Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What domain name to use for your home network

ctrl.blog

Post reply on HN
Print view View original

141–150 of 174 posts

Re: What domain name to use for your home network

#141

Post by willis936 »

Spivak wrote: post #138
willis936 wrote: post #130

Earlier quoted context omitted.

If you run your own router: yes up to a certain point. https://www.myhelpfulguides.com/2018/07/30/redirect-hard-cod... Afaik nobody has a fix for the client hostility that DoH brings to the table.

I think the fact that I can slurp, block, and/or modify all the unencrypted DNS requests of every device on my network to be the hostile thing. Yes we have all abused unencrypted DNS to take the littlest bit of control back from hostile devices but we’re the minority of a minority who lose out in this situation where everyone else is now shielded from random sketchy Wi-Fi hotspots, and their ISP.

I think not giving the option to configure DNS servers or outright ignoring configured DNS servers to be incredibly hostile. Redirecting unencrypted DNS traffic is a defensive escalation. Putting your arms up as a fist comes at your face is not a hostile action.

Re: What domain name to use for your home network

#142

Post by Fiahil »

jeroenhd wrote: post #44

Honestly, just spend the five bucks a year and reserve a real domain name with auto renew. You don't need to make it publicly resolvable, but you'll be 100% sure all of your internal service names won't ever conflict with anything used in the real world. If you pick the right registrar, you can easily get your hands on a wildcard DNS cert as well through Let's Encrypt, so you can protect your internal services with H…

> If you pick the right registrar, you can easily get your hands on a wildcard DNS cert as well through Let's Encrypt.

I, sadly, went for Namecheap, and they don't integrate with let's encrypt :(

I know I could use the http challenge solver, but I would have to expose a publicly-available endpoint and I would prefer to avoid that !

Re: What domain name to use for your home network

#143

Post by treesknees »

Fiahil wrote: post #142
jeroenhd wrote: post #44

Honestly, just spend the five bucks a year and reserve a real domain name with auto renew. You don't need to make it publicly resolvable, but you'll be 100% sure all of your internal service names won't ever conflict with anything used in the real world. If you pick the right registrar, you can easily get your hands on a wildcard DNS cert as well through Let's Encrypt, so you can protect your internal services with H…

> If you pick the right registrar, you can easily get your hands on a wildcard DNS cert as well through Let's Encrypt. I, sadly, went for Namecheap, and they don't integrate with let's encrypt :( I know I could use the http challenge solver, but I would have to expose a publicly-available endpoint and I would prefer to avoid that !

You can change your DNS provider without changing the registrar.

Re: What domain name to use for your home network

#144

Post by d2wa »

mattowen_uk wrote: post #122
d2wa wrote: post #55

Earlier quoted context omitted.

Read the article. Don’t use .local (except for mDNS.)

> Don’t use .local (except for mDNS.) Going forward, I agree. However for many years, the recommendation from large providers (including Microsoft) WAS to use .local I've got .local as my internal network. For some people, it's not a trivial job to re-domain everything.

Microsoft had .corp as a placeholder for years, intending admins to input their own domains. (Which many promptly never did.) However, I'm not aware of them ever recommending or using .local for anything.

Re: What domain name to use for your home network

#146

Post by crmrc114 »

Just tossing this out there- apple only claimed .local in rfc as of 2013. There are plenty of 'legacy' production environments that I support that still use .local without issue with mac clients. Its possible there would be a collision- but in practice the pain point is not enough concern for many with the limited subset of apple devices on their corporate networks.

Still pissed that apple was straight up allowed to usurp that tld instead of something like .mdns.local or .autoconf

Also, please dont use .com/net/org for local networks. All you are going to do is punish yourself when you go to setup you AD domain. However if you want to setup a subdomain that you are willing to make the AD server authoritative for you may end up with less pain. If you have to use your own domain keep in mind that if you go to setup AD in your home/lab/small biz you will need to add records for your webserver/mailserver etc since AD will want to be the authoritative dns server for its domain. There are ways around this, but I digress. Using a public tld can cause pain, just be aware of that.

Re: What domain name to use for your home network

#147

Post by Wowfunhappy »

minimaul wrote: post #35
minimaul wrote: post #21

Earlier quoted context omitted.

For what it's worth, this does work. For now. The main issue is if it gets sold later, or assigned by RFC. As an example, more than one company I've worked for used .dev as a TLD for their dev environments, with local DNS to override it. Once google bought .dev, this meant that: - we couldn't access anything Google put on .dev - suddenly, all of our test sites had HTTPS forced, because .dev was HSTS preloaded by Goog…

And as an extra point - can you actually guarantee that all your DNS lookups hit your DNS server first? That's harder than it sounds, with more and more apps implementing their own DNS over HTTPS clients - Firefox does it for instance, so does Chrome.

Honestly, my initial reaction to that is "well, this is a great example why I don't like Firefox's DNS-over-HTTPS thing." Firefox should follow the OS's DNS settings, not make assumptions about how I run my network.

But a great counterargument would be "too bad, Firefox and now Google are doing it anyway, you lost and this is the world we live in, so deal with it." And, you'd have a point!

Re: What domain name to use for your home network

#148

Post by atsmyles »

I use .lan and will continue to do so. .home.arpa is fine for 1 lan, but if you want to connect to multiple lans, it no longer works well. Add to the fact the amount of typing. .lan should be reserved so that people can use it for addressing multiple local area networks. We already have .local for mDNS which is perfect for the single lan setup. If they won't do it de jure, then users like myself will make this standard de facto.

Re: What domain name to use for your home network

#149

Post by traceroute66 »

zamadatix wrote: post #32
traceroute66 wrote: post #6

The blog post misses the (controversial if you're one of the ex-applicants) decision by ICANN to ban .corp, .home and .mail from ever appearing on the internet. So you've got those options too. Or in ICANN management-speak: "Whereas, the Board considered that the applicants were not aware before the application window that the strings .CORP, .HOME, and .MAIL would be identified as high-risk, and that the delegations…

"to be not assigned" is generally less safe than "assigned for local use". E.g. 1.1.1.0/24 was first held back too see if bogus traffic would decreased then a ssigned for research purposes then assigned for cloudflare DNS causing a lot of grief for corporate networks that used 1.1.1.1 or 1.1.1.2 for network clustering or portal gateways instead of ones explicitly assigned for internal use.

>"to be not assigned" is generally less safe than "assigned for local use"

Normally I would agree. But in this case, 5 years (2018-2013), a $185,000 refund, high-profile media coverage and an explicit "deferred indefinitely" statement later ? I don't think any of us will see .CORP, .HOME and .MAIL on the internet in our lifetimes !

Post reply on HN