diff --git a/debian/control b/debian/control
index 6e059231a..4ce147fec 100644
--- a/debian/control
+++ b/debian/control
@@ -15,7 +15,7 @@ Depends: ${python3:Depends}, ${misc:Depends}
  , python3-miniupnpc, python3-dbus, python3-jinja2
  , python3-toml, python3-packaging, python3-publicsuffix2
  , python3-ldap, python3-zeroconf (>= 0.36), python3-lexicon,
- , python-is-python3
+ , python3-tldextract, python-is-python3
  , nginx, nginx-extras (>=1.18)
  , apt, apt-transport-https, apt-utils, dirmngr
  , openssh-server, iptables, fail2ban, bind9-dnsutils
diff --git a/src/diagnosers/12-dnsrecords.py b/src/diagnosers/12-dnsrecords.py
index 91fcf10fa..39e0ca17b 100644
--- a/src/diagnosers/12-dnsrecords.py
+++ b/src/diagnosers/12-dnsrecords.py
@@ -2,6 +2,7 @@
 
 import os
 import re
+import tldextract
 from typing import List
 from datetime import datetime, timedelta
 from publicsuffix2 import PublicSuffixList
@@ -68,7 +69,9 @@ class MyDiagnoser(Diagnoser):
             return
 
         base_dns_zone = _get_dns_zone_for_domain(domain)
-        basename = domain.replace(base_dns_zone, "").rstrip(".") or "@"
+        basename = tldextract.extract(domain).domain
+        if len(basename) == 0:
+            basename = "@"
 
         expected_configuration = _build_dns_conf(
             domain, include_empty_AAAA_if_no_ipv6=True