16 ms·

Something that I’m surprised a lot of devs don’t know; there are official domains you’re supposed to use for documentation, testing, etc. They are specifically

Something that I’m surprised a lot of devs don’t know; there are official domains you’re supposed to use for documentation, testing, etc. They are specifically reserved by IANA for these purposes. Originally I think it was just example.com, but they now have a list of all them: https://www.iana.org/domains/reserved https://www.iana.org/domains/reserved

walrus01 6y ago
Not just domains but IP address ranges as well. Doesn't stop lots of people from doing things like using real US DOD ipv4 /8 sized ranges for things they shouldn't.
- jcims 6y ago
  I and I’m guessing a few other HN readers worked for a place ~20 years ago that had a nationwide WAN and used a pirated /8 for every state.
lifthrasiir 6y ago
Note that `foo@bar.com` is frequently used to get around the email address requirement, so it is not really for testing. I wouldn't be surprised if prominent websites block any address from example.com or so.
- Sharlin 6y ago
  But people who know and use the words foo and bar are almost exclusively developers, so they should know better eveb when typing a fake address to a random form. But it’s easy to type reflexively, without thinking, so I’m not surprised people do it.
  - CydeWeys 6y ago
    I'll be honest, even I do this when it's a form that has an email requirement but that I don't otherwise care about at all. I'm not gonna sign myself up for spam. Sometimes example.com and whatever other testing TLD that comes to mind is blocked because they want something that could plausibly be a real email address, so I give them something that could plausibly be a real email address, like asfgjklahsfgjklh@asdfoghuasfga.com
    - comfyinnernet 6y ago
      Have you tried theunabomberwasright@fbi.gov?
    - lozaning 6y ago
      That's why I own fakefakefake.email it gives me some minor pleasure to provide this email address to people who insist on having an email address for me.
      - bialpio 6y ago
        I use @mailinator.com for that purpose, it's oddly satisfying to put "lolno@mailinator.com" / etc in those places.
        glandium 6y ago
        A lot of forms reject @mailinator.com and similar domains.
        ficklepickle 6y ago
        Then you use one of their alternate domains. Or you point a domain to one of their alternates. Check out the MX record for meowcats.fun, for example. It points to suremail.info, which points to mailinator. I have never had that domain rejected by a form. Shhh, don't tell anyone ;)
    - nitemice 6y ago
      I've been using a@b.com just because it's quick & easy to type. I just looked it up, and it seems all the single-letter .com domains are reserved, so it should be fine.
      - maven29 6y ago
        Isn't x.com owned by paypal?
  - not2b 6y ago
    The fact that it is a valid address is a feature, as some sites that demand email addresses (so they can spam you) verify the address for correctness. People are intentionally choosing an address that appears valid, because it is valid. So, sorry to the guy who bought bar.com, but that's what he signed up for.
    - Sharlin 6y ago
      Correctness and existence are two different things. I doubt many sites explicitly exclude @example.com or @*.test in their email validator.
- paultopia 6y ago
  I usually use president@whitehouse.gov and the like...
  - srtjstjsj 6y ago
    That risks getting you in trouble with Secret Service.
  - samatman 6y ago
    I would steer well clear of .gov and .mil when providing fake anything. Impersonating federal agents is shockingly illegal and the authorities who enforce this have absolutely no sense of humor. The risk is low but why take it?
- arendtio 6y ago
  Actually, for a while I used example.com a lot and I was surprised how often it worked just fine.
- rubinlinux 6y ago
  I usually use postmaster@theirdomain so they can spam themselves to an address they (in theory) cannot just ignore mail to.
darkerside 6y ago
I've typically used example.com for testing, but link says it's just for documentation. Sounds like .test is the sanctioned way. https://en.m.wikipedia.org/wiki/.test https://en.m.wikipedia.org/wiki/.test
- ryanbrunner 6y ago
