6 ms·

We have a client who insisted on using a .house domain. It kept triggering alerts on our uptime monitoring service with DNS errors, so we had to reduce the sens

We have a client who insisted on using a .house domain. It kept triggering alerts on our uptime monitoring service with DNS errors, so we had to reduce the sensitivity of that specific test. We also had a client who had to change their TLD from .healthcare to .org.uk because (a) people were confused because they didn't understand that there are all these new TLDs and kept adding .co.uk, .org etc and (b) some NHS systems in the UK (one of their target audiences) refused to accept emails that finished with .healthcare, saying that it was a malformed email address. I think in the vast majority of cases these new TLDs aren't worth it until the general population's understanding catches up. I still advise clients to use www rather than a plain domain name for websites, because I've come across a significant minority of people who need that "www" as a clear signal that it's a website.

Eikon 7y ago
> I still advise clients to use www rather than a plain domain name for websites And you should. Not only can’t you put CNAME at the zone APEX without doing nasty tricks but not doing so is also a security risk when dealing with cookies.
- SiVal 7y ago
  Could you (or someone) explain this? (I'm not arguing, I'm interested.)
  - faeyanpiraat 7y ago
    I'm interested in this aswell.
  - Eikon 7y ago
    You can only put CNAME records at the zone APEX if there is no other records kinds as a CNAME is supposed to be a synonymous. If you had records such as: @ IN A 127.0.0.1 @ IN CNAME example.org. The server could not answer anything sensible as you now just introduced an ambiguity. The "nasty tricks" I was referring to is basically records such as ALIAS that you may find at some providers. The way they work is roughly: - Given a record `@ IN ALIAS example.org.`. - Pull records at `example.org` (maybe with an AXFR request but usually just individual records). - Merge our domain APEX with `example.org` records we just pulled. - Reply to requester with the merged zone, discarding the ALIAS record. Regarding cookies, the issue is that they are passed to subdomains so cookies that you set for `example.org` are also accessible from `*.example.org`.
    - cbg0 7y ago
      What's so "nasty" about using ALIAS? > Regarding cookies, the issue is that they are passed to subdomains so cookies that you set for `example.org` are also accessible from `*.example.org`. This is only true for cookies that are not set as `HostOnly` as far as I'm aware.
      - Eikon 7y ago
        > What's so "nasty" about using ALIAS? It's a not standard and therefore, is not a generally applicable solution. When something not standard becomes common practice and is expected, here comes the pain.
        XelNika 7y ago
        I don't really see the issue. It changes nothing from the DNS client's perspective.
        toast0 7y ago
        From the DNS client's perspective, there is a positive and a negative. Positive: since the server with an alias record actually returns an A/AAAA, a client doesn't have to contact any more servers to get the results. Negative: the servers for the CNAME target may be faster, relevant if the name is used beyond the A/AAAA TTL but sooner than the TTL would be set for a CNAME); or the servers for the target may be providing much finer targeting than is possibly by proxying.
        cbg0 7y ago
        > When something not standard becomes common practice and is expected, here comes the pain. I think that's the case with most popular features before they become a standard. Personally, I've used ALIAS on AWS without a hitch for years.
        SteveNuts 7y ago
        The standard should be amended for the modern web then. AWS's (and I'm sure many other's) implementation of this for their various load balancing, CDN services, etc. are critical to the health of the web now.
  - johannes1234321 7y ago
    There is lots on the DNS already. For the security argument: Consider you run on `example.com` and at a later stage add `[blog|forum|support|...].example.com` suddenly cookies from `example.com` might leak to those Subdomains. If you put cookies on `www.example.com` they won't leak to those.
    - Avamander 7y ago
      Not if you set the Domain attribute of the cookie properly, this is a poor software problem, not second-level domain problem.
      - johannes1234321 7y ago
        True, but simple mitigations can be powerful ... Sidenote: If leaking cookies to your own subdomains is a risk, one might also have other problems already. Point is: I explained the potential risk. Evaluating one has to do oneself
- chrisweekly 7y ago
  Use of CNAMES also leaves the door open to simple DDOS mitigation.
- dfawcus 7y ago
  So maybe we should define a DNS SRV record (https://tools.ietf.org/html/rfc2782 https://tools.ietf.org/html/rfc2782) for WWW, and work to get the browsers using it? e.g. _http._tcp.example.com and _https._tcp.example.com It seems there was such a draft: https://tools.ietf.org/html/draft-andrews-http-srv-02 https://tools.ietf.org/html/draft-andrews-http-srv-02
