diff --git a/iana/iana.go b/iana/iana.go
index 8e138e1db09..19fa5526c23 100644
--- a/iana/iana.go
+++ b/iana/iana.go
@@ -2,19 +2,26 @@ package iana
 
 import (
 	"fmt"
+	"time"
 
 	"github.com/weppos/publicsuffix-go/publicsuffix"
+	zlintutil "github.com/zmap/zlint/v3/util"
 )
 
 // ExtractSuffix returns the public suffix of the domain using only the "ICANN"
 // section of the Public Suffix List database.
 // If the domain does not end in a suffix that belongs to an IANA-assigned
 // domain, ExtractSuffix returns an error.
+// It confirms with zlint's TLD list.
 func ExtractSuffix(name string) (string, error) {
 	if name == "" {
 		return "", fmt.Errorf("Blank name argument passed to ExtractSuffix")
 	}
 
+	if !zlintutil.HasValidTLD(name, time.Now()) {
+		return "", fmt.Errorf("%s has an unknown TLD", name)
+	}
+
 	rule := publicsuffix.DefaultList.Find(name, &publicsuffix.FindOptions{IgnorePrivate: true, DefaultRule: nil})
 	if rule == nil {
 		return "", fmt.Errorf("Domain %s has no IANA TLD", name)
diff --git a/iana/iana_test.go b/iana/iana_test.go
index 214952abc5b..7715babfd6a 100644
--- a/iana/iana_test.go
+++ b/iana/iana_test.go
@@ -40,7 +40,7 @@ func TestExtractSuffix_Valid(t *testing.T) {
 	for _, tc := range testCases {
 		got, err := ExtractSuffix(tc.domain)
 		if err != nil {
-			t.Errorf("%q: returned error", tc.domain)
+			t.Errorf("%q: returned error: %v", tc.domain, err)
 			continue
 		}
 		if got != tc.want {