17 ms·

What domain name to use for your home network

232 points by miles 5y ago

Wowfunhappy 5y ago
> Do not use undelegated domain names like .lan, .home, .homenet, .network, nor should you make up your own domain name. ...why? My DNS server, my rules, no? Why should I feel obligated to follow ICANN? Obviously, I'll need to make changes if someone ever registers the domain with ICANN (and I want to access the ICANN version), but other than that...
- manicdee 5y ago
  The issue here being: what happens when you have your proxy configured as "proxy.lan" but you make a typo when entering it in local DNS or in your browser settings? That DNS request for "proxy.lan" will now go all the way out to the root servers for every page load, multiple times. Not so important for you with your 200 tabs open, but quite important to the people maintaining the root servers who see a significant percentage of all queries being for bogus domains that don't exist.
  - prox 5y ago
    Does this happen often? How do they mitigate this?
    - d2wa 5y ago
      They burn money on the problem.
  - rualca 5y ago
    > (...) but quite important to the people maintaining the root servers who see a significant percentage of all queries being for bogus domains that don't exist. I get the boys out rule sentiment, but isn't resolving domain names, even those that don't exist, the whole purpose of root servers? I mean, your suggestion reads like asking not to type URLs wrong because a significant percentage of requests are 404s.
    - ratsmack 5y ago
      >... even those that don't exist, the whole purpose of root servers? The root servers shouldn't be a dumping ground for unnecessary traffic when proper DNS configuration is not that difficult.
      - rualca 5y ago
        I'm not sure you're getting it. You're complaining about a scenario where there's a misconfiguration error that's totally unintentional. No one is intentionally driving traffic to domains that don't exist. In fact, of said traffic hits the root servers, odds are that the system is effectively down and not receiving the traffic it's expected to receive, and a few developers are trying to figure out what's broken.
  - Shank 5y ago
    What if you make a typo on .home.arpa? e.g., .home.arps? How is that any different?
    - d2wa 5y ago
      Because all DNS software is supposed to know that the .arpa domain name is managed by the IETF and not ICANN. Or, rather, they know not to try to resolve it. There are a handful of different .arpa domains in use, and they all require special handling from your DNS server. E.g. reverse DNS/rDNS uses in-addr.arpa., and the DNS server in even the dumbest consumer-grade router will know how to respond to requests under that domain.
      - manquer 5y ago
        that doesn't mean anything if you typo on ".arpa". No DNS hardware is smart enough to know that you meant ".arpa" not ".apra" you actually typed in. Typos are not really a valid argument, it can happen for any type of domain.
  - peanut-walrus 5y ago
    If you want to be a polite DNS resolver operator, root servers from B to G allow zone transfer, so you can just host the root zone locally. This way none of the typos or other bogus requests will leave your network.
- traceroute66 5y ago
  > My DNS server, my rules, no? That's the same line taken by network admins who think they know better than using RFC1918 IP ranges for their LAN.
  - sokoloff 5y ago
    Worked at a company which did this (dating back to when they probably figured they’d never need to connect to the net). As a satellite office and an acquisition, we played all kinds of games to try to figure out whether we should send a given IP address out to the Internet or to corporate. Apple’s IP range was entirely overlapping and of course the corporate networking group just threw up their hands and said “send it to us; the internet is not a business critical function.” This was in the early 2000s, not the early 90s.
  - Wowfunhappy 5y ago
    I'm not suggesting this would be intelligent for anything larger than your own home network!
- geofft 5y ago
  Does every single network client on your network use your DNS server for name resolution? No DNS-over-HTTPS? No widgets configured to talk to public DNS servers? Also, does your DNS server correctly filter "out"-of-bailiwick responses for .lan etc. zones that are actually perfectly well in-bailiwick because they're from the actual delegated-by-the-real-root-servers nameservers, they're just not from your private server that you've configured? If not, I can execute a cache-poisoning attack against you.
- tialaramex 5y ago
  On your network, sure. But you seem to be on our network with all of us and so here you need to obey our rules or things won't go so well for you.
  - renewiltord 5y ago
    Oh yeah? What are you going to do? Complain that you can’t run the root nameservers and try to blackhole my traffic but fail since I am DHCP configured by my ISP? Sounds like a toothless threat.