  In practice, is there any difference? As long as example.com is guaranteed to be reserved, I don't see any downside in using it. Not using .test was a big problem for tools like Pow a while ago, but that's because they were using .dev, which had no official recognition as being reserved or special-purposed. For e-mail addresses in particular, I could easily see a situation where your domain logic prevents you from using an invalid TLD (like .test), and it would be a shame to special-case something strictly for testing purposes.
  - darkerside 6y ago
    Probably not, but it's always nice to follow intended designs, since others will do so as well and this allows systems to evolve in compatible ways. There may be no difference today, but there could be tomorrow. These days invalid TLDs don't really exist. New ones are getting released all the time. The only problem you'd run into is if the system you're using is treating .test differently for some reason, but that's likely not the case, for obscurity reasons if nothing else.
    - srtjstjsj 6y ago
      .invalid is guaranteed invalid by spec.
      - darkerside 6y ago
        Touche
  - paledot 6y ago
    Well, example.com resolves, . test doesn't. Depending on your use case, one or the other may be desirable, but if you're setting up a dev environment, .test is your answer.
nebulous1 6y ago
A lot of people learned this the hard way when Google bought and later enabled permanent HSTS for the .dev domain (prior to actually publicly releasing it) in Chrome, breaking everybody's non https local .dev environments. As mentioned above, it should have been .test
- CydeWeys 6y ago
  The HSTS preloading fortunately ended up being an unintentional additional type of Controlled Interruption period, which was a good thing in the end. It would've been a lot worse if, one day, your fake domain names are resolving locally, and then literally the next day it's now a real domain name that's resolving remotely, with who knows what result. This at least forced people to address it well in advance of domain names potentially resolving globally. https://www.icann.org/resources/pages/name-collision-2013-12-06-en https://www.icann.org/resources/pages/name-collision-2013-12... https://jdebp.eu/FGA/dns-use-domain-names-that-you-own.html https://jdebp.eu/FGA/dns-use-domain-names-that-you-own.html
  - owl57 6y ago
    Sounds like it could be intentional. — We bought .dev, now what we do with all those people in the wild misusing it? — Well, most of them misuse it with our browser, let's break at least their hacks early and loudly.
    - CydeWeys 6y ago
      It was unintentional. Source: The horse's mouth. I'm the guy who came up with the idea of launching .dev and .app as HTTPS-only TLDs, and I'm the one who had them added to the HSTS preload list.
      - jbrooksuk 6y ago
        Out of interest, how did this happen without any investigation into possible consequences etc? It’s a huge change that surely warranted special attention before making it happen?
TedDoesntTalk 6y ago
But I don’t see example.com listed there...
- EE84M3i 6y ago
  Try Ctrl+F. It's at the top.
EvanAnderson 6y ago
You also have Microsoft's list of domains / companies used in their documentation and examples: https://social.technet.microsoft.com/wiki/contents/articles/1117.list-of-fictional-companies-used-in-microsoft-material.aspx https://social.technet.microsoft.com/wiki/contents/articles/...
- chrismeller 6y ago
  That’s really cool. Contoso (also mentioned by someone else in this thread) and Fabrikam are the only ones I remembered off the top of my head, I had no idea they used that many.
  - RedShift1 6y ago
    Northwind and Windtip
- Hamuko 6y ago
  Didn't Microsoft for the longest time use a domain in their documentation that they didn't own and were basically forced to buy it now?
  - yesbabyyes 6y ago
    Yes, you're probably thinking of corp.com, which MS used as the default for AD setups. It went up for auction this spring and MS bought it: https://krebsonsecurity.com/2020/04/microsoft-buys-corp-com-so-bad-guys-cant/ https://krebsonsecurity.com/2020/04/microsoft-buys-corp-com-...
    - CydeWeys 6y ago
      I used to work for a company named Foo Bar Solutions with the public website foobarsol.com, but that used foobar.com for the internal AD name for some reason (which they didn't actually own). That was ... interesting. Microsoft clearly did not do their due diligence in explaining that the domain configured in AD must absolutely, positively, 100% no bullshit, be a real domain name that you actually own and will never relinquish. I'd argue they should have gone so far as WHOISing the domain name in question and failing outright if it didn't exist, and displaying the Registrant/Organization information if it did and prompting "Is this you?" before continuing. Would have saved so many sysadmins so much grief over the years. And to be clear, Foo Bar is a placeholder here, not the actual name.
