5mo ago

ICANN approves use of .internal domain for your network

www.theregister.com ICANN approves use of .internal domain for your network

Vint Cerf revealed Google already uses the string, as do plenty of others

Tech @programming.dev

ICANN approves use of .internal domain for your network • The Register

www.theregister.com /2024/08/08/dot_internal_ratified/

1 0

150 comments

It would have been nice if they came up with something shorter like .lan.
- Oh, that's LAN - I thought you'd put ian and I was trying to get the joke. Stupid sans-serif fonts.
  
  First pictures of him sleeping now he has a TLD
- Use it anyway.
  
  You go to networking jail for that.

Sorry. I chose .local and I'm sticking to it.
- I switched from .local to .honk and I'm never looking back.
  
  I love it
  
  Fucking GENIUS.
- I was using .local, but it ran into too many conflicts with an mDNS service I host and vice versa. I switched to .lan, but I'm certainly not going to switch to .internal unless another conflict surfaces.
  I've also developed a host-monitoring solution that uses mDNS, so I'm not about to break my own software. 😅
  
  .internal takes to long to type
  
  Yeah, I don't really have a use at home for mDNS. None that I can think of, anyway. Pretty sure I was using it before MDNS was a thing.
- It's also second only to .com in terms of query volume in ICANN's Magnitude statistics with 980 mil vs .internal's 60 mil. Not sure if that makes it a de facto standard, but it's close.
- I went with .home and so far the problems are within reason
  
  I'm using .home and have not had any issues. Would you mind sharing what problems you've come across so I know what to expect?
- I still haven't heard a convincing argument to not use .local and I see no reason to stop.
  
  Mainly conflicts with mDNS. However it's shitty IMHO that the mDNS spec snarfed a domain already in widespread use, should have used .mDNS or similar.
  
  .local is already used by mDNS/Zeroconf.
  
  Tell me you don't share a net with Macs without using those words.
  
  I've also used .local but .local could imply a local neighborhood. The word itself is based on "location". Maybe a campus could be .local but the smaller networks would be .internal
  Or, maybe they want to not confuse it with link-local or unique local addresses. Though, maybe all .internal networks should be using local (private) addresses?
  
  My main issue was it doesn’t play well with Macs.
- I’ve had issues with .local on my Android device. Straight up doesn’t work. I had to change to .lan
  
  Hmm, the only issue I had was because it was using the DoH (which I don't have a local server for). Once I disabled that, it was fine.

It should be reserved for sex toys.
Just saying.
- What are you doing step-LAN?
  
  Please don't use the duplex again.
  
  I saw you peeked inside my ssh key drawer last night step-LAN
- I used to wonder why porn sites aren't required to use '.cum' instead of '.com'...
  
  The original 3, “.cum”, “.nut”, and “.orgasm”.
  
  Well did you find out?
- some sex toys are external
  
  Then they go on .external, obviously.

Browsers barf at non https now. What are we supposed to do about certificates?
- If you mean properly signed certificates (as opposed to self-signed) you'll need a domain name, and you'll need your LAN DNS server to resolve a made-up subdomain like lan.domain.com. With that you can get a wildcard Let's Encrypt certificate for *.lan.domain.com and all your https://whatever.lan.domain.com URLs will work normally in any browser (for as long as you're on the LAN).
  
  Right, main point of my comment is that .internal is harder to use that it immediately sounds. I don't even know how to install a new CA root into Android Firefox. Maybe there is a way to do it, but it is pretty limited compared to the desktop version.
- Nothing, this is not about that.
  This change gives you the guarantee that .internal domains will never be registered officially, so you can use them without the risk of your stuff breaking should ICANN ever decide to make whatever TLD you're using an official TLD.
  That scenario has happened in the past, for example for users of FR!TZBox routers which use fritz.box. .box became available for purchase and someone bought fritz.box, which broke browser UIs. This could've even been used maliciously, but thankfully it wasn't.
- Either ignore like I do or add a self signed cert to trusted root and use that for your services. Will work fine unless you're letting external folks access your self hosted stuff.
- Quite literally my first thought. Great, but I can't issue certs against that.
  One of the major reasons I have a domain name is so that I can issue certs that just work against any and all devices. For resources on my network. Home or work, some thing.
  To folks recommending a private CA, that's a quick way to some serious frustration. For some arguably good reasons. On some devices I could easily add a CA to, others are annoying or downright bullshit, and yet others are pretty much impossible. Then that last set that's the most persnickety, guests, where it'd be downright rude!
  Being able to issue public certs is easily is great! I don't use .local much because if it's worth naming, it's worth securing.
  
  My Asus router is actually able to get a certificate and use DDNS which is really interesting.
  
