PYTHON-5814 Configurable DNS domain validation for SRV records by sleepyStick · Pull Request #2868 · mongodb/mongo-python-driver

sleepyStick · 2026-06-11T20:55:38Z

PYTHON-5814

Changes in this PR

add srvAllowedHostsSuffix param

Test Plan

Checklist

Checklist for Author

Did you update the changelog (if necessary)?
Is there test coverage?
Is any followup work tracked in a JIRA ticket? If so, add link(s).

Checklist for Reviewer

Does the title of the PR reference a JIRA Ticket?
Do you fully understand the implementation? (Would you be comfortable explaining how this code works to someone else?)
Is all relevant documentation (README or docstring) updated?

codecov-commenter · 2026-06-11T21:21:12Z

Codecov Report

❌ Patch coverage is 83.14607% with 15 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pymongo/synchronous/srv_resolver.py	50.00%	5 Missing and 2 partials ⚠️
pymongo/_psl.py	93.54%	1 Missing and 1 partial ⚠️
pymongo/asynchronous/mongo_client.py	75.00%	0 Missing and 2 partials ⚠️
pymongo/asynchronous/srv_resolver.py	85.71%	2 Missing ⚠️
pymongo/synchronous/mongo_client.py	75.00%	0 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!

…was only here for the initial delivery of the project, removing now

…run a resync

…ver into PYTHON-5814

NoahStapp

Looks good, just some documentation/clarity questions!

NoahStapp · 2026-08-27T18:09:44Z

    srv|SRV|initial-dns-seedlist-discovery|srv_seedlist)
      cpjson initial-dns-seedlist-discovery/tests/ srv_seedlist
+      # srvAllowedHostsSuffix validation uses the bundled Public Suffix List.
+      cp_psl


So this will resync every time there is a change to the Public Suffix List?

it syncs from the spec's copy of the PSL -- which is automatically updated once a month but could be manually triggered (in the specs repo)

(the actual PSL has like an avg of 3 changes per week which is far too much noise to always keep up to date)

And our automated weekly sync will pick up that monthly change in the spec repo?

NoahStapp · 2026-08-27T18:10:26Z


 PyMongo 4.18 brings a number of changes including:

+- Added the ``srvAllowedHostsSuffix`` URI option and :class:`~pymongo.mongo_client.MongoClient`


We also need an AsyncMongoClient reference here and below.

NoahStapp · 2026-08-27T18:11:07Z

+  keyword argument. When connecting via ``mongodb+srv://``, this option overrides the default
+  requirement that SRV-returned hosts share the same parent domain as the seed hostname,
+  allowing hosts under a different domain suffix to be accepted. The suffix must not be a
+  public suffix (per the Public Suffix List). See the


Should the Public Suffix List be linked here?

lol that'd be a nice thing to do, wouldn't it! (I initially was like ppl can look it up if they need it, they know what to google now LOLOL) done!

NoahStapp · 2026-08-27T18:11:55Z

+  requirement that SRV-returned hosts share the same parent domain as the seed hostname,
+  allowing hosts under a different domain suffix to be accepted. The suffix must not be a
+  public suffix (per the Public Suffix List). See the
+  :class:`~pymongo.mongo_client.MongoClient` documentation for security considerations.


Is there a blog post or non-API doc link we can add here for an example?

not at the moment, will reach out to docs team about this!

NoahStapp · 2026-08-27T18:17:33Z

+    if domain in suffixes:
+        return True
+    parts = domain.split(".")
+    return len(parts) == 1 or (len(parts) > 1 and ".".join(parts[1:]) in wildcards)


Can you add a short comment explaining this line? I'm not following how this results in a suffix being public or not.

i assume "this line" is the return line, and if so, done! lmk if the comment isn't clear tho

Copilot

Pull request overview

This PR adds a new SRV-only configuration option, srvAllowedHostsSuffix, to make DNS domain validation for mongodb+srv:// connections configurable while still preventing overly-broad suffixes via Public Suffix List (PSL) checks.