davemtl 6y ago
Indeed. I've owned `invaliddomain.com` for almost 20 years. You'll be surprised how many use it for testing. One morning I woke up to 30,000 e-mails from Sony Japan with PDFs attached of scanned hand-written part orders. Something similar with Boeing sending me backup notifications. I notified each of these companies about their configuration through their official channels, only to be told "no, it's your server doing this" then usually followed up with an e-mail a few weeks later along the lines of "sorry, our bad". So, if you're testing something and using a test domain, use the IANA reserved domains, please. Theses were the days when I was running my own servers. I don't see it as often now as my e-mail is now hosted.
- chrismeller 6y ago
  Haha. That’s actually surprising, I mean that one takes some work to even type. I’ve mentioned previously on HN that I own doesnthaveone.com, which is constantly bombarded with random crap. I wish I had some big public customer data to see what other fake ones show up.
- CydeWeys 6y ago
  .app, .dev, .prod, and .zip all had substantial volume of problematic traffic that was discovered during the Controlled Interruption period (which occurs prior to launch and consists of a wildcard DNS entry placed on the entire TLD). You would not believe some of the brokenness that was happening there. .zip may need some explanation -- apparently there are lots of library API calls out there that take a path string as input and try to load it as either a local or remote file. You can see where this is going. https://www.icann.org/en/system/files/files/name-collision-framework-30jul14-en.pdf https://www.icann.org/en/system/files/files/name-collision-f...
  - monadic2 6y ago
    Ruby's `open` accepts urls. I can't say I've ever used this functionality.
    - dogma1138 6y ago
ssorallen 6y ago
Thank you, I was unaware of this. I found the relevant section in the doc that was linked from your original link: 2. TLDs for Testing, & Documentation Examples To safely satisfy these needs, four domain names are reserved as listed and described below. .test .example .invalid .localhost * ".test" is recommended for use in testing of current or new DNS related code. * ".example" is recommended for use in documentation or as examples. * ".invalid" is intended for use in online construction of domain names that are sure to be invalid and which it is obvious at a glance are invalid. * The ".localhost" TLD has traditionally been statically defined in host DNS implementations as having an A record pointing to the loop back IP address and is reserved for such use. Any other use would conflict with widely deployed code which assumes this use. https://tools.ietf.org/html/rfc2606#section-2 https://tools.ietf.org/html/rfc2606#section-2 3. Reserved Example Second Level Domain Names * example.com * example.net * example.org https://tools.ietf.org/html/rfc2606#section-3 https://tools.ietf.org/html/rfc2606#section-3
- gwright 6y ago
  I learned about .invalid last year and had an immediate use for it where we needed a syntactically valid email to match a schema but didn't want it to be deliverable. I discovered quickly that some other systems wouldn't accept the placeholder emails such as notused@email.invalid. Too many systems try to be too smart about the syntax of emails (+ subaddressing is another minefield). Had to go back to using something like notused@invalid.toplevel.com
  - sellyme 6y ago
    > + subaddressing is another minefield I'm still not sure if this is because the developers are incompetent and don't understand that they can just used an established standard instead of rolling their own janky parser, or if it's because they just don't want to let the user tell who had their databases leaked or sold their email to a spam list. I used to think the former because there's so many different solutions to the latter that don't involve actively annoying the people you're trying to extract money from, but I'm starting to think that it's a little from column A and a little from column B.
exikyut 6y ago