- minimaul 5y ago
  For what it's worth, this does work. For now. The main issue is if it gets sold later, or assigned by RFC. As an example, more than one company I've worked for used .dev as a TLD for their dev environments, with local DNS to override it. Once google bought .dev, this meant that: - we couldn't access anything Google put on .dev - suddenly, all of our test sites had HTTPS forced, because .dev was HSTS preloaded by Google The point here is that an unexpected change that you might not be aware is coming can break your setup in ways that are awkward to resolve - eg HSTS preloading means that you can no longer access non HTTPS endpoints unless you do it by IP and that leads to a frustrating afternoon - and it's inevitably always when you don't want it. Like it or not, ICANN operates the DNS space. There's a proper way to get your own piece of this space, and you can run home or business networks under your own piece and you have a guarantee that no one will break you - because it's yours. (edited for formatting)
  - minimaul 5y ago
    And as an extra point - can you actually guarantee that all your DNS lookups hit your DNS server first? That's harder than it sounds, with more and more apps implementing their own DNS over HTTPS clients - Firefox does it for instance, so does Chrome.
    - k4rli 5y ago
      How come DNS requests initiated from Chrome/FF still reach my pi-hole and get blocked just fine? I would think this browsers' solution would have prevented that.
    - willis936 5y ago
      If you run your own router: yes up to a certain point. https://www.myhelpfulguides.com/2018/07/30/redirect-hard-coded-dns-to-pi-hole-using-edgerouter-x/ https://www.myhelpfulguides.com/2018/07/30/redirect-hard-cod... Afaik nobody has a fix for the client hostility that DoH brings to the table.
      - Spivak 5y ago
- paranoidrobot 5y ago
  Try using something under .local and see how much fun you have. That's what a former employer had set up for their internal environments. Worked great until mDNS came along and Apple devices insisted that .local had to go through mDNS rather than our DNS servers. The Mac users had a constant stream of complaints because of it: "I can't connect to the printer", "Shared drives don't work", "I can't access the CI environment in Safari/Chrome/whatever"
  - globular-toast 5y ago
    Place I worked at set up the network using .local around 2010 when mDNS was already common. Turns out the admin had seen/heard of .local and thought that's what it was for. A little knowledge is a dangerous thing...
- d2wa 5y ago
  As long as you properly configure your server to not bother the root servers, then sure. Do what you want. But you need to set up the TLD zone in addition to your domain zone. It’s extra work.
- nucleardog 5y ago
  I'm with ya. I use `.zz`. It's short, easy to type, and in order for that to be assigned out, we'd need an entirely new country to be created (one that decided the other bazillion free CCTLDs are not to their liking). And like you say, I only run into a problem if I decide I want to access things from said country. Would I do this in any professional setting? Absolutely not. For my own stuff at home? The risk is pretty minimal and the work involved in updating if I ever have to is not too bad. DHCP automatically registers everything under <hostname>.zz, and I cname well-known things from <thing>.svc.zz to the appropriate hostname so I can hit, e.g., `blueiris.svc.zz` or `homeassistant.svc.zz`. For SSL I just run my own CA.
  - Symbiote 5y ago
    You can use ZZ freely, as it's an ISO 3166 code reserved for private use. AA, QM to QZ and XA to XZ are also reserved.
    - pwdisswordfish8 5y ago
      Not exactly. The RFC that would make it safe is draft status, and the draft is set to expire in <2 months and does not come off as particularly confident itself: https://tools.ietf.org/id/draft-ietf-dnsop-private-use-tld-01.txt https://tools.ietf.org/id/draft-ietf-dnsop-private-use-tld-0... > are thought to be plausible choices for the implementation of private namespaces
      - tremon 5y ago
        The RFC may expire, but it quotes the ISO3166 guidelines as to why .zz is safe for personal use. Those guidelines will not change because of this draft: [ISO3166 clause 8.1.3] "User assigned code element": "If users need code elements to represent country names not included in this part of ISO 3166, the series of letters AA, QM to QZ, XA to XZ, and ZZ, and the series AAA to AAZ, QMA to QZZ, XAA to XZZ, and ZZA to ZZZ respectively and the series of numbers 900 to 999 are available."
        5y ago
- unraveller 5y ago
  I briefly considered their advice and am now using the-com-remote-home8080-amail.local.fu why? because it Further Upsets authoritarians. To pick your own free TLD just run a nameserver check against the TLD on [1] and watch out for TLDs that hit root servers [1] https://dns.google/resolve?micro.soft&type=NS https://dns.google/resolve?micro.soft&type=NS
PostThisTooFast 5y ago
Interesting, but I don't understand how to set this up. If I go into my router's admin pages (it's a Ubiquiti EdgeRouterX), then Services, then DNS... the only options are: DNS Forwarding Cache size Interface (currently set to Switch0) Dynamic DNS (Add DDNS interface) Now what?
dmd 5y ago
In similar news, do not use "dev.host", because someone owns it[0] and can and will do increasingly hilarious things to your traffic. [0] me
- adjkant 5y ago
  Good boy: https://dev.host/~shmup/thot/2017/IMG_3091.JPG https://dev.host/~shmup/thot/2017/IMG_3091.JPG
traceroute66 5y ago
The blog post misses the (controversial if you're one of the ex-applicants) decision by ICANN to ban .corp, .home and .mail from ever appearing on the internet. So you've got those options too. Or in ICANN management-speak: "Whereas, the Board considered that the applicants were not aware before the application window that the strings .CORP, .HOME, and .MAIL would be identified as high-risk, and that the delegations of such high-risk strings would be deferred indefinitely." [1] [1]https://features.icann.org/addressing-new-gtld-program-applications-corp-home-and-mail https://features.icann.org/addressing-new-gtld-program-appli...
