Add gsites.ai and staging.gsites.ai (gotcha!)

[gotchamobi]

Public Suffix List (PSL) Submission

Checklist of required steps

• Description of Organization

• Robust Reason for PSL Inclusion

• DNS verification via dig

• Each domain listed in the PRIVATE section has and shall maintain at least two years remaining on registration, and we shall keep the _psl TXT record in place in the respective zone(s).

Submitter affirms the following:

• We are listing any third-party limits that we seek to work around in our rationale such as those between iOS 14.5+ and Facebook (see Issue #1245 as a well-documented example)

• This request was not submitted with the objective of working around other third-party limits.

• The submitter acknowledges that it is their responsibility to maintain the domains within their section. This includes removing names which are no longer used, retaining the _psl DNS entry, and responding to e-mails to the supplied address. Failure to maintain entries may result in removal of individual entries or the entire section.

• The Guidelines were carefully read and understood, and this request conforms to them.
• The submission follows the Guidelines on formatting and sorting.

• A role-based email address has been used and this inbox is actively monitored with a response time of no more than 30 days.

Abuse Contact:

• Abuse contact information (email or web form) is available and easily accessible.

  URL where abuse contact or abuse reporting form can be found:

https://gotchamobi.com/contact-us/

---

For PRIVATE section requests that are submitting entries for domains that match their organization website's primary domain, please understand that this can have impacts that may not match the desired outcome and take a long time to roll back, if at all.

To ensure that requested changes are entirely intentional, make sure that you read the affectation and propagation expectations, that you understand them, and confirm this understanding.

PR Rollbacks have lower priority, and the volunteers are unable to control when or if browsers or other parties using the PSL will refresh or update.

(Link: about propagation/expectations)

• Yes, I understand. I could break my organization's website cookies and cause other issues, and the rollback timing is acceptable. Proceed anyway.

---

Description of Organization

gotcha! is a small-business growth platform operated by Gotcha Mobile Solutions in Dallas, Texas. We build and operate software and managed services for small businesses — diagnostics, SEO, local listings, reviews and website production — and we host the resulting websites and applications on behalf of those customers.

This request concerns g!Sites, our website build-and-host product, and the hosting platform underneath it. A customer's site is built (increasingly with AI assistance) and then served by us from a subdomain of gsites.ai, with a matching preview environment beneath staging.gsites.ai. Customers may later attach their own domain, but the gsites.ai subdomain remains the origin the site is served from and the CNAME target their own domain points at.

I am the submitter, Christopher Jenkin, CEO of Gotcha Mobile Solutions, and I am responsible for this platform's infrastructure. The address on the entry is a monitored role account rather than a personal mailbox.

Organization Website:

https://gotchamobi.com

Reason for PSL Inclusion

The reason is cookie scoping between mutually untrusting tenants. Each subdomain of gsites.ai is allocated to a different customer, and the content served there is under that customer's control. Without a public suffix boundary, any one customer's site can set a cookie scoped to .gsites.ai, and browsers will then attach that cookie to requests for every other customer's site. That is a cross-tenant cookie injection and session fixation exposure which cannot be mitigated server side, because the scoping decision is made in the user agent rather than by us.

staging.gsites.ai is listed as a second entry rather than relying on gsites.ai alone. Preview environments are allocated per customer directly beneath it, so listing only gsites.ai would make staging.gsites.ai an ordinary registrable domain and leave every customer's preview sharing a single cookie origin — the same defect, relocated.

Neither gsites.ai nor staging.gsites.ai serves a cookie-bearing application of our own, and we do not intend to run one there. Our own authenticated products are served from a different domain, so listing these names does not put our corporate or product logins at risk. We have read the guidance on derivative propagation and accept that rollback is slow and not guaranteed.

This is not an attempt to obtain relief from any third-party rate limit or platform restriction. We have no outstanding request with Let's Encrypt, Cloudflare or any other party, and certificate issuance for these names is per hostname rather than wildcard.

Both names hold registration well beyond two years (gsites.ai is registered through 2029-05-08) and we will maintain more than one year of term in order to remain listed, along with the _psl records.

Number of THOUSANDS of distinct users this request is being made to serve:

0 thousand at present. That is an actual count rather than an estimate, and we would rather state it plainly than project a number.

g!Sites is pre-launch with a public waitlist (visible at https://gotchamobi.com) and the hosting platform is in active development, with the DNS and serving infrastructure already in place. Our existing client base for adjacent managed services numbers in the hundreds, and those customers are the initial migration path onto this platform.

We recognise the guidelines describe a 2,000–3,000 distinct-user threshold and that we are below it today. We are submitting now because the cookie boundary is an architectural property that is far cheaper to establish before customer sites exist than to retrofit afterwards, and because propagation to browsers takes months. If the maintainers would prefer to defer until we can demonstrate the user count, we entirely understand — say so and we will close this and resubmit then, rather than consume review time now.

DNS Verification

dig +short TXT _psl.gsites.ai
"https://github.com/publicsuffix/list/pull/3139"

dig +short TXT _psl.staging.gsites.ai
"https://github.com/publicsuffix/list/pull/3139"

Both records are live on the authoritative nameservers (ns75/ns76.domaincontrol.com) and resolve through public resolvers. They will remain in place for as long as inclusion is desired.

[gotchamobi]

DNS validation is now in place and resolving publicly:

_psl.gsites.ai.          TXT  "https://github.com/publicsuffix/list/pull/3139"
_psl.staging.gsites.ai.  TXT  "https://github.com/publicsuffix/list/pull/3139"

Both records are live on the authoritative nameservers (ns75/ns76.domaincontrol.com) and resolve through public resolvers. They will be left in place permanently.

The domain is registered through 2029-05-08.

[gotchamobi]

Withdrawing this for now — on a closer read of the template and guidelines, we do not yet meet the eligibility bar. The platform is pre-launch and does not serve the minimum distinct-user threshold, and we still need to put a role-based contact address and a public abuse-reporting URL in place.

Apologies for the noise. We will resubmit with a complete template once those are genuinely satisfied.

[pencilnav]

Your entry is ineligible for an inclusion per our Guidelines and requirements. Please close this PR.

Also, #2612 and completely AI generated + automated.

@gotchamobi