Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

.INTERNAL is now reserved for private-use applications

icann.org

Post reply on HN
Print view View original

81–90 of 290 posts

Re: .INTERNAL is now reserved for private-use applications

#81

Post by justin_oaks »

quectophoton wrote: post #44
jcrites wrote: post #24

Are there any good reasons to use a TLD like .internal for private-use applications, rather than just a regular gTLD like .com? It's nice that this is available, but if I was building a new system today that was internal, I'd use a regular domain name as the root. There are a number of reasons, and one of them is that it's incredibly nice to have the flexibility to make a name visible on the Internet, even if it is c…

> Are there any good reasons to use a TLD like .internal for private-use applications, rather than just a regular gTLD like .com? That assumes you are able to pay to rent a domain name, and keep paying for it, and that you are reasonably sure that the company you're renting it from is not going to take it away from you because of a selectively-enforced TOS, and that you are reasonably sure that both yourself and your…

If you control the DNS resolution in your company and use an internal certificate authority, technically you don't have to rent a domain name. You can control how it resolves and "hijack" whatever domain name you want. It won't be valid outside your organization/network, but if you're using it only for internal purposes then that doesn't matter.

Of course, this is a bad idea, but it does allow you to avoid the "rent".

Re: .INTERNAL is now reserved for private-use applications

#83

Post by yjftsjthsd-h »

8organicbits wrote: post #46

My biggest frustration with .internal is that it requires a private certificate authority. Lots of organizations struggle to fully set up trust for the private CA on all internal systems. When you add BYOD or contractor systems, it's a mess. Using a publicly valid domain offers a number of benefits, like being able to use a free public CA like Lets Encrypt. Every machine will trust your internal certificates out of t…

Do you mean to say that your biggest frustration with HTTPS on .internal is that it requires a private certificate authority? Because I'm running plain HTTP to .internal sites and it works fine.

Re: .INTERNAL is now reserved for private-use applications

#84

Post by dudus »

nox101 wrote: post #76
ghshephard wrote: post #52

Earlier quoted context omitted.

Number one reason that comes to mind is you prevent the possibility of information leakage. You can't screw up your split-dns configuration and end up leaking your internal IP space if everything is .internal. It's much the same reason why some very large IPv6 services deploy some protected IPv6 space in RFC4193 FC::/7 space. Of course you have firewalls. And of course you have all sorts of layers of IDS and air-gaps…

What about things like cookies, storage, caching, etc.. If my job has ` https://testing.internal ` and some company I visit also has ` https://testing.internal ` ...

Great question. I think they leak but this happens regardless.

Re: .INTERNAL is now reserved for private-use applications

#85

Post by yjftsjthsd-h »

zzo38computer wrote: post #48
Denvercoder9 wrote: post #29

Earlier quoted context omitted.

> I also think that a .pseudo TLD should be made up which also cannot be assigned on the internet, but is also not for assigning on local networks either. There's already .example, .invalid, .test and .localhost; which are reserved. What usecase do you have that's not covered by one of them?

.example is used for examples in documentation and stuff like that. .invalid means that a domain name is required but a valid name should not be used; for example, a false email address in a "From:" header in Usenet, to indicate that you cannot send email to the author in this way. .test is for a internal testing use, of DNS and other stuff. .localhost is for identifying the local computer. .internal is (presumably)…

I'm not following; the examples you're giving for .pseudo sound like they would fit under .internal. Could you give a more concrete example of a usecase?

Re: .INTERNAL is now reserved for private-use applications

#86

Post by anderskaseorg »

wlonkly wrote: post #54
candiddevmike wrote: post #36

Earlier quoted context omitted.

It's reserved per RFC 6762: > This document specifies that the DNS top-level domain ".local." is a special domain with special semantics, namely that any fully qualified name ending in ".local. https://datatracker.ietf.org/doc/html/rfc6762 Applications can/will break if you attempt to use .local outside of mDNS (such as systemd-resolved). Don't get upset when this happens. Interesting fact: RFC 6762 predates Kubernet…

But that's an IETF standard, not an ICANN policy. AFAIK there's nothing in place today that would _prevent_ ICANN from granting .local to a registry other than it just being a bad idea.

The jurisdictional status of .local and other standards-reserved special use domains is explained by RFC 6761 section 3:

https://datatracker.ietf.org/doc/html/rfc6761#section-3

And ICANN is bound by the IETF/ICANN Memorandum of Understanding Concerning the Technical Work of the IANA, which prevents it from usurping that jurisdiction:

https://www.icann.org/resources/pages/agreements-en

Re: .INTERNAL is now reserved for private-use applications

#87

Post by dboreham »

jeroenhd wrote: post #71
arjvik wrote: post #25

Earlier quoted context omitted.

Modern windows supports mDNS these days!

It does! I generally assume mDNS to just be available on every device these days. But I've also seen managed environments where mDNS has been turned off or blocked at the firewall.

mDNS is a broadcast protocol so always "blocked at the firewall ".

Re: .INTERNAL is now reserved for private-use applications

#88

Post by lysace »

yjftsjthsd-h wrote: post #83
8organicbits wrote: post #46

My biggest frustration with .internal is that it requires a private certificate authority. Lots of organizations struggle to fully set up trust for the private CA on all internal systems. When you add BYOD or contractor systems, it's a mess. Using a publicly valid domain offers a number of benefits, like being able to use a free public CA like Lets Encrypt. Every machine will trust your internal certificates out of t…

Do you mean to say that your biggest frustration with HTTPS on .internal is that it requires a private certificate authority? Because I'm running plain HTTP to .internal sites and it works fine.

There's some every packet shall be encrypted, even in minimal private VPCs lore going on. I'm blaming PCI-DSS.

Re: .INTERNAL is now reserved for private-use applications

#89

Post by toast0 »

jeroenhd wrote: post #15
gjsman-1000 wrote: post #13

Earlier quoted context omitted.

Um... no? .intern is not a valid TLD; you can't get any domains with it, nobody has proposed that TLD, and if someone did that issue would be discovered then.

If you've got a couple hundred grant laying about, you could probably set up a shell company and acquire .intern through a several-year ccTLD acquisition process. I'd like to think people learned from .dev and such. I doubt any scammer will be able to use it.

At present, you need money and a time machine. New TLDs were allocated in batches, and there's no current application process.
Post reply on HN