That just provides a "this exists and is a thing" overview, with the bulk of the information hiding in https://tools.ietf.org/html/rfc6761 https://tools.ietf.org/html/rfc6761. That's the link that qualifies special behavior for anything ending in ".test", ".localhost", ".invalid", and the set of "example.???" domains. Copy-pasting the RFC into a comment would be a bit spammy (it's three pages of hyper-specificity), so just go read that. It's quite accessible and the mechanics are useful to be aware of.
ed25519FUUU 6y ago
6tisch.arpa. [RFC-ietf-6tisch-minimal-security-15] 10.in-addr.arpa. [RFC6761] 16.172.in-addr.arpa. [RFC6761] 17.172.in-addr.arpa. [RFC6761] 18.172.in-addr.arpa. [RFC6761] 19.172.in-addr.arpa. [RFC6761] 20.172.in-addr.arpa. [RFC6761] 21.172.in-addr.arpa. [RFC6761] 22.172.in-addr.arpa. [RFC6761] 23.172.in-addr.arpa. [RFC6761] 24.172.in-addr.arpa. [RFC6761] 25.172.in-addr.arpa. [RFC6761] 26.172.in-addr.arpa. [RFC6761] 27.172.in-addr.arpa. [RFC6761] 28.172.in-addr.arpa. [RFC6761] 29.172.in-addr.arpa. [RFC6761] 30.172.in-addr.arpa. [RFC6761] 31.172.in-addr.arpa. [RFC6761] 168.192.in-addr.arpa. [RFC6761] 170.0.0.192.in-addr.arpa. [RFC8880] 171.0.0.192.in-addr.arpa. [RFC8880] 254.169.in-addr.arpa. [RFC6762] 8.e.f.ip6.arpa. [RFC6762] 9.e.f.ip6.arpa. [RFC6762] a.e.f.ip6.arpa. [RFC6762] b.e.f.ip6.arpa. [RFC6762] home.arpa. [RFC8375] example. [RFC6761] example.com. [RFC6761] example.net. [RFC6761] example.org. [RFC6761] invalid. [RFC6761] ipv4only.arpa. [RFC8880] local. [RFC6762] localhost. [RFC6761] onion. [RFC7686] test. [RFC6761]
chrisweekly 6y ago
yeah, "example.com" seems pretty sensible; it's what I've always used and recommended.
renewiltord 6y ago
Yeah, but then you use that and some fool somewhere in the pipeline has decided it's an optimization to the spec to not deliver to those addresses and so you can't even test if your email sending is working.
amenod 6y ago
Related - there are reserved IPv4 and IPv6 addresses for a similar purpose too: https://en.wikipedia.org/wiki/Reserved_IP_addresses https://en.wikipedia.org/wiki/Reserved_IP_addresses . Not just for testing, but for writing documentation and similar too.
themacguffinman 6y ago
A bit off topic, but I lament that these reserved domains are becoming less and less useful for testing web applications. I don't think you can acquire regular SSL certificates for reserved TLDs like "test.", yet an increasing number of browser features only work in "Secure Contexts" (ie. HTTPS only). Chrome treats "localhost." as a Secure Context by default, a nice convenience, but for the other reserved TLDs you have to either self-sign (a fairly complex and laborious process that doesn't necessarily work on locked down devices) or register a non-reserved domain with a regular SSL certificate that points to a test IP.
- CydeWeys 6y ago
  Yeah, because of SSL, you really do need to own at least one real domain name that you use solely for testing. You can hang a bunch of subdomains off it and run separate applications on each one, but you are gonna want a real domain name. Fortunately domains are super cheap all things considered. A .dev domain (my preference, but admittedly I'm biased) is a buck a month. If you really want to penny-pinch there's much cheaper still.
  - themacguffinman 6y ago
    For me the cost isn't the main concern, it's the name collisions. I can easily obtain a short, memorable, and descriptive domain in a reserved TLD, but I probably have to find some obscure *.dev domain name because I'm competing with the entire world. Not the end of the world, I know, but I think it kind of defeats the purpose of reserved TLDs.
    - CydeWeys 6y ago
      You'd be surprised how many short, memorable domains are still available on new gTLDs. E.g. there are several times more possible 4 letter strings than total .dev registrations that even exist. And if you're willing to use numbers this gets higher, let alone 5 characters or more.
jfroma 6y ago
I force myself to use @example.com even when the code I am writing does not send mails. This is the way I got used to it
franga2000 6y ago
Similarly, the IETF reserves 3 IPv4 /24s, an IPv6 /32 and 2 ASN ranges for that same purpose. [1] https://tools.ietf.org/html/rfc5737 https://tools.ietf.org/html/rfc5737 [2] https://tools.ietf.org/html/rfc3849 https://tools.ietf.org/html/rfc3849 [3] https://tools.ietf.org/html/rfc5398 https://tools.ietf.org/html/rfc5398 This also seems to be unknown even to some university professors, who I've seen set up lab exercises using actual CloudFlare ASNs and IPs on a simulator connected to the open Internet. Not exactly dangerous as it would obviously get filtered, but still really bad form.