  - JdeBP 7y ago
    Enjoy http://jdebp.uk./FGA/dns-srv-record-use-by-clients.html#HTTP http://jdebp.uk./FGA/dns-srv-record-use-by-clients.html#HTTP and http://jdebp.uk./FGA/dns-srv-record-use-by-clients.html#Shame http://jdebp.uk./FGA/dns-srv-record-use-by-clients.html#Sham... .
  - teddyh 7y ago
    SRV support seems to have been (unfairly, I think) rejected by HTTP vendors and standard bodies. There is a new standard, however, in the works: https://tools.ietf.org/html/draft-nygren-dnsop-svcb-httpssvc-00 https://tools.ietf.org/html/draft-nygren-dnsop-svcb-httpssvc... This one might have a larger chance of being accepted, since it provides some things which HTTP standard bodies and HTTP client vendors want. It doesn’t (at this stage, anyway) provide for the load-balancing “weight” field from the SRV record, but it does support MX-style priority numbers, and also port numbers. Very interesting, to say the least.
- svacko 7y ago
  one of my DNS hosting providers supports ANAME record to provide CNAME record for apex/naked domain https://tools.ietf.org/id/draft-ietf-dnsop-aname-01.html https://tools.ietf.org/id/draft-ietf-dnsop-aname-01.html - found just today trying to configure static website hosting on S3 & Cloudfront
syshum 7y ago
as with all things, this depends on your target audience. If you seeking a general population for something like healthcare, finance, or any other ever day task then yes stick to the old school TLD's
pjc50 7y ago
Even .org.uk isn't foolproof; I've had mine for 20 years and still occasionally get people leaving off the .uk. The most recent suspect is Google Android keyboard will autocomplete my email address .. and leave off the ".uk"!
- pidg 7y ago
  As the former holder of yahoo.org.uk, I can also confirm that ordinary people don't understand the difference between .org.uk and .co.uk.
  - omnimus 7y ago
    why is that .co.uk anyway? like other countries have .de .nl.. at certain point i thought its smebody owning co.or reselling subdomains.
    - Symbiote 7y ago
      Like many countries, .UK had a second-level set of categories for different types of organization. There's also .net.uk, .sch.uk, .ac.uk, .gov.uk, .nhs.uk, .mod.uk, .police.uk, ... .AU, .NZ, .JP, .MX, .BR, .TH... it's not uncommon.
mr__y 7y ago
>some NHS systems in the UK (one of their target audiences) refused to accept emails that finished with .healthcare not suprising at all, I've seen e-mail address validation code that (among other things) used a fixed list of TLDs. I could imagine some spam filters doing a similiar thing.
- mytailorisrich 7y ago
  And I've seen validation that assumed that TLDs were 2 or 3 characters only.
  - mr__y 7y ago
    Oh yes, a simple [a-z]{2,3} in regexp. I'm pretty sure I've seen exactly this on many different occasions
    - unilynx 7y ago
      Or their 'modern' version: ([a-z]{2,3})|info)
- takeda 7y ago
  I know there was someone in charge of ccTLD, and used just that TLD for personal e-mail (i.e. no dots). That would throw off a lot of validators, but I suppose it also was good to avoid all kinds of robots that were scanning webpages for emails.
- cuspycode 7y ago
  I've had e.g. foo@mysub.mydomain.com rejected by one of the world's top-3 shipping/courier services. This was on a .com domain registered many years ago, so it wasn't a TLD issue. And the subdomain and its MX was also established long ago. But their software finally did accept the mail address after I removed the "mysub." part. Crazy!
edent 7y ago
I'm interested in the NHS systems which didn't recognise the newer TLDs. I work for NHSX - could you drop me an email with the details? My contact details are in my profile. Thanks!
- frereubu 7y ago
  Sure - I'll drop them an email to see if they can remember. They changed towards the middle of last year, and it was reported to them by NHS staff rather than them experiencing it first-hand, so their memories may be a bit hazy.
  - uasm 7y ago
    Friendly reminder: you don't really know whether this person truly works for the NHS, as they claim. Don't divulge sensitive information to random people.
    - ddeck 7y ago
      Perhaps in general, but in this case the email he's pointing to is an nhs.uk address.
Karunamon 7y ago
There are many broken web forms out there that didn't support perfectly legitimate ccTLDs, and that's before the floodgates were thrown open. There's lots of silly ideas out there on how to validate an email address, and almost nobody uses the right one. (To wit: Deliver to it, and if it doesn't send, that's the user's problem)
Faark 7y ago
> I've come across a significant minority of people who need that "www" as a clear signal that it's a website Now more than ever. Before they opened the tld floodgates you could be pretty sure [word].[commonTld] could be put into your browser. So yeah, guess we have to keep using those 4 letters or come up with alternative solutions. Funniest I've seen was an ad using http:// http:// instead.

