4 ms·

I'd hope that some sort of DNS namespace could be carved out with appropriate rules followed by everyone. The automatic resolution is an optimisation I am sugg

I'd hope that some sort of DNS namespace could be carved out with appropriate rules followed by everyone. The automatic resolution is an optimisation I am suggesting. If ip.whatever.domain always resolves to ip then your local network infrastructure can do that without requiring external Internet connectivity at the time of resolution. You shouldn't require Internet connectivity for internal access!

pfg 11y ago
The problem is that you'll still need some kind of unique "domain space", i.e. you can't have just <ip>.vendor.direct (or whatever the TLD would be), because then multiple users could get a signed certificate for the same FQDN, which would allow interesting MitM scenarios (that was one of the main motivations behind the decision to forbid CAs from issuing certificates for internal names). Anyway, I think that the public DNS solution + DHCP hostname mapping + manual DNS configuration as a last resort would be good enough for almost every scenario I can think of.