walrus01 6y ago

Not just domains but IP address ranges as well. Doesn't stop lots of people from doing things like using real US DOD ipv4 /8 sized ranges for things they shouldn't.

jcims 6y ago
I and I’m guessing a few other HN readers worked for a place ~20 years ago that had a nationwide WAN and used a pirated /8 for every state.

lifthrasiir 6y ago

Note that `foo@bar.com` is frequently used to get around the email address requirement, so it is not really for testing. I wouldn't be surprised if prominent websites block any address from example.com or so.

Sharlin 6y ago
But people who know and use the words foo and bar are almost exclusively developers, so they should know better eveb when typing a fake address to a random form. But it’s easy to type reflexively, without thinking, so I’m not surprised people do it.
- CydeWeys 6y ago
  I'll be honest, even I do this when it's a form that has an email requirement but that I don't otherwise care about at all. I'm not gonna sign myself up for spam. Sometimes example.com and whatever other testing TLD that comes to mind is blocked because they want something that could plausibly be a real email address, so I give them something that could plausibly be a real email address, like asfgjklahsfgjklh@asdfoghuasfga.com
  - comfyinnernet 6y ago
    Have you tried theunabomberwasright@fbi.gov?
  - lozaning 6y ago
    That's why I own fakefakefake.email it gives me some minor pleasure to provide this email address to people who insist on having an email address for me.
    - bialpio 6y ago
      I use @mailinator.com for that purpose, it's oddly satisfying to put "lolno@mailinator.com" / etc in those places.
      - glandium 6y ago
        A lot of forms reject @mailinator.com and similar domains.
        ficklepickle 6y ago
        Then you use one of their alternate domains. Or you point a domain to one of their alternates. Check out the MX record for meowcats.fun, for example. It points to suremail.info, which points to mailinator. I have never had that domain rejected by a form. Shhh, don't tell anyone ;)
  - nitemice 6y ago
    I've been using a@b.com just because it's quick & easy to type. I just looked it up, and it seems all the single-letter .com domains are reserved, so it should be fine.
    - maven29 6y ago
      Isn't x.com owned by paypal?
- not2b 6y ago
  The fact that it is a valid address is a feature, as some sites that demand email addresses (so they can spam you) verify the address for correctness. People are intentionally choosing an address that appears valid, because it is valid. So, sorry to the guy who bought bar.com, but that's what he signed up for.
  - Sharlin 6y ago
    Correctness and existence are two different things. I doubt many sites explicitly exclude @example.com or @*.test in their email validator.
paultopia 6y ago
I usually use president@whitehouse.gov and the like...
- srtjstjsj 6y ago
  That risks getting you in trouble with Secret Service.
- samatman 6y ago
  I would steer well clear of .gov and .mil when providing fake anything. Impersonating federal agents is shockingly illegal and the authorities who enforce this have absolutely no sense of humor. The risk is low but why take it?
arendtio 6y ago
Actually, for a while I used example.com a lot and I was surprised how often it worked just fine.
rubinlinux 6y ago
I usually use postmaster@theirdomain so they can spam themselves to an address they (in theory) cannot just ignore mail to.

darkerside 6y ago

I've typically used example.com for testing, but link says it's just for documentation. Sounds like .test is the sanctioned way. https://en.m.wikipedia.org/wiki/.test https://en.m.wikipedia.org/wiki/.test

ryanbrunner 6y ago
In practice, is there any difference? As long as example.com is guaranteed to be reserved, I don't see any downside in using it. Not using .test was a big problem for tools like Pow a while ago, but that's because they were using .dev, which had no official recognition as being reserved or special-purposed. For e-mail addresses in particular, I could easily see a situation where your domain logic prevents you from using an invalid TLD (like .test), and it would be a shame to special-case something strictly for testing purposes.
- darkerside 6y ago
  Probably not, but it's always nice to follow intended designs, since others will do so as well and this allows systems to evolve in compatible ways. There may be no difference today, but there could be tomorrow. These days invalid TLDs don't really exist. New ones are getting released all the time. The only problem you'd run into is if the system you're using is treating .test differently for some reason, but that's likely not the case, for obscurity reasons if nothing else.
  - srtjstjsj 6y ago
    .invalid is guaranteed invalid by spec.
    - darkerside 6y ago
      Touche
- paledot 6y ago
  Well, example.com resolves, . test doesn't. Depending on your use case, one or the other may be desirable, but if you're setting up a dev environment, .test is your answer.

