Implementation ticket for CSHARP-6077 / DRIVERS-3329.

Adds the srvAllowedHostsSuffix URI option, which replaces the {{

}} inferred from an SRV hostname when validating returned host names, together with the Public Suffix List guardrail that bounds how broad the configured suffix may be.

Specs:

• Initial DNS Seedlist Discovery — the option; changes still in flight in specifications#1950
• Public Suffix List — merged (DRIVERS-3568, no separate language ticket, so it lands here)

Scope

Public Suffix List

Vendor public_suffix_list.dat as an embedded resource and hand-roll the matcher. Do not take Nager.PublicSuffix: it is consumable on net472 via netstandard2.0, but it requires Microsoft.Extensions.Logging.Abstractions >= 10.0.3 and Microsoft.Extensions.Configuration.Abstractions >= 10.0.3, against the driver's current Logging.Abstractions 2.0.0 pin. Forcing that floor on consumers is not worth ~150 lines of matcher.

The file is 139 KB / 10,239 rules — 281 wildcard, 8 exception, 459 Unicode rules and no xn-- at all, so the spec's "convert one side before comparing" requirement is real work. Convert those rules to A-label at load so the matcher operates entirely in A-label space. Rules are at most 7 labels, which bounds the suffix walk. Load lazily so an ordinary MongoClient never parses the list.

Note there is no EmbeddedResource anywhere in src/ today — this is the first.

Option plumbing

Parse and validate in ConnectionString, including rejecting the option on a non-SRV scheme (mirroring the existing srvServiceName check). Apply the normalization steps in spec order: strip leading and trailing dots, convert to A-label, ASCII-lowercase, reject if the result is a public suffix, prepend a dot. Reject a value that is empty after stripping.

Surface on MongoUrl, MongoUrlBuilder (including ToString round-trip), MongoClientSettings, and ClusterSettings. ClusterKey must include it — otherwise two clients differing only by suffix would share a cluster.

Validation

ConnectionString.HasValidParentDomain takes the anchor as a parameter, and skips the "fewer than three parts implies one more domain level" branch when a suffix is configured. It already derives .domainname with the leading dot included, so the spec's mandated leading dot fits the existing shape.

SRV polling

DnsMonitor.lookupDomainName currently serves two roles that the spec explicitly separates: it builds the query name ({{

._tcp.}} + it), which the suffix MUST NOT affect, and it is the validation anchor, which the suffix MUST replace. Split it in two. This is the only change touching live SDAM behavior — consider landing it as a separate PR if the overall diff gets large.

Tests

• srvAllowedHostsSuffix-* JSON tests ride the existing InitialDnsSeedlistDiscoveryTestRunner
• The five PSL prose tests go in a new tests/MongoDB.Driver.Tests/Specifications/public-suffix-list/, mirroring the spec layout (initial-dns-seedlist-discovery/prose-tests/SrvPartsTests.cs is the local precedent)

Notes

• All new public surface is additive, so a minor version bump. The one thing to check against the API-stability rules is whether the new ClusterSettings constructor parameter is binary-breaking.
• IdnMapping.GetAscii throws on a value with a leading dot (empty label). The spec's step 1 strips leading and trailing dots before the Punycode step, so following the order is safe — don't re-add the dot before conversion.
• specifications#1950 is not merged yet, so the normative text may still shift.
• CSHARP-6213 is a pre-existing, related bug in the same polling code path; it is not part of this work.