There are some interesting addresses that explore that property of Full Qualified Domain Names. For instance, try this on your browser:
It would be curious if ICANN would define "The Internet entry address" as the root address of DNS:
The danger of the trailing dot in the domain name
41–50 of 75 posts
Re: The danger of the trailing dot in the domain name
#42Where have we got to the point where a relative hostname is accepted by 100% of websites yet an absolute hostname isn't? Surely it should be the other way round, this is a ridiculous state of affairs!
Up voted, because "forward example.com. to example.com" is exactly backwards. Think about what happens to the user who doesn't have 'example.com' (the relative hostname) resolve to the same address as 'example.com.' (the absolute hostname). Now they want to get to 'example.com.', they type 'example.com.' and they get forwarded to 'example.com', which resolves to example.com.localdomain.com according to their local DNS server. Oops.
Re: The danger of the trailing dot in the domain name
#43You can cd to /home/user or /home/user/ as well. The dot's in DNS are equivalent to the slashes in your Unix file system. / is root . is root I'm shocked that many people on HN don't seem to understand this.
My shock is that some webservers don't remove an ending dot before trying to match a virtual host (any besides IIS?), and that web browsers don't assume equivalence, for website SSL cert CN purposes, between "fqdn." and "fqdn".
I'm also shocked that chrome and firefox send a relative domain in Host: headers if that's what's typed into the url bar. Why wouldn't they send the fqdn? Is it specified this way in some RFC? What does this browser "feature" do other than require webservers in orgs with corpdomain.com search paths to add additional vhost aliases to ensure all the requests get to the right place? Switching vhosts to an intranet website based on the request's Host header does not provide any security in an intranet/dns-search-path setup.
Re: The danger of the trailing dot in the domain name
#44Where have we got to the point where a relative hostname is accepted by 100% of websites yet an absolute hostname isn't? Surely it should be the other way round, this is a ridiculous state of affairs!
Up voted, because "forward example.com. to example.com" is exactly backwards. Think about what happens to the user who doesn't have 'example.com' (the relative hostname) resolve to the same address as 'example.com.' (the absolute hostname). Now they want to get to 'example.com.', they type 'example.com.' and they get forwarded to 'example.com', which resolves to example.com.localdomain.com according to their local DN…
It's like having everything rely on directories called "com" and "net", but when someone uses the correct, absolute path of "/com" or "/net" it somehow stops working. Nobody would stand for the latter happening with relative paths, yet somehow relative domains are the default! Madness!
Re: The danger of the trailing dot in the domain name
#45The fact that the two IIS based sites (Microsoft, Stack overflow) both fail with an outright error 400 complaining about a bad host name makes me wonder whether this might actually be a bug in IIS to overzealously validate the hostname. The trailing dot is totally valid and there's no need to complain.
Stack overflow uses IIS??
Yes and it really showed in the beginning: they had lots of issues and you could constantly see the cat saying "sorry, i am wurkin' on fixin' yer problem" (don't remember the exact msg but it was a lolzcat message).
SO is also hardly something impressive from a UI point of view: it is a very simple UI really not doing much. Usenet readers from 20 years ago were way more capable than SO...
Re: The danger of the trailing dot in the domain name
#46Just tried it with my app on heroku and get an HTTP 404 "no such app" error. Tried to add www.mydomain.com. to the domain list in the admin interface. Didn't work either stating "Domain is invalid". Gna...
You don't need to add the FQDN - heroku already supports it. E.g. http://www.leedsindustrialestate.co.uk./ is a Heroku hosted site.
Re: The danger of the trailing dot in the domain name
#47You can cd to /home/user or /home/user/ as well. The dot's in DNS are equivalent to the slashes in your Unix file system. / is root . is root I'm shocked that many people on HN don't seem to understand this.
Not the same thing, really, since domains are reversed compared to file paths. In domains, the root token is optional and assumed; like if 'home/user' meant the same thing as '/home/user'.
Re: The danger of the trailing dot in the domain name
#48Just tried it with my app on heroku and get an HTTP 404 "no such app" error. Tried to add www.mydomain.com. to the domain list in the admin interface. Didn't work either stating "Domain is invalid". Gna...
Use example.com in examples, since mydomain.com is an actual website.
Or if you want to make it clear that it's your domain, mydomain.example or mydomain.test https://en.wikipedia.org/wiki/Top-level_domain#Reserved_doma...
Re: The danger of the trailing dot in the domain name
#49You can cd to /home/user or /home/user/ as well. The dot's in DNS are equivalent to the slashes in your Unix file system. / is root . is root I'm shocked that many people on HN don't seem to understand this.
Not the same thing, really, since domains are reversed compared to file paths. In domains, the root token is optional and assumed; like if 'home/user' meant the same thing as '/home/user'.
Well, reverse the path then. "news.ycombinator.com." is equivalent to "/com/ycombinator/news", but more commonly we use "news.ycombinator.com", equivalent to "com/ycombinator/news".
The root token is not optional and assumed at all. Instead, there are multiple "search paths", like with binaries on *nix and Windows/DOS. Now, usually, it will check "." ("/") somewhere along the way, but people often have intranet domains which are also checked, so what you expected to resolve to "news.ycombinator.com." might resolve to "news.ycombinator.com.mycompany.com."
Re: The danger of the trailing dot in the domain name
#50You can cd to /home/user or /home/user/ as well. The dot's in DNS are equivalent to the slashes in your Unix file system. / is root . is root I'm shocked that many people on HN don't seem to understand this.
My shock is that some webservers don't remove an ending dot before trying to match a virtual host (any besides IIS?), and that web browsers don't assume equivalence, for website SSL cert CN purposes, between "fqdn." and "fqdn". I'm also shocked that chrome and firefox send a relative domain in Host: headers if that's what's typed into the url bar. Why wouldn't they send the fqdn? Is it specified this way in some RFC?…
It's because it makes the attacker's job easier. "fqdn." and "fqdn" are not the same thing. They may not resolve to the same machine. If one of them resolves to the attacker's machine, you certainly don't want them to be equivalent.