Eikon 7y ago

> I still advise clients to use www rather than a plain domain name for websites And you should. Not only can’t you put CNAME at the zone APEX without doing nasty tricks but not doing so is also a security risk when dealing with cookies.

SiVal 7y ago
Could you (or someone) explain this? (I'm not arguing, I'm interested.)
- faeyanpiraat 7y ago
  I'm interested in this aswell.
- Eikon 7y ago
  You can only put CNAME records at the zone APEX if there is no other records kinds as a CNAME is supposed to be a synonymous. If you had records such as: @ IN A 127.0.0.1 @ IN CNAME example.org. The server could not answer anything sensible as you now just introduced an ambiguity. The "nasty tricks" I was referring to is basically records such as ALIAS that you may find at some providers. The way they work is roughly: - Given a record `@ IN ALIAS example.org.`. - Pull records at `example.org` (maybe with an AXFR request but usually just individual records). - Merge our domain APEX with `example.org` records we just pulled. - Reply to requester with the merged zone, discarding the ALIAS record. Regarding cookies, the issue is that they are passed to subdomains so cookies that you set for `example.org` are also accessible from `*.example.org`.
  - cbg0 7y ago
    What's so "nasty" about using ALIAS? > Regarding cookies, the issue is that they are passed to subdomains so cookies that you set for `example.org` are also accessible from `*.example.org`. This is only true for cookies that are not set as `HostOnly` as far as I'm aware.
    - Eikon 7y ago
      > What's so "nasty" about using ALIAS? It's a not standard and therefore, is not a generally applicable solution. When something not standard becomes common practice and is expected, here comes the pain.
      - XelNika 7y ago
        I don't really see the issue. It changes nothing from the DNS client's perspective.
        toast0 7y ago
        From the DNS client's perspective, there is a positive and a negative. Positive: since the server with an alias record actually returns an A/AAAA, a client doesn't have to contact any more servers to get the results. Negative: the servers for the CNAME target may be faster, relevant if the name is used beyond the A/AAAA TTL but sooner than the TTL would be set for a CNAME); or the servers for the target may be providing much finer targeting than is possibly by proxying.
      - cbg0 7y ago
        > When something not standard becomes common practice and is expected, here comes the pain. I think that's the case with most popular features before they become a standard. Personally, I've used ALIAS on AWS without a hitch for years.
      - SteveNuts 7y ago
        The standard should be amended for the modern web then. AWS's (and I'm sure many other's) implementation of this for their various load balancing, CDN services, etc. are critical to the health of the web now.
- johannes1234321 7y ago
  There is lots on the DNS already. For the security argument: Consider you run on `example.com` and at a later stage add `[blog|forum|support|...].example.com` suddenly cookies from `example.com` might leak to those Subdomains. If you put cookies on `www.example.com` they won't leak to those.
  - Avamander 7y ago
    Not if you set the Domain attribute of the cookie properly, this is a poor software problem, not second-level domain problem.
    - johannes1234321 7y ago
      True, but simple mitigations can be powerful ... Sidenote: If leaking cookies to your own subdomains is a risk, one might also have other problems already. Point is: I explained the potential risk. Evaluating one has to do oneself
chrisweekly 7y ago
Use of CNAMES also leaves the door open to simple DDOS mitigation.
dfawcus 7y ago
So maybe we should define a DNS SRV record (https://tools.ietf.org/html/rfc2782 https://tools.ietf.org/html/rfc2782) for WWW, and work to get the browsers using it? e.g. _http._tcp.example.com and _https._tcp.example.com It seems there was such a draft: https://tools.ietf.org/html/draft-andrews-http-srv-02 https://tools.ietf.org/html/draft-andrews-http-srv-02
- JdeBP 7y ago
  Enjoy http://jdebp.uk./FGA/dns-srv-record-use-by-clients.html#HTTP http://jdebp.uk./FGA/dns-srv-record-use-by-clients.html#HTTP and http://jdebp.uk./FGA/dns-srv-record-use-by-clients.html#Shame http://jdebp.uk./FGA/dns-srv-record-use-by-clients.html#Sham... .
- teddyh 7y ago
  SRV support seems to have been (unfairly, I think) rejected by HTTP vendors and standard bodies. There is a new standard, however, in the works: https://tools.ietf.org/html/draft-nygren-dnsop-svcb-httpssvc-00 https://tools.ietf.org/html/draft-nygren-dnsop-svcb-httpssvc... This one might have a larger chance of being accepted, since it provides some things which HTTP standard bodies and HTTP client vendors want. It doesn’t (at this stage, anyway) provide for the load-balancing “weight” field from the SRV record, but it does support MX-style priority numbers, and also port numbers. Very interesting, to say the least.
svacko 7y ago
one of my DNS hosting providers supports ANAME record to provide CNAME record for apex/naked domain https://tools.ietf.org/id/draft-ietf-dnsop-aname-01.html https://tools.ietf.org/id/draft-ietf-dnsop-aname-01.html - found just today trying to configure static website hosting on S3 & Cloudfront