nebulous1 6y ago

A lot of people learned this the hard way when Google bought and later enabled permanent HSTS for the .dev domain (prior to actually publicly releasing it) in Chrome, breaking everybody's non https local .dev environments. As mentioned above, it should have been .test

CydeWeys 6y ago
The HSTS preloading fortunately ended up being an unintentional additional type of Controlled Interruption period, which was a good thing in the end. It would've been a lot worse if, one day, your fake domain names are resolving locally, and then literally the next day it's now a real domain name that's resolving remotely, with who knows what result. This at least forced people to address it well in advance of domain names potentially resolving globally. https://www.icann.org/resources/pages/name-collision-2013-12-06-en https://www.icann.org/resources/pages/name-collision-2013-12... https://jdebp.eu/FGA/dns-use-domain-names-that-you-own.html https://jdebp.eu/FGA/dns-use-domain-names-that-you-own.html
- owl57 6y ago
  Sounds like it could be intentional. — We bought .dev, now what we do with all those people in the wild misusing it? — Well, most of them misuse it with our browser, let's break at least their hacks early and loudly.
  - CydeWeys 6y ago
    It was unintentional. Source: The horse's mouth. I'm the guy who came up with the idea of launching .dev and .app as HTTPS-only TLDs, and I'm the one who had them added to the HSTS preload list.
    - jbrooksuk 6y ago
      Out of interest, how did this happen without any investigation into possible consequences etc? It’s a huge change that surely warranted special attention before making it happen?

TedDoesntTalk 6y ago

But I don’t see example.com listed there...

EE84M3i 6y ago
Try Ctrl+F. It's at the top.

EvanAnderson 6y ago

You also have Microsoft's list of domains / companies used in their documentation and examples: https://social.technet.microsoft.com/wiki/contents/articles/1117.list-of-fictional-companies-used-in-microsoft-material.aspx https://social.technet.microsoft.com/wiki/contents/articles/...

chrismeller 6y ago
That’s really cool. Contoso (also mentioned by someone else in this thread) and Fabrikam are the only ones I remembered off the top of my head, I had no idea they used that many.
- RedShift1 6y ago
  Northwind and Windtip
Hamuko 6y ago
Didn't Microsoft for the longest time use a domain in their documentation that they didn't own and were basically forced to buy it now?
- yesbabyyes 6y ago
  Yes, you're probably thinking of corp.com, which MS used as the default for AD setups. It went up for auction this spring and MS bought it: https://krebsonsecurity.com/2020/04/microsoft-buys-corp-com-so-bad-guys-cant/ https://krebsonsecurity.com/2020/04/microsoft-buys-corp-com-...
  - CydeWeys 6y ago
    I used to work for a company named Foo Bar Solutions with the public website foobarsol.com, but that used foobar.com for the internal AD name for some reason (which they didn't actually own). That was ... interesting. Microsoft clearly did not do their due diligence in explaining that the domain configured in AD must absolutely, positively, 100% no bullshit, be a real domain name that you actually own and will never relinquish. I'd argue they should have gone so far as WHOISing the domain name in question and failing outright if it didn't exist, and displaying the Registrant/Organization information if it did and prompting "Is this you?" before continuing. Would have saved so many sysadmins so much grief over the years. And to be clear, Foo Bar is a placeholder here, not the actual name.