- zamadatix 5y ago
  "to be not assigned" is generally less safe than "assigned for local use". E.g. 1.1.1.0/24 was first held back too see if bogus traffic would decreased then a ssigned for research purposes then assigned for cloudflare DNS causing a lot of grief for corporate networks that used 1.1.1.1 or 1.1.1.2 for network clustering or portal gateways instead of ones explicitly assigned for internal use.
  - traceroute66 5y ago
    >"to be not assigned" is generally less safe than "assigned for local use" Normally I would agree. But in this case, 5 years (2018-2013), a $185,000 refund, high-profile media coverage and an explicit "deferred indefinitely" statement later ? I don't think any of us will see .CORP, .HOME and .MAIL on the internet in our lifetimes !
- twobitshifter 5y ago
  It actually mentioned .home as something not to use (along with .lan and.homenetwork)
  - CRConrad 5y ago
    Maybe the GP meant "missed" as in "was wrong about". [EDIT:] (I'm not saying it is; just that GP may think so.) [/EDIT]
- 5y ago
vbezhenar 5y ago
IMO the best approach is to register somedomain.com and use its subdomains. It’s guaranteed not to interfere with anything, you can get LE certificate, you can make it available from the Internet if necessary.
- fsckboy 5y ago
  somedomain.com is not guaranteed not to interfere! example.com is guaranteed not to interfere (and example.org) http://www.iana.org/domains/reserved http://www.iana.org/domains/reserved
  - thundermuffin 5y ago
    I believe you took their post too literally; they mean to go register some domain you would like to have (such as ilovemycoolhouse.com or bearinabigblue.house) and use it, because the only way it will ever interfere with something is if you cause it to.
    - inetknght 5y ago
      I hope you never forget to renew that registration...
      - thundermuffin 5y ago
        I agree! It always boggles my mind how people and companies can forget to renew their domain names when you receive so many email reminders now a days.
        manquer 5y ago
        It is quite easy, the original owner/ responsible PoC left long ago, or the email goes to an barely read inbox/ group or bounces completely. If a task only recurs less frequently like say every 3-5 years, it is more likely to be forgotten it is the same whether it is individual or companies.
flemhans 5y ago
What if it's an office building?
- geofft 5y ago
  Buy a real domain name and use that. It is probably cheaper than a single square foot of office space. (This can either be your normal domain name that you already have, using split DNS to make more things resolve on the internal network, or an entirely separate domain name, whichever is operationally easier for you.)
  - flemhans 5y ago
    But homes could do that too. I bet many homes have more money for domain names than some shops/offices. Just wondering why they didn't call it 'localnet' or some other unused synonym for local.
jitl 5y ago
I use cozy.systems
johnchristopher 5y ago
What about .localhost? Asking for a friend.
- d2wa 5y ago
  That is actually another special-use domain name that is supposed to be resolved by the local stub resolver to 127.0.0.1 and ::1. It’s not suitable for use on your local network, however.
  - pwdisswordfish8 5y ago
    It’s supposed to be resolved to a loopback address. Chrome forces it to 127.0.0.1, because Google knows better than you. Obviously. <https://bugs.chromium.org/p/chromium/issues/detail?id=489973 https://bugs.chromium.org/p/chromium/issues/detail?id=489973>
- francislavoie 5y ago
  Works great for things you run on the same machine, less-so for LAN.
  - deleted 5y ago
    [deleted]
WalterBright 5y ago
"pennygetyourownwifi" works for me.
davemtl 5y ago
I use a sub-domain of a domain I registered. For example, I use in.[myname].ca.
rootusrootus 5y ago
I just use a real domain name, so I can easily obtain LE certs. Only the internal DNS server will actually return internal addresses.
