Comment by clivedup

If, for example, you could trick a client into thinking "com" was not a public suffix, then from malicious.com you could set cookies on paypal.com

DNSSEC is not widely deployed, and so we cannot rely on the authenticity of DNS.

Maybe if we had DNSSEC, then we could rely on it for publicsuffix. Maybe lots of others things could be more easily solved if we had that too.

DNSSEC automation is coming, e.g. https://www.rfc-editor.org/info/rfc10026/. It might never become mainstream, but don't let anyone tell you that we couldn't benefit from having DNS authenticity!