davemtl 6y ago

Indeed. I've owned `invaliddomain.com` for almost 20 years. You'll be surprised how many use it for testing. One morning I woke up to 30,000 e-mails from Sony Japan with PDFs attached of scanned hand-written part orders. Something similar with Boeing sending me backup notifications. I notified each of these companies about their configuration through their official channels, only to be told "no, it's your server doing this" then usually followed up with an e-mail a few weeks later along the lines of "sorry, our bad". So, if you're testing something and using a test domain, use the IANA reserved domains, please. Theses were the days when I was running my own servers. I don't see it as often now as my e-mail is now hosted.

chrismeller 6y ago
Haha. That’s actually surprising, I mean that one takes some work to even type. I’ve mentioned previously on HN that I own doesnthaveone.com, which is constantly bombarded with random crap. I wish I had some big public customer data to see what other fake ones show up.
CydeWeys 6y ago
.app, .dev, .prod, and .zip all had substantial volume of problematic traffic that was discovered during the Controlled Interruption period (which occurs prior to launch and consists of a wildcard DNS entry placed on the entire TLD). You would not believe some of the brokenness that was happening there. .zip may need some explanation -- apparently there are lots of library API calls out there that take a path string as input and try to load it as either a local or remote file. You can see where this is going. https://www.icann.org/en/system/files/files/name-collision-framework-30jul14-en.pdf https://www.icann.org/en/system/files/files/name-collision-f...
- monadic2 6y ago
  Ruby's `open` accepts urls. I can't say I've ever used this functionality.
  - dogma1138 6y ago

ssorallen 6y ago

Thank you, I was unaware of this. I found the relevant section in the doc that was linked from your original link: 2. TLDs for Testing, & Documentation Examples To safely satisfy these needs, four domain names are reserved as listed and described below. .test .example .invalid .localhost * ".test" is recommended for use in testing of current or new DNS related code. * ".example" is recommended for use in documentation or as examples. * ".invalid" is intended for use in online construction of domain names that are sure to be invalid and which it is obvious at a glance are invalid. * The ".localhost" TLD has traditionally been statically defined in host DNS implementations as having an A record pointing to the loop back IP address and is reserved for such use. Any other use would conflict with widely deployed code which assumes this use. https://tools.ietf.org/html/rfc2606#section-2 https://tools.ietf.org/html/rfc2606#section-2 3. Reserved Example Second Level Domain Names * example.com * example.net * example.org https://tools.ietf.org/html/rfc2606#section-3 https://tools.ietf.org/html/rfc2606#section-3

gwright 6y ago
I learned about .invalid last year and had an immediate use for it where we needed a syntactically valid email to match a schema but didn't want it to be deliverable. I discovered quickly that some other systems wouldn't accept the placeholder emails such as notused@email.invalid. Too many systems try to be too smart about the syntax of emails (+ subaddressing is another minefield). Had to go back to using something like notused@invalid.toplevel.com
- sellyme 6y ago
  > + subaddressing is another minefield I'm still not sure if this is because the developers are incompetent and don't understand that they can just used an established standard instead of rolling their own janky parser, or if it's because they just don't want to let the user tell who had their databases leaked or sold their email to a spam list. I used to think the former because there's so many different solutions to the latter that don't involve actively annoying the people you're trying to extract money from, but I'm starting to think that it's a little from column A and a little from column B.

exikyut 6y ago

That just provides a "this exists and is a thing" overview, with the bulk of the information hiding in https://tools.ietf.org/html/rfc6761 https://tools.ietf.org/html/rfc6761. That's the link that qualifies special behavior for anything ending in ".test", ".localhost", ".invalid", and the set of "example.???" domains. Copy-pasting the RFC into a comment would be a bit spammy (it's three pages of hyper-specificity), so just go read that. It's quite accessible and the mechanics are useful to be aware of.