- sigjuice 5y ago
  A real domain name is the way to go. The convenience of using LE wildcard certificates is huge. However, running split-horizon DNS is not straightforward, at least in a home setting. I don't see a huge problem with putting a couple of internal addresses in external DNS servers. lexicon cloudflare --auth-token $(gopass cloudflare) create my-real-domain.xyz A --name my-rpi --content 192.168.1.201
  - jeroenhd 5y ago
    You don't necessarily need a split-horizon DNS. You only need a few records for the LE wildcard certificate to renew. In fact, DNS-01 only seems to require a single TXT record to resolve. In theory you could set up a small home server or dev machine script that pulls in a wildcard certificate and let all the real A/AAAA queries go to your LAN DNS server (or resolve through mDNS!). A record that doesn't resolve in global DNS won't usually cause much trouble in local DNS either. Putting internal IP addresses in your DNS could pose problems for (small) companies using this trick (because it allows hackers to map out your network) and it could cause confusion (when systems reverse-lookup domains and suddenly a spoofed 10.0.0.1 address is shown as myfunkyservice.sigjuice.xyz in the log files). The issues are minor and unlikely to be a problem, but they're there to serve as footguns years down the line.
    - sigjuice 5y ago
      I didn't say split-horizon DNS is needed for getting LE certs. Just that a real domain name is a requirement to obtain LE certs in the first place. How will an A/AAAA query from something like https://my-rpi.my-real-domain.xyz https://my-rpi.my-real-domain.xyz resolve using mDNS? All DNS queries go to my LAN DNS server by default. I don't particularly care that I can't create A/AAAA records on my LAN DNS server (which is a Time Capsule, btw) to keep the queries inside. To me, the potential leakage of internal addresses/names is an acceptable tradeoff for the convenience. Btw, how is a reverse DNS lookup ever going to do what you mention? I am not creating any PTR records anywhere.
swiley 5y ago
I just set static IPs for important things and put them in my domain. There's also MDNS although most of the MDNS responders are pretty fat for what they do. I tried hacking some basic MDNS stuff into busybox a few years ago but never cleaned it up and sent a patch.
karmanyaahm 5y ago
I use homenet.<my lastname>.tld
j1elo 5y ago
> Your time is better spent ensuring all your devices support mDNS resolution Heh. I starred this Android feature request and kind of regret it because it's been a continuous stream of "+1" emails (but I want to stay subscribed in case some meaningful conversation happens at last): https://issuetracker.google.com/issues/140786115 https://issuetracker.google.com/issues/140786115 (A login is required; any Google account will do)
- CRConrad 5y ago
  Starred (not +1'd).
- yrro 5y ago
  I wonder which Android will support first, MDNS or DHCPv6?
xcskier56 5y ago
This is a complete tangent, but does anyone else really hate white text on black background? After reading only a few lines my eyes hurt and I have ghosting where the lines were when I look away. Websites like this one are basically unusable for me
- thrownaway810 5y ago
  I think it’s a device issue for you. My device sees it as black text on a white background.
- frosted-flakes 5y ago
  Turn off dark mode in your system settings if you don't want dark mode. It's black-on-white in light mode.
jeroenhd 5y ago
Honestly, just spend the five bucks a year and reserve a real domain name with auto renew. You don't need to make it publicly resolvable, but you'll be 100% sure all of your internal service names won't ever conflict with anything used in the real world. If you pick the right registrar, you can easily get your hands on a wildcard DNS cert as well through Let's Encrypt, so you can protect your internal services with HTTPS! You don't suddenly want to be restricted to HTTPS only (i.e. when Google bought .dev). There's also the minor risk of someone eventually buying your domain and causing all kinds of funky hell, like setting proxies to your internal network (through WPAD) and the names of local services (printer, router, etc.) being queried to a real DNS server because your computer sometimes appends the domain name to TLD-less queries. I've seen it happen that someone set something like example.com as their local domain (including in the DHCP config) who then saw constant slowdowns as their browser tried to resolve http://local-service/ http://local-service/ as http://local-service.example.com/ http://local-service.example.com/, going out to the internet every time, and not caching the error response.
- bb88 5y ago
  I'm not saying your wrong, but frankly, it's 2021, and it should be a lot easier than this to set up hosts internally for home use. We've largely had the internet broadly for the last 25 years, and the average person should not have to be an expert on wildcard certs/DNS/zeroconf if they want to just have a server running locally. In fact, that's part of the reason things have gone to the cloud, because what should be local internet style appliances (think of a media server that you just plug in and works with your stereo/tv) can't find each other easily -- all because you can't resolve a freakin name on the local DNS without setting up bonjour or your own DNS server.
  - milofeynman 5y ago
    You could just create your own cert and add it to all of your devices, I suppose
    - bb88 5y ago
      That doesn't work for certain devices, TV's/IoT devices, etc.
ill0gicity 5y ago
My solution was to use a single domain for everything, with different locations broken out under their own subdomains. My colocated rack is "fmt2". VPSs are under normal IATA 3-letter codes. Homes, not just mine, are under "<STREET_NUMBER><STREET_NAME_INITIAL>". Internal services available for all homes are under "int". And so on. There are a bunch of reserved names under each to provide consistent access to per-location devices and services... "network" for a jump-off point to other devices, "edge<N>" for internet-connected routers, "sw<N>" for switches, "svc<N>" for per-location services (Wireguard, DNS, DHCP, NTP, LDAP, RADIUS, BIRD, HTTP/HTTPS, Home Assistant, Home Bridge), "ap<N>" for access points, "print<N>" for document printers, "fdm<N>" for 3D printers, ad nauseum. It's worked great to keep things organized. It also simplifies certificates since I can use wildcards.