Changes:

Adds srvAllowedHostsSuffix to URI parsing and to the (Async)MongoClient keyword/URI option plumbing through to SRV resolution.
Introduces a bundled PSL parser (pymongo/_psl.py) and uses it to reject srvAllowedHostsSuffix values that are public suffixes.
Adds SRV seedlist spec test fixtures and a connection-string invalid-URI case covering SRV-only enforcement.

Reviewed changes

Copilot reviewed 30 out of 31 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/test_dns.py	Adds PSL parsing unit tests (sync suite).
test/asynchronous/test_dns.py	Adds PSL parsing unit tests (async suite).
test/srv_seedlist/replica-set/srvAllowedHostsSuffix-without_dot_pass.json	SRV seedlist fixture validating suffix matching without a leading dot.
test/srv_seedlist/replica-set/srvAllowedHostsSuffix-without_dot_fail.json	SRV seedlist fixture validating mismatch failure without a leading dot.
test/srv_seedlist/replica-set/srvAllowedHostsSuffix-with_dot.json	SRV seedlist fixture validating suffix matching with a leading dot.
test/srv_seedlist/replica-set/srvAllowedHostsSuffix-trailing-dot.json	SRV seedlist fixture validating suffix normalization with trailing dot.
test/srv_seedlist/replica-set/srvAllowedHostsSuffix-tld-only.json	SRV seedlist fixture rejecting TLD-only suffix.
test/srv_seedlist/replica-set/srvAllowedHostsSuffix-psl-public-suffix.json	SRV seedlist fixture rejecting a PSL public suffix.
test/srv_seedlist/replica-set/srvAllowedHostsSuffix-psl-public-suffix-capitalized.json	SRV seedlist fixture rejecting a capitalized PSL public suffix.
test/srv_seedlist/replica-set/srvAllowedHostsSuffix-psl-not-public-suffix.json	SRV seedlist fixture accepting a non-public suffix.
test/srv_seedlist/replica-set/srvAllowedHostsSuffix-period-only.json	SRV seedlist fixture rejecting a period-only suffix.
test/srv_seedlist/replica-set/srvAllowedHostsSuffix-mismatch.json	SRV seedlist fixture rejecting a suffix that doesn’t match returned hosts.
test/srv_seedlist/replica-set/srvAllowedHostsSuffix-case-insensitive.json	SRV seedlist fixture validating case-insensitive suffix matching.
test/connection_string/test/invalid-uris.json	Adds invalid case for `srvAllowedHostsSuffix` used with non-SRV URIs.
pymongo/uri_parser_shared.py	Allows the new option in URI option validation and enforces SRV-only usage.
pymongo/common.py	Adds option validator entry for `srvallowedhostssuffix`.
pymongo/asynchronous/uri_parser.py	Plumbs `srvAllowedHostsSuffix` into async SRV parsing and resolver construction.
pymongo/asynchronous/srv_resolver.py	Implements suffix-based SRV host validation + PSL restriction (async).
pymongo/asynchronous/settings.py	Stores/exposes `srv_allowed_hosts_suffix` in async topology settings.
pymongo/asynchronous/monitor.py	Passes `srv_allowed_hosts_suffix` into SRV resolution in the async monitor.
pymongo/asynchronous/mongo_client.py	Adds keyword/docs + wires option into TopologySettings construction (async).
pymongo/synchronous/uri_parser.py	Plumbs `srvAllowedHostsSuffix` into sync SRV parsing and resolver construction.
pymongo/synchronous/srv_resolver.py	Implements suffix-based SRV host validation + PSL restriction (sync).
pymongo/synchronous/settings.py	Stores/exposes `srv_allowed_hosts_suffix` in sync topology settings.
pymongo/synchronous/monitor.py	Passes `srv_allowed_hosts_suffix` into SRV resolution in the sync monitor.
pymongo/synchronous/mongo_client.py	Adds keyword/docs + wires option into TopologySettings construction (sync).
pymongo/_psl.py	Adds PSL loading/parsing utility used to validate `srvAllowedHostsSuffix`.
doc/changelog.rst	Documents the new option and its security implications.
.pre-commit-config.yaml	Excludes the PSL data file from codespell.
.evergreen/resync-specs.sh	Adds logic to pull PSL data from the specs repo during resync.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