ed25519FUUU 6y ago

6tisch.arpa. [RFC-ietf-6tisch-minimal-security-15] 10.in-addr.arpa. [RFC6761] 16.172.in-addr.arpa. [RFC6761] 17.172.in-addr.arpa. [RFC6761] 18.172.in-addr.arpa. [RFC6761] 19.172.in-addr.arpa. [RFC6761] 20.172.in-addr.arpa. [RFC6761] 21.172.in-addr.arpa. [RFC6761] 22.172.in-addr.arpa. [RFC6761] 23.172.in-addr.arpa. [RFC6761] 24.172.in-addr.arpa. [RFC6761] 25.172.in-addr.arpa. [RFC6761] 26.172.in-addr.arpa. [RFC6761] 27.172.in-addr.arpa. [RFC6761] 28.172.in-addr.arpa. [RFC6761] 29.172.in-addr.arpa. [RFC6761] 30.172.in-addr.arpa. [RFC6761] 31.172.in-addr.arpa. [RFC6761] 168.192.in-addr.arpa. [RFC6761] 170.0.0.192.in-addr.arpa. [RFC8880] 171.0.0.192.in-addr.arpa. [RFC8880] 254.169.in-addr.arpa. [RFC6762] 8.e.f.ip6.arpa. [RFC6762] 9.e.f.ip6.arpa. [RFC6762] a.e.f.ip6.arpa. [RFC6762] b.e.f.ip6.arpa. [RFC6762] home.arpa. [RFC8375] example. [RFC6761] example.com. [RFC6761] example.net. [RFC6761] example.org. [RFC6761] invalid. [RFC6761] ipv4only.arpa. [RFC8880] local. [RFC6762] localhost. [RFC6761] onion. [RFC7686] test. [RFC6761]

chrisweekly 6y ago

yeah, "example.com" seems pretty sensible; it's what I've always used and recommended.

renewiltord 6y ago

Yeah, but then you use that and some fool somewhere in the pipeline has decided it's an optimization to the spec to not deliver to those addresses and so you can't even test if your email sending is working.

amenod 6y ago

Related - there are reserved IPv4 and IPv6 addresses for a similar purpose too: https://en.wikipedia.org/wiki/Reserved_IP_addresses https://en.wikipedia.org/wiki/Reserved_IP_addresses . Not just for testing, but for writing documentation and similar too.

themacguffinman 6y ago

A bit off topic, but I lament that these reserved domains are becoming less and less useful for testing web applications. I don't think you can acquire regular SSL certificates for reserved TLDs like "test.", yet an increasing number of browser features only work in "Secure Contexts" (ie. HTTPS only). Chrome treats "localhost." as a Secure Context by default, a nice convenience, but for the other reserved TLDs you have to either self-sign (a fairly complex and laborious process that doesn't necessarily work on locked down devices) or register a non-reserved domain with a regular SSL certificate that points to a test IP.

CydeWeys 6y ago
Yeah, because of SSL, you really do need to own at least one real domain name that you use solely for testing. You can hang a bunch of subdomains off it and run separate applications on each one, but you are gonna want a real domain name. Fortunately domains are super cheap all things considered. A .dev domain (my preference, but admittedly I'm biased) is a buck a month. If you really want to penny-pinch there's much cheaper still.
- themacguffinman 6y ago
  For me the cost isn't the main concern, it's the name collisions. I can easily obtain a short, memorable, and descriptive domain in a reserved TLD, but I probably have to find some obscure *.dev domain name because I'm competing with the entire world. Not the end of the world, I know, but I think it kind of defeats the purpose of reserved TLDs.
  - CydeWeys 6y ago
    You'd be surprised how many short, memorable domains are still available on new gTLDs. E.g. there are several times more possible 4 letter strings than total .dev registrations that even exist. And if you're willing to use numbers this gets higher, let alone 5 characters or more.

jfroma 6y ago

I force myself to use @example.com even when the code I am writing does not send mails. This is the way I got used to it

franga2000 6y ago

Similarly, the IETF reserves 3 IPv4 /24s, an IPv6 /32 and 2 ASN ranges for that same purpose. [1] https://tools.ietf.org/html/rfc5737 https://tools.ietf.org/html/rfc5737 [2] https://tools.ietf.org/html/rfc3849 https://tools.ietf.org/html/rfc3849 [3] https://tools.ietf.org/html/rfc5398 https://tools.ietf.org/html/rfc5398 This also seems to be unknown even to some university professors, who I've seen set up lab exercises using actual CloudFlare ASNs and IPs on a simulator connected to the open Internet. Not exactly dangerous as it would obviously get filtered, but still really bad form.