- philsnow 5y ago
  I had set up some minecraft servers in my k8s homelab behind a proxy that routes clients to the right server depending on the domain name they're connecting to. Everything inside the k8s homelab uses subdomains of k.myvanitydomain.com. The minecraft proxy is at mc.k.myvanitydomain.com. So, to connect to the "valinor" minecraft server, it's just valinor.mc.k.myvanitydomain.com. Dead simple (to me). I tried explaining that to my kids and suddenly I knew what it was like for whoever explained to me the whole /ls/<chubby_cell>/borg/<borg_cell>/bns/<mdb_user>/<job_name>/<index> setup from google prod
SavantIdiot 5y ago
Weird, my Linksys WRT1900AC applies `.home` to its local DNS, but this article says not to?
- d2wa 5y ago
  Don’t use the .home domain. It was mistakenly recommended in RFC 7788. But that RFC was updated by RFC 8375 recommending the home.arpa domain. (RFCs are published by the IETF who manages the .arpa TLD. That’s one of the few TLDs not managed by ICANN for historical reasons. The .home TLD falls under ICANN’s root domain, so the RFC shouldn’t have assigned it.)
  - SavantIdiot 5y ago
    Ah, thanks. Oddly, it is the default and the current firmware won't let me change it.
theteapot 5y ago
What's wrong with .localdomain? Or is that for something else??
- d2wa 5y ago
  It’s an unassigned top-level domain. So, don’t use it. Some Linux distributions erroneously resolve it to 127.0.0.1, but there’s no RFC or consensus around this TLD.
  - theteapot 5y ago
    Jeez, all this time :/. Thanks.
scolby33 5y ago
I truly do not understand why this problem has gone on for so long. It's clear that many people think `.home.arpa` is ugly. It boggles my mind that the IETF and ICANN can't come up with some agreement to get `.home` or something similar codified like RFC 7788 tried to do. This just seems like a fight between giant bureaucracies while meanwhile the users suffer and bad decisions like assigning `.dev` are made. I get that there are rules around this sort of critical infrastructure and its management, but come ON. /rant With the rant ended: can anyone explain to me why all the relevant organizations can't get together and assign a TLD for this purpose that doesn't end in `.arpa`?
- pwdisswordfish8 5y ago
  Delegating .dev was fine. Sick of hearing about this. As the meme goes, "well, well, well, if it isn't the consequences of my own actions." Everyone who got burned by .dev got what they deserve and needs to grow up already, take responsibility for themselves, and get over it.
  - labawi 5y ago
    Delegating .dev was not fine. Does everything need to be for rent? The name system is a unique non-renewable resource. And it's not like ICANN gave people a lot of choice for unregistered domains. By your logic, I suppose .onion was not fine either, till cca 2015 when it got special-use status? And all the name system alternatives should be abolished, because we need to rent their TLDs to some uninterested party?
    - pwdisswordfish8 5y ago
      > I suppose .onion was not fine either, till cca 2015 when it got special-use status? You are correct.
lttlrck 5y ago
No mention of .internal https://datatracker.ietf.org/doc/html/draft-wkumari-dnsop-internal-00 https://datatracker.ietf.org/doc/html/draft-wkumari-dnsop-in... (Though maybe it's not a great name for this particular application, it seems to make a lot of sense for enterprise level infrastructure)
- reaperducer 5y ago
  I tried to get my company's IT department to put my latest project on a .internal domain. They wouldn't go for it, even though it can and will only be used by people internally. They bound it to a sub domain of the company's main web site claiming that Microsoft (maybe something with Active Directory? Or Azure?) doesn't support any domains that you don't actually own. I wouldn't be surprised if this is false because the people in charge of the domains think GoDaddy is awesome. Would love to hear an HN expert tell me if they're full of crap or not.
  - xorcist 5y ago
    While it is certainly possible that a Microsoft-managed network places additional restrictions on what addresses are used, there are several good reasons to not to create unique "snowflake" situations for individual applications. There might be silent assumptions everywhere what domain addresses answer to, in log collection, in monitoring, in address management tools. Simple things like domain search strings becomes harder. Any non trivial enterprise is going to have a ton of these (semi-)automated tools that your address will end up in. It also carries the risk of complicating future work. The company might merge with another company. Or imagine a mandate where all communication will need to switch to TLS, only to discover there are addresses used under other domains internally.