sleepyStick · 2026-08-27T19:20:14Z

+    return suffixes, wildcards, exceptions
+
+
+def is_public_suffix(domain: str) -> bool:
+    """Return True if domain is a public suffix per the bundled Public Suffix List."""
+    global _PUBLIC_SUFFIXES  # noqa: PLW0603
+    if _PUBLIC_SUFFIXES is None:
+        _PUBLIC_SUFFIXES = _load_public_suffixes()
+    suffixes, wildcards, exceptions = _PUBLIC_SUFFIXES


on the other hand, it feels silly to load the list if the user might not use the list,,?
idk i can be convinced either way,, no strong opinions on this,,

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

NoahStapp

LGTM!

sleepyStick and others added 2 commits June 11, 2026 13:53

add srvAllowedHostsSuffix option to srv uri

2cd02da

Merge branch 'master' into PYTHON-5814

499a3ec

sleepyStick mentioned this pull request Jun 11, 2026

DRIVERS-3329: Configurable DNS domain validation for SRV records mongodb/specifications#1950

Open

4 tasks

sleepyStick and others added 7 commits June 16, 2026 10:24

sync unified tests

3423d39

Merge branch 'master' into PYTHON-5814

3e30434

add unified test (forgot to commit this previously oops)

1ac4967

Merge branch 'master' into PYTHON-5814

a8a3b4e

Merge branch 'master' into PYTHON-5814

9663485

Merge branch 'master' into PYTHON-5814

a71dd7a

add more tests and edit docstring

4a6ba01

sleepyStick mentioned this pull request Jun 29, 2026

PYTHON-5814 Configurable DNS domain validation for SRV records #2903

Merged

6 tasks

sleepyStick and others added 14 commits June 29, 2026 16:05

edit changelog

466a47e

cache public suffix list after first load

7902127

add example to docstring

c8f8c9f

Merge branch 'main' into PYTHON-5814

2c8ad29

add psl tests

14ae604

remove two label minimum

1fc7fe2

add test

fa34923

Merge branch 'main' into PYTHON-5814

aaad72f

lower the srv response

a2c5cbd

replaced this test with a different one in the spec repo -- this one …

071a285

…was only here for the initial delivery of the project, removing now

add psl to resync spec script so it can be synced regularly and sync …

63d57ca

…run a resync

Merge branch 'main' into PYTHON-5814

7c4e57a

update changelog

ae72df1

Merge branch 'PYTHON-5814' of github.com:sleepyStick/mongo-python-dri…

c950d35

…ver into PYTHON-5814

sleepyStick marked this pull request as ready for review August 27, 2026 17:31

sleepyStick requested a review from a team as a code owner August 27, 2026 17:31

sleepyStick requested a lite review from Copilot and removed request for Copilot August 27, 2026 17:31

sleepyStick requested a review from NoahStapp August 27, 2026 17:31

NoahStapp requested changes Aug 27, 2026

View reviewed changes

NS feedback

8f58480

Copilot AI lite review requested due to automatic review settings August 27, 2026 19:06

Copilot started reviewing on behalf of sleepyStick August 27, 2026 19:07 View session

Merge branch 'main' into PYTHON-5814

820c648

sleepyStick requested a review from NoahStapp August 27, 2026 19:09

Copilot AI reviewed Aug 27, 2026

View reviewed changes

sort the list alphabetically

d99b4e9

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

NoahStapp approved these changes Aug 27, 2026

View reviewed changes


		PyMongo 4.18 brings a number of changes including:

		- Added the ``srvAllowedHostsSuffix`` URI option and :class:`~pymongo.mongo_client.MongoClient`

Uh oh!

Conversation

sleepyStick commented Jun 11, 2026

Changes in this PR

Test Plan

Checklist

Checklist for Author

Checklist for Reviewer

Uh oh!

codecov-commenter commented Jun 11, 2026 • edited by codecov Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

NoahStapp left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

sleepyStick Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

NoahStapp left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov-commenter commented Jun 11, 2026 •

edited by codecov Bot

Loading

sleepyStick Aug 27, 2026 •

edited

Loading