-csp-journey/ https://github.blog/engineering/githubs-csp-journey/

joelanman 2y ago
interesting, why is this?
- deleted 2y ago
  [deleted]
- varun_ch 2y ago
  I can think of two reasons: 1. it's immediately clear to users that they're seeing content that doesn't belong to your business but instead belongs to your business's users. maybe less relevant for github, but imagine if someone uploaded something phishing-y and it was visible on a page with a url like google.com/uploads/asdf. 2. if a user uploaded something like an html file, you wouldn't want it to be able to run javascript on google.com (because then you can steal cookies and do bad stuff), csp rules exist, but it's a lot easier to sandbox users content entirely like this.
  - wiradikusuma 2y ago
    I'm wondering, many SaaS offer companyname.mysaas.com. Is that totally secure?
    - _cenw 2y ago
      If it's on the PSL it gets treated similarly to second level "TLDs" like co.uk.
      - mhio 2y ago
        PSL = Public Suffix List https://publicsuffix.org/ https://publicsuffix.org/

theendisney 2y ago

I felt the need to get in addition to (shall we say) foo-bar.nl the foobar.nl the foo-bar.com and foobar.com because I dont want a competitor picking up those and customers might type it like that.

oasisbob 2y ago

Don't forget about infrastructure domains, static-asset domains, separation of product domains from corporate domains ... there are plenty of good reasons to use multiple domains, especially if you're doing anything with the web where domain hierarchies and the same-origin policy are so critical to the overall security model.

frosting1337 2y ago

For whatever it's worth, subdomain takeovers are also a thing and bug bounty hunters have been exploiting it for years.