Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

.INTERNAL is now reserved for private-use applications

icann.org

Post reply on HN
Print view View original

31–40 of 290 posts

Re: .INTERNAL is now reserved for private-use applications

#31

Post by jcrites »

leeter wrote: post #27
jcrites wrote: post #24

Are there any good reasons to use a TLD like .internal for private-use applications, rather than just a regular gTLD like .com? It's nice that this is available, but if I was building a new system today that was internal, I'd use a regular domain name as the root. There are a number of reasons, and one of them is that it's incredibly nice to have the flexibility to make a name visible on the Internet, even if it is c…

I can't speak for others but HSTS is a major reason. Not everybody wants to deal with setting up certs for every single application on a network but they want HSTS preload externally. I get why for AWS the solution of having everything from a .com works. But for a lot of small businesses it's just more than they want to deal with. Another reason is information leakage. Having DNS records leak could actually provide p…

> Having DNS records leak could actually provide potential information on things you'd rather not have public.

This is true, but using a regular domain name as your root does not require you to actually publish those DNS records on the Internet.

For example, say that you own the domain `example.com`. You can build a private service `foo.example.com` and only publish its DNS records within the networks where it needs to be resolved – in exactly the same way that you would with `foo.internal`.

If you ever decide that you want an Internet-facing endpoint, just publish `foo.example.com` in public DNS.

Re: .INTERNAL is now reserved for private-use applications

#32

Post by leeter »

jcrites wrote: post #31
leeter wrote: post #27

Earlier quoted context omitted.

I can't speak for others but HSTS is a major reason. Not everybody wants to deal with setting up certs for every single application on a network but they want HSTS preload externally. I get why for AWS the solution of having everything from a .com works. But for a lot of small businesses it's just more than they want to deal with. Another reason is information leakage. Having DNS records leak could actually provide p…

> Having DNS records leak could actually provide potential information on things you'd rather not have public. This is true, but using a regular domain name as your root does not require you to actually publish those DNS records on the Internet. For example, say that you own the domain `example.com`. You can build a private service `foo.example.com` and only publish its DNS records within the networks where it needs…

I'm not disagreeing at all. But Hanlon's Razor applies:

> Never attribute to malice what can better be explained by incompetence

You can't leak information if you never give access to that zone in any way. More than once I've run into well meaning developers in my time. Having a .internal inherently documents that something shouldn't be public. Whereas foo.example.com does not.

Re: .INTERNAL is now reserved for private-use applications

#34

Post by quectophoton »

tetris11 wrote: post #5

I need a dumbed down version of this.

When you need to assign an IP address for a host, the safest thing to do is to either use an IP address you own^Ware renting, or to use an IP address nobody will be able to "own" in the foreseeable future.

This is that but for domain names. When you need to use a domain name to refer to a host, the safest thing to do is to either use a domain name you own^Ware renting, or to use a domain name nobody will be able to "own" in the foreseeable future.

For an IP address, you might usually choose from 192.168.0.0/16 or similar reserved ranges. Your "192.168.1.1" is not the same as my "192.168.1.1", we both can use it and neither of us can "officially" own it.

For a domain name, you can use ".internal" or other similar (if uglier) reserved TLDs. Your "nas.internal" is not the same as my "nas.internal", we both can use it and neither of us can "officially" own it.

Since you're asking this question you might also be wondering how people can even use custom domains like that, and the answer is by self-hosting a DNS server, and using that as a DNS server instead of a public one (so you'd use your self-hosted server instead of, say, "8.8.8.8"). Then you configure your DNS server so that whenever someone requests "google.com" it does "the normal thing", but when someone requests "nas.internal" it returns whatever IP address you want.

Re: .INTERNAL is now reserved for private-use applications

#35

Post by 2snakes »

There used to be issues with the public part of a .com getting sent weird private windows traffic iirc. This was discovered with honeypot analysis and the potential for information exposure if you could register a .com and another company was using it as their AD domain.

Re: .INTERNAL is now reserved for private-use applications

#36

Post by candiddevmike »

jeroenhd wrote: post #19
duskwuff wrote: post #7

Earlier quoted context omitted.

.local is already reserved for mDNS.

.local is in this weird state where it's _technically_ not reserved, but most PCs in the world already resolve it with special non-DNS software because of the Bonjour/mDNS protocol. So you end up with the IETF standardising .local, because Apple was already using it, but ICANN never did much with that standardisation. I doubt ICANN will actually touch .local, but they could. One could imagine a scheme where .local is…

It's reserved per RFC 6762:

> This document specifies that the DNS top-level domain ".local." is a special domain with special semantics, namely that any fully qualified name ending in ".local.

https://datatracker.ietf.org/doc/html/rfc6762

Applications can/will break if you attempt to use .local outside of mDNS (such as systemd-resolved). Don't get upset when this happens.

Interesting fact: RFC 6762 predates Kubernetes (one of the biggest .local violators), they should really change the default domain...

Re: .INTERNAL is now reserved for private-use applications

#38

Post by quectophoton »

duskwuff wrote: post #14
csdreamer7 wrote: post #9

Earlier quoted context omitted.

Not by ICANN? https://www.iana.org/domains/root/db

The ICANN root zone only contains gTLDs and ccTLDs which are delegated. Other TLDs which are explicitly reserved for non-public use, like .localhost, .test, or .invalid, don't appear on that list either.

I think a more correct place to look at would be the gTLD Applicant Guidebook[1][2], section "2.2.1.2.1 Reserved Names", which I guess should be updated to now include "INTERNAL".

Though that list apparently includes all reserved names, not only those reserved for non-public use.

[1]: https://newgtlds.icann.org/en/applicants/agb

[2]: https://newgtlds.icann.org/sites/default/files/guidebook-ful...

Re: .INTERNAL is now reserved for private-use applications

#39

Post by csdreamer7 »

duskwuff wrote: post #14
csdreamer7 wrote: post #9

Earlier quoted context omitted.

Not by ICANN? https://www.iana.org/domains/root/db

The ICANN root zone only contains gTLDs and ccTLDs which are delegated. Other TLDs which are explicitly reserved for non-public use, like .localhost, .test, or .invalid, don't appear on that list either.

Ty for the information.
Post reply on HN