The registrable domain is the main domain a user should verify before trusting a site. It is the portion you can actually register, such as example.com, rather than a deeper subdomain like login.example.com or a lookalike such as example.co. Security tools often derive it from the public suffix list to separate a real site owner from hosted subdomains.
This matters because attackers often hide deception in subdomains, long URL paths, or browser UI tricks. A phishing page may use a convincing prefix, but the registrable domain reveals who controls the site. Defenders teach users to check this domain in the address bar, and security systems use it for allowlists, reputation checks, and alerting. When browser trust cues are spoofed, verifying the registrable domain becomes a critical second check.