- rdpintqogeogsaa 5y ago
  That's an Internet Draft, not a standard or even at least a published RFC. An Internet Draft cannot be used Internet-Drafts as reference material or cited as anything other than "work in progress." There are some more reserved domains in RFC 6761 (https://datatracker.ietf.org/doc/html/rfc6761 https://datatracker.ietf.org/doc/html/rfc6761) though: - .test (Application software SHOULD NOT recognize test names as special, and SHOULD use test names as they would other domain names. [...] Caching DNS servers SHOULD recognize test names as special and SHOULD NOT, by default, attempt to look up NS records for them, or otherwise query authoritative DNS servers in an attempt to resolve test names. Instead, caching DNS servers SHOULD, by default, generate immediate negative responses for all such queries.) - .localhost (Users are free to use localhost names as they would any other domain names. Users may assume that IPv4 and IPv6 address queries for localhost names will always resolve to the respective IP loopback address.) - .invalid (Users are free to use "invalid" names as they would any other domain names. Users MAY assume that queries for "invalid" names will always return NXDOMAIN responses. Name resolution APIs and libraries SHOULD recognize "invalid" names as special and SHOULD always return immediate negative responses. Name resolution APIs SHOULD NOT send queries for "invalid" names to their configured caching DNS server(s).) - .example, .example.com, .example.net (Users SHOULD understand that example names are reserved for use in documentation.) Unfortunately, none of these address the same needs as .internal would.
livinginfear 5y ago
What method are people using to configure this oin their own network? The router supplied by my ISP doesn't support using a custom DNS server like a pihole, unfortunately. I don't consider using /etc/hosts a longterm worthwhile solution. I'd love to find another useful way of setting this up.
- nine_k 5y ago
  I was lucky enough to ask my ISP to set their box to bridge mode and have my request granted, then attached my own router.
  - livinginfear 5y ago
    I just looked, and my router does indeed support bridged mode. That might be my answer. Thanks for pointing this out!
- jannes 5y ago
  Does your router support disabling DHCP? You can just run your own DHCP server in that case.
  - KozmoNau7 5y ago
    That's what I do, even though I run my own router. The pi-hole acts as both DNS and DHCP. It sets the DNS domain correctly via DHCP, unlike a lot of routers.
  - livinginfear 5y ago
    It does. I might go with this option. It seems like it'll be easier than running the router in bridged mode, and adding another physical router.
aussieguy1234 5y ago
An interesting trick I discovered is that you can make a public domain point to a local IP. So I could make foo.mylocal.com point to 127.0.0.1 or the printer, or anything else really.
pininja 5y ago
For those curious about the (spoiler) .arpa domain, here’s an RFC https://www.rfc-editor.org/rfc/rfc3172 https://www.rfc-editor.org/rfc/rfc3172
ComputerGuru 5y ago
I think it’s safe to assume that the one gtld ICANN will never sign off on - even if they sell .home, .lan, and everything else - is .icann So if they won’t give us a tld to use, just use that :)
- nsgi 5y ago
  What if they start using it?
- d2wa 5y ago
  .dev comes to mind.
pwdisswordfish8 5y ago
> Do not use undelegated domain names like .lan OpenWRT: *glances aside nervously*
- citrin_ru 5y ago
  .lan should be OK, it has no it’s own RFC, but it is a reserved domain nevertheless: https://datatracker.ietf.org/doc/html/rfc6762#appendix-G https://datatracker.ietf.org/doc/html/rfc6762#appendix-G
  - pwdisswordfish8 5y ago
    > We do not recommend use of unregistered top-level > domains at all, but should network operators decide to do this, the > following top-level domains have been used on private internal > networks without the problems caused by trying to reuse ".local." for > this purpose: This is hardly ‘reserved’. It just describes existing practice without in any way designating it as safe, recommended or future-proof.
    - labawi 5y ago
      It's fine as long as people keep using it.
8fingerlouie 5y ago
I use NextDNS, so in the configuration for my LAN devices i have rewrites that maps host.somewhere.com to 192.168.x.x. The external DNS maintains a single host record for VPN access, and since NextDNS also handles external requests, i have to set different hostnames for internal/external access. It's (probably not) optimal, but it works. It was pretty much the same approach i used with PiHole/AdGuard Home. Edit: To allow multiple hostnames i use a wildcard certificate from LetsEncrypt, though once i'm connected through VPN it doesn't matter much as it will resolve the internal hostname just fine.
