Hacker News Reader

Comment by fabstei | Hacker News Reader

A concrete counterexample: plantura.garden is a large, reputable German-language gardening magazine / brand, and probably exactly the kind of legitimate site one would expect on .garden.

So while the abuse numbers may well justify treating newly registered / low-reputation .garden domains with suspicion, blanket-blocking the entire TLD seems like it would create real collateral damage.

View on HN

For businesses, it's not a valid reason to not block .garden simply because a gardening site exists. If a site is important enough, exceptions to the blanket rule can be applied.

In general though, if you want Fortune 500s to utilize your service/company, don't utilize a novelty TLD.

Blanket ban rules are extremely lazy and unacceptable in 2026, especially for Fortune 500s. It’s extremely cheap to use a scoring system instead.

Really don't understand what "unacceptable" even means in this context. It is perfectly acceptable for a company to control internet access.

More to the point though, what is this cheap and easy domain scoring system that does a better job than a blanket ban?

The best domain reputation provider, DomainTools, definitely isn't providing their data for cheap, nor is it always the fastest. We pay a substantial amount to them for thousands of requests a day, something we reserve for enriching actual security incidents, not because someone wants to go to catparty.foobar or whatever.

Unacceptable for who? It's definitely more than acceptable for a lot of people.

Sure, but blanket bans are even cheaper.

They really aren't when you are operating at ISP scale. Especially when there are 20+ years of evidence of said scoring systems being abused until they calcified into the mess that is modern email hosting

You say this as if the people implementing TLD blocks even understand what the term scoring system means

Would you consider .aero, .cat, .asia, .info novelties? They have been around for 20+ years. Sure, there are over 1500 gTLDs now, but when does something stop becoming a novelty? .ai a ccTLD, that Google recognizes as a gTLD, is that a novelty? These are a bit rhetorical.

I can't speak for the others, but registering a .aero domain requires submitting an application that's reviewed by a human and assessed based on the domain's relevancy to the aviation industry.

I would define them by the bar to entry. When a spammer can pick up thousands of domains for a few hundred bucks or less because a dodgy registrar is intentionally selling all domains on a specific TLD for next to nothing I find it safe to block anything on that TLD. I have always done this for email both personally and professionally and never once received any push-back. I explained the risk of collateral damage and leadership was always fine with it. Customers were B2B and could log in to open a ticket. Customer emails would come from domains we already trusted in their on-boarding process.

> In general though, if you want Fortune 500s to utilize your service/company, don't utilize a novelty TLD.

New potential technique to not have your open source project yoinked/resold by cloud providers? :)

I don't think that anyone claims that there aren't any legitimate sites on .garden, but the risk of using an abuse-prone TLD is that Bayesians are going to assign you an increased prior risk of abuse. Honestly the TLD is making more money from the abusers than from Plantura so they're not going to tighten up their ship, Plantura should probably move to a different TLD.

Reply on news.ycombinator.com