Which SaaS Subdomains to block - saas

Question

I'm working on a SaaS (Software as a Service) web app and I'm using subdomains for separate accounts.
Which subdomains should I prevent the user from using.
The ones I currently have are... admin, administrator, blog, support and help. I remember seeing a question on Quora about it but I can't find it any more.

Answer 1

Thanks for your suggestions. I've made a Rubygem for blocking a load of subdomains which can be found here - https://github.com/deanperry/saas_deny_subdomains
Just add deny_subdomains :subdomain (:subdomain) being the field, and it will block/deny a massive list of subdomains.

Answer 2

Here is my version in PHP. I added some of mine + ones suggested in the thread + dean perry's.
I was able to cover lots of scenarios by using some regex.
/**
* Checks if the subdomain is good. e.g. forbidden names are: ssl, secure, test, tester etc.
* #see http://stackoverflow.com/questions/11868191/which-saas-subdomains-to-block
* #see https://github.com/deanperry/saas_deny_subdomains/blob/master/lib/saas_deny_subdomains/subdomains.rb
* #return boolean
*/
public function isSubdomainAvailable($subdomain) {
$banned_subdomains_csv = 'admin, login, administrator, blog, dashboard, admindashboard, images?, img, files?, videos?, help, support, cname, test, cache, mystore, biz, investors?
api\d*, js, static, s\d*,ftp, e?mail,webmail, webdisk, ns\d*, register, join, registration, pop\d?, beta\d*, stage, deploy, deployment,staging, testers?, https?, donate, payments, smtp,
ad, admanager, ads, adsense, adwords?, about, abuse, affiliate, affiliates, store, shop, clients?, code, community, forum?, discussions?, order, buy, cpanel, store, payment,
whm, dev, devel, developers?, development, docs?, whois, signup, gettingstarted, home, invoice, invoices, ios, ipad, iphone, logs?, my, status, networks?,
new, newsite, news, partner, partners, partnerpage, popular, wiki, redirect, random, public, resolver, sandbox, search, servers?, service,uploads?, validation,
signin, signup, sitemap, sitenews, sites, sms, sorry, ssl, staging,features, stats?, statistics?, graphs?, surveys?, talk, trac, git, svn, translate, validations, webmaster,
www\d*, feeds?, rss, asset[s\d]*, cp\d*, control panel, online, media, jobs?, secure, demo, i\d*, img\d*, css\d*, js\d*';
$regex = $banned_subdomains_csv;
$regex = preg_replace('#\s#si', '', $regex); // rm new lines, spaces etc
$regex = preg_replace("#,+#si", '|', $regex); // more than one comma
$regex = trim($regex, ','); // remove any leading/trailing commas
$regex = '#^(?:' . $regex . ')$#si'; // let's create a nice regex.
$status = !preg_match($regex, $subdomain); // without main domain added
return $status;
}
Slavi
http://orbisius.com

Answer 3

To name a view:
www
help
support
admin
api
assets0-x

Answer 4

In addition to those mentioned:
test
stage/staging
dev/development
status
mail
webmail
ftp
feeds
ssl/secure
demo
git/svn
files/docs
Might also want to reserve your own name and any variations.
Edit: Just a thought, and perhaps over the top, but you could also consider reserving something like i.example.com ("i" being for internal) then you've got a whole namespace of *.i.example.com for internal use.

Answer 5

Another way of approaching this would be app-tenant.domain.com where tenant is your customer's username or company. Which means you can willcard your users with something like app-*.domain.com in your DNS settings. But if you use an application level load balancer that should be easier. This looks prettier IMHO.
Note: app.**.domain.com is not valid AFAIK