cookiengineer 5y ago
I have to chime in here now and call the article what it is: wrong at least in regards to misinformation about ".local". > DNS clients may defer the resolution of .local spTLDs to the system’s mDNS resolvers instead of its DNS resolver. This is not true. First off: You can always misconfigure your DNS resolver, but usually they can be used in parallel. Multicast DNS usually is only used when your router is too stupid to manage the hostname; and if multicast DNS is active on every host, then it's a setting that fixes even that broken router. Also, "hostname.local" will never conflict with DNS based service discovery [1] of resolving a host via multicast DNS. And even if so, you can just use one of the other reserved multicast addresses and be done with it. As long as you don't use e.g. "._tcp." or "._udp." inside your hostname, you never have domain name conflicts. I think there's also a huge misconception about what DNS-based service discovery is. In DNS-SD, there are questions to a service identifier with a PTR inside, and the response contains A,AAAA,SRV and TXT entries to describe everything you need to know to make a connection to the correct host, ip, port and version of the service. Airprint, airplay, airscan and others additionally use their service name as a prefix in regards to the IANA-registered service names [2] so printers, scanners and other Multicast-DNS compatible hardware never conflicts with the existing network. /ragecomment Personally, I would actually embrace the use of .local, because it allows you to build a self-discovery service that is unrelated to DHCP and unrelated to ARP mechanisms, and works peer-to-peer; as long as the IPs are in the same NAT or, with IPv6/UDP6, have at least one discoverable scope. In DNS-SD, you literally just have to be able to reach other IPs, and you have a working handshake mechanism to discover other devices without having to know their hostnames, IPs, or anything. It's pretty amazing once you realize its network automation potential. Source: Me, building a web browser that uses peer-to-peer TLS encryption on "username._stealth._tcp.tholian.network" and "username._stealth._tcp.tholian.local" [3] [1] https://www.ietf.org/rfc/rfc6763.txt https://www.ietf.org/rfc/rfc6763.txt [2] http://dns-sd.org/ServiceTypes.html http://dns-sd.org/ServiceTypes.html [3] https://github.com/tholian-network/stealth https://github.com/tholian-network/stealth
sko- 5y ago
This still won't fix the bat-shit-stupid idea of browser developers to just forward anything they think is not resolvable (and often even if it IS a valid local FQDN) to the next best search engine...
- Joker_vD 5y ago
  IIRC all browsers try to perform name resolution if you append "/" at the end of your input in the address bar. After that fails they redirect to a search engine, but not before.
- d2wa 5y ago
  Well, browsers do a very sensible thing of attempting to anything that is a valid domain names. For everything else, including undelegated (and therefore unresolvable) top-level domains get passed on as search queries. Forwarding as much traffic to search engines is how they make money, after all. If you don’t like it, stick to valid domains.
r1ch 5y ago
For all the things saying not to use it, I've not run in to any issues with .local. It's reserved so it won't be delegated on the internet, it makes sense as a word and mDNS continues to work correctly. So far I haven't seen any devices that try to resolve over mDNS instead of DNS.
PostThisTooFast 5y ago
Yeah, thanks for the insight, "bros."
Annatar 5y ago
"Do not use undelegated domain names like .lan, .home, .homenet, .network, nor should you make up your own domain name." But it doesn't explain why, and what the mechanism behind that statement is. I configured my internal DNS servers on my home network to be root top level domain servers for a made-up .tld. Why wouldn't that work? Don't know, because the author does not explain the mechanism in detail. As far as I can see for the past 15 years, having configured the internal DNS servers to be root top level domain name servers works like a charm, with no observed ill- or side-effects.
NDizzle 5y ago
There is a .casa TLD that you can use. It’s inexpensive to register, too.
KaiserPro 5y ago
This isn't networking advice, but its what I've done either professionally and for home in some limited cases. For fee paying networks, the "router" will most likley be in charge of some sort of DNS. If thats the case its made canonical for a subdomain that one owns. If you're lazy, just plain split horizon. However limit it strictly to DHCP. As soon as you start re-writing public services, you're sunk. Side note, its a really good time to start putting in location data into subdomains. using option 60(might not be this, its been a while) you can work out what switch the request came from and add a different subdomain based on that you can make subdomains like server01.rack3.datacenter.country.company.com. this allows you to make search params to create local services. ie "time" would first check rack3, then datacenter, then country, then company.
- KaiserPro 5y ago
  also my home domain name is "phartiphuckballs.com"
SeaWhales1000 5y ago
For us laymen, why would you need/want a domain name for a home network?
- d2wa 5y ago
  So you don't need to memorize and hard-code IP addresses for your network services. * router.home.arpa * nas.home.arpa * printer.home.arpa * htpc.home.arpa
  - filomeno 5y ago
    Yes, but that can be achieved by using a hostname alone (router, nas, printer, htpc...). What does the domain bring?
    - hda111 5y ago
      Prevent collision with public domains. “ws” has an A record. It’s possible that your local Webserver also is named ws. With all new gTLDs it’s easy to have a collision when someone buys the “router” TLD.