  Same thing we do with .local - "click here to proceed (unsafe)" :D
  Set up my work's network waay back on NT4. 0 as .local cuz I was learning and didn't know any better, has been that way ever since.
- You can set up your own CA, sign certs and distribute the root to every one of your devices if you really wanted to.
  
  Yeah I know about that, I've done it. It's just a PITA to do it even slightly carefully.
  
  That sounds like a bad idea, you would need your CA and your root certs to be completely air gapped for it to be even remotely safe.
- I found options like .local and now .internal way too long for my private stuff. So I managed to get a two-letter domain from some obscure TLD and with Cloudflare as DNS I can use Caddy to get Let's Encrypt certs for hosts that resolve to 10.0.0.0/8 IPs. Caddy has plugins for other DNS providers, if you don't want to go with Cloudflare.
  
  Might be an idea to not use any public A records and just use it for cert issuance, and Stick with private resolvers for private use.
- Maybe browsers could be configured to automatically accept the first certificate they see for a given .internal domain, and then raise a warning if it ever changes, probably with a special banner to teach the user what an .internal name means the first time they see one
  
  The main reason this will never happen is that the browser vendors make massive revenue and profit margins off of The Cloud and would really prefer that the core concept of a LAN just dies so you pay your rent to them.
- Accept them

Why do I care what ICANN says I can do on my own network? It's my network, I do what I want.
- Try using .com for your internal network and watch the problems arise. Their choice to reserve .internal helps people avoid fqdn collisions.
  See also https://traintocode.com/stop-using-test-dot-com/
  
  Well as long as the TLD isn't used by anyone it should work internally regardless of what ICANN says, especially if I add it to etc/hosts
- Certain domain names are locally routed only. So if you use internal or local as a tld, you can just assign whatever names you want and your computer won't go looking out on the internet for them. This means you and I can both have fileserver.local as an address on our respective network without conflicting. It's the URI equivalent of 192.168.0.0/16.
  
  Interesting that you should use ".local" as an example, as that one's extra special, aka Multicast DNS
- YouCANN do anything you want?
- The value of the DNS is that we all use the same one. You can declare independence, but you'd lose out on that value.
  
  the only losers in this situation are people that are squatting on my rightfully pirated domain names!

I will stick with .lan
- But what if your name is not Ian...
  
  Then change it Ian!
- Tai'shar Malkier!

That's good, I never liked the clunky .home.arpa domain.
- Well, I just realized I completely goofed, because I went with .arpa instead of .home.arpa, due to what was surely not my own failings.
  So I guess I’m going to be changing my home’s domain anyway.
- It was just always so annoying having to go into the iPhone keyboard punctuation twice for each domain

Took long enough

Thanks but I hardly needed anyone permission to not use that. .local still works just fine.
- Except when it doesn't. It can have issues around multicast dns.
- I've had issues with .local on my Android device. Straight up doesn't work. I had to change to .lan
  
  Same here, just stumbled across this issue yesterday when I tried to restructure my network to use .local
  
  I think it was only added in android 12.
- It just means .internal won't be relayed out on the internet, as it will be reserved for local only.
- Good luck with that. .local is reserved for mDNS calls, and not every OS treats it the same way. Ask me how I know.
  
  Been working fine for me for twenty years or more in a mixed environment.
- I used to use .local but mDNS can get confused, .home has been fine though

Interesting. I've been using ".home.arpa" for a while now, since that's one of the other often used ways.
- home.arpa
  Yes, I've been using this too. Here's the RFC for .home.arpa (in place of .home): https://www.rfc-editor.org/rfc/rfc8375.html
  
  Nice. Thanks 👍

Missed the opportunity for .myshit.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters	More Letters
CA	(SSL) Certificate Authority
DNS	Domain Name Service/System
HTTP	Hypertext Transfer Protocol, the Web
HTTPS	HTTP over SSL
IP	Internet Protocol
SSL	Secure Sockets Layer, for transparent encryption
TLS	Transport Layer Security, supersedes SSL
VPN	Virtual Private Network

6 acronyms in this thread; the most compressed thread commented on today has 6 acronyms.

[Thread #910 for this sub, first seen 8th Aug 2024, 09:05] [FAQ] [Full list] [Contact] [Source code]

Thank god. Now iOS will finally recognize it

Next up!
ICANN approves use of .awesome-selfhosted domain for your network

I guess no one offered anything for .internal

Woohoo! We internal now! No more FQDN collisions!

routerlogin.net how I do not miss you
- i loved that it was an option. not sure why it was changed.

We use .lh, short for localhost. For local network services I use service discovery and .local. And for internal stuff we just use a subdomain of our domain.

I personally use .nexus for my network.

My network is .milkme and I have nipples… will they approve it?
- You can milk anything with nipples!

150 comments