syshum 7y ago

as with all things, this depends on your target audience. If you seeking a general population for something like healthcare, finance, or any other ever day task then yes stick to the old school TLD's

pjc50 7y ago

Even .org.uk isn't foolproof; I've had mine for 20 years and still occasionally get people leaving off the .uk. The most recent suspect is Google Android keyboard will autocomplete my email address .. and leave off the ".uk"!

pidg 7y ago
As the former holder of yahoo.org.uk, I can also confirm that ordinary people don't understand the difference between .org.uk and .co.uk.
- omnimus 7y ago
  why is that .co.uk anyway? like other countries have .de .nl.. at certain point i thought its smebody owning co.or reselling subdomains.
  - Symbiote 7y ago
    Like many countries, .UK had a second-level set of categories for different types of organization. There's also .net.uk, .sch.uk, .ac.uk, .gov.uk, .nhs.uk, .mod.uk, .police.uk, ... .AU, .NZ, .JP, .MX, .BR, .TH... it's not uncommon.

mr__y 7y ago

>some NHS systems in the UK (one of their target audiences) refused to accept emails that finished with .healthcare not suprising at all, I've seen e-mail address validation code that (among other things) used a fixed list of TLDs. I could imagine some spam filters doing a similiar thing.

mytailorisrich 7y ago
And I've seen validation that assumed that TLDs were 2 or 3 characters only.
- mr__y 7y ago
  Oh yes, a simple [a-z]{2,3} in regexp. I'm pretty sure I've seen exactly this on many different occasions
  - unilynx 7y ago
    Or their 'modern' version: ([a-z]{2,3})|info)
takeda 7y ago
I know there was someone in charge of ccTLD, and used just that TLD for personal e-mail (i.e. no dots). That would throw off a lot of validators, but I suppose it also was good to avoid all kinds of robots that were scanning webpages for emails.
cuspycode 7y ago
I've had e.g. foo@mysub.mydomain.com rejected by one of the world's top-3 shipping/courier services. This was on a .com domain registered many years ago, so it wasn't a TLD issue. And the subdomain and its MX was also established long ago. But their software finally did accept the mail address after I removed the "mysub." part. Crazy!

edent 7y ago

I'm interested in the NHS systems which didn't recognise the newer TLDs. I work for NHSX - could you drop me an email with the details? My contact details are in my profile. Thanks!

frereubu 7y ago
Sure - I'll drop them an email to see if they can remember. They changed towards the middle of last year, and it was reported to them by NHS staff rather than them experiencing it first-hand, so their memories may be a bit hazy.
- uasm 7y ago
  Friendly reminder: you don't really know whether this person truly works for the NHS, as they claim. Don't divulge sensitive information to random people.
  - ddeck 7y ago
    Perhaps in general, but in this case the email he's pointing to is an nhs.uk address.

Karunamon 7y ago

There are many broken web forms out there that didn't support perfectly legitimate ccTLDs, and that's before the floodgates were thrown open. There's lots of silly ideas out there on how to validate an email address, and almost nobody uses the right one. (To wit: Deliver to it, and if it doesn't send, that's the user's problem)

Faark 7y ago

> I've come across a significant minority of people who need that "www" as a clear signal that it's a website Now more than ever. Before they opened the tld floodgates you could be pretty sure [word].[commonTld] could be put into your browser. So yeah, guess we have to keep using those 4 letters or come up with alternative solutions. Funniest I've seen was an ad using http:// http:// instead.