    - d2wa 5y ago
      How, exactly, is that hostname being resolved, though? There is no magical protocol to resolve TLD-less hostnames in DNS. Your router probably adds entries for `hostname.dhcp-domain` but since `dhcp-domain` is empty, you end up with just `hostname`. No, go ahead and name a device `com` and see what happens. Your router will have a hard time resolving `example.com`. This is why you put your stuff behind apurpose-built TLD like `home.arpa.`
      - WorldMaker 5y ago
        In some cases today that hostname is being resolved via mDNS, which is a good reason to get into the habit of using .local for mDNS addresses. Using somehostname.local on many OSes today forces DNS lookups to always and only use mDNS and avoids accidentally calling DNS. (So long as you don't break mDNS support on your local network by doing something like trying to use .local for traditional DNS.) mDNS is probably sufficient for most people and you don't need to setup old school DNS on a local network. (But if you do, a purpose-built TLD like home.arpa is a good choice.)
crmrc114 5y ago
Just tossing this out there- apple only claimed .local in rfc as of 2013. There are plenty of 'legacy' production environments that I support that still use .local without issue with mac clients. Its possible there would be a collision- but in practice the pain point is not enough concern for many with the limited subset of apple devices on their corporate networks. Still pissed that apple was straight up allowed to usurp that tld instead of something like .mdns.local or .autoconf Also, please dont use .com/net/org for local networks. All you are going to do is punish yourself when you go to setup you AD domain. However if you want to setup a subdomain that you are willing to make the AD server authoritative for you may end up with less pain. If you have to use your own domain keep in mind that if you go to setup AD in your home/lab/small biz you will need to add records for your webserver/mailserver etc since AD will want to be the authoritative dns server for its domain. There are ways around this, but I digress. Using a public tld can cause pain, just be aware of that.
atsmyles 5y ago
I use .lan and will continue to do so. .home.arpa is fine for 1 lan, but if you want to connect to multiple lans, it no longer works well. Add to the fact the amount of typing. .lan should be reserved so that people can use it for addressing multiple local area networks. We already have .local for mDNS which is perfect for the single lan setup. If they won't do it de jure, then users like myself will make this standard de facto.
otterpro 5y ago
Can't we use .test and .example as well? They are reserved for testing locally, and although it sounds weird, ie nas.test, it will work. * [rfc6761](https://datatracker.ietf.org/doc/html/rfc6761 https://datatracker.ietf.org/doc/html/rfc6761)

232 points by miles 5y ago

> Do not use undelegated domain names like .lan, .home, .homenet, .network, nor should you make up your own domain name. ...why? My DNS server, my rules, no? Why should I feel obligated to follow ICANN? Obviously, I'll need to make changes if someone ever registers the domain with ICANN (and I want to access the ICANN version), but other than that...

manicdee 5y ago
The issue here being: what happens when you have your proxy configured as "proxy.lan" but you make a typo when entering it in local DNS or in your browser settings? That DNS request for "proxy.lan" will now go all the way out to the root servers for every page load, multiple times. Not so important for you with your 200 tabs open, but quite important to the people maintaining the root servers who see a significant percentage of all queries being for bogus domains that don't exist.
- prox 5y ago
  Does this happen often? How do they mitigate this?
  - d2wa 5y ago
    They burn money on the problem.
- rualca 5y ago
  > (...) but quite important to the people maintaining the root servers who see a significant percentage of all queries being for bogus domains that don't exist. I get the boys out rule sentiment, but isn't resolving domain names, even those that don't exist, the whole purpose of root servers? I mean, your suggestion reads like asking not to type URLs wrong because a significant percentage of requests are 404s.
  - ratsmack 5y ago
    >... even those that don't exist, the whole purpose of root servers? The root servers shouldn't be a dumping ground for unnecessary traffic when proper DNS configuration is not that difficult.
    - rualca 5y ago
      I'm not sure you're getting it. You're complaining about a scenario where there's a misconfiguration error that's totally unintentional. No one is intentionally driving traffic to domains that don't exist. In fact, of said traffic hits the root servers, odds are that the system is effectively down and not receiving the traffic it's expected to receive, and a few developers are trying to figure out what's broken.
- Shank 5y ago
  What if you make a typo on .home.arpa? e.g., .home.arps? How is that any different?
  - d2wa 5y ago
    Because all DNS software is supposed to know that the .arpa domain name is managed by the IETF and not ICANN. Or, rather, they know not to try to resolve it. There are a handful of different .arpa domains in use, and they all require special handling from your DNS server. E.g. reverse DNS/rDNS uses in-addr.arpa., and the DNS server in even the dumbest consumer-grade router will know how to respond to requests under that domain.
    - manquer 5y ago
      that doesn't mean anything if you typo on ".arpa". No DNS hardