Live data from Hacker News

The danger of the trailing dot in the domain name

saynt2day.blogspot.ru

21–30 of 75 posts

Re: The danger of the trailing dot in the domain name

#21
post #19

http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/web... > [The trailing dot in the domain name is] there for a reason. It made the domain name a fully qualified one, and thus unambiguous and not prone to search path spoofing. [snip] > For example: Posit that the web browser uses the BIND DNS Client library and the search example.net directive is present in that library's resolv.conf configuration file. > In t…

The search path spoofing argument is weak. If you depend on a DNS resolver that spoofs domain searches, what guaranteed that it wouldn't simply spoof the full resolution as well ?

In practice nobody uses the dot at the end except when writing BIND files.

Re: The danger of the trailing dot in the domain name

#22

Why is this something that people do?

Why, is this something that people do?

no, I read it as a solution to a problem that doesn't occur. It's way worse if somebody would type a comma or any other letter at the end of the domain name, as I just learned, the dot is the best character to mistake at the end of a domain

Re: The danger of the trailing dot in the domain name

#24
post #10

The fact that the two IIS based sites (Microsoft, Stack overflow) both fail with an outright error 400 complaining about a bad host name makes me wonder whether this might actually be a bug in IIS to overzealously validate the hostname. The trailing dot is totally valid and there's no need to complain.

Stack overflow uses IIS??

Re: The danger of the trailing dot in the domain name

#25
post #22

Why is this something that people do?

Why, is this something that people do? no, I read it as a solution to a problem that doesn't occur. It's way worse if somebody would type a comma or any other letter at the end of the domain name, as I just learned, the dot is the best character to mistake at the end of a domain

[deleted]

Re: The danger of the trailing dot in the domain name

#26
post #10

The fact that the two IIS based sites (Microsoft, Stack overflow) both fail with an outright error 400 complaining about a bad host name makes me wonder whether this might actually be a bug in IIS to overzealously validate the hostname. The trailing dot is totally valid and there's no need to complain.

The 400 error is just the web server complaining that there is no web site to deliver to you for that hostname. It isn't complaining about the hostname being invalid, per se.

I thought so too, but then I made a little experiment:

    pilif@shion:~$ curl -I -H "Host: example.com"  http://198.252.206.16/
    HTTP/1.1 404 Not Found
    Content-Length: 4129
    Date: Sat, 16 Mar 2013 12:28:22 GMT

vs.

    pilif@shion:~$ curl -I -H "Host: example.com." http://198.252.206.16/
    HTTP/1.1 400 Bad Request
    Content-Length: 334
    Content-Type: text/html; charset=us-ascii
    Date: Sat, 16 Mar 2013 12:28:56 GMT
The IP is the one from stackoverflow.com. When querying for a host they are not configured (try any), you will get a 404 plus an explanation page that the selected Q&A community doesn't exist.

When you try the same host with a trailing dot, you get a generic IIS error 400.

This is too much of a coincidence and I value it as a strong sign that my hypothesis might be correct. I have no IIS at my disposal to replicate paulbeattie's experiment, but the outcome he described further helps confirming my suspicion (no matter the downvotes he got)

Same experiment works with microsoft.com too:

    pilif@shion:~$ curl -I -H "Host: example.com." http://65.55.57.27/
    HTTP/1.1 400 Bad Request
    Content-Length: 334
    Content-Type: text/html; charset=us-ascii
    Server: Microsoft-HTTPAPI/2.0
    Date: Sat, 16 Mar 2013 12:35:10 GMT
    Connection: close

    pilif@shion:~$ curl -I -H "Host: example.com" http://65.55.57.27/
    HTTP/1.1 200 OK
    Cache-Control: private
    Content-Length: 0
    Server: Microsoft-IIS/8.0
    (snip)

Re: The danger of the trailing dot in the domain name

#27
post #10

The fact that the two IIS based sites (Microsoft, Stack overflow) both fail with an outright error 400 complaining about a bad host name makes me wonder whether this might actually be a bug in IIS to overzealously validate the hostname. The trailing dot is totally valid and there's no need to complain.

Stack overflow uses IIS??

Yes, I believe it was built using the .NET framework.

Re: The danger of the trailing dot in the domain name

#28
post #10

The fact that the two IIS based sites (Microsoft, Stack overflow) both fail with an outright error 400 complaining about a bad host name makes me wonder whether this might actually be a bug in IIS to overzealously validate the hostname. The trailing dot is totally valid and there's no need to complain.

Stack overflow uses IIS??

Yes, I believe it was built using the .NET framework.

Re: The danger of the trailing dot in the domain name

#29
post #10

The fact that the two IIS based sites (Microsoft, Stack overflow) both fail with an outright error 400 complaining about a bad host name makes me wonder whether this might actually be a bug in IIS to overzealously validate the hostname. The trailing dot is totally valid and there's no need to complain.

Stack overflow uses IIS??

Yes, I believe it was built using the .NET framework.

Re: The danger of the trailing dot in the domain name

#30
post #10

The fact that the two IIS based sites (Microsoft, Stack overflow) both fail with an outright error 400 complaining about a bad host name makes me wonder whether this might actually be a bug in IIS to overzealously validate the hostname. The trailing dot is totally valid and there's no need to complain.

Stack overflow uses IIS??

Yes, I believe it was built using the .NET framework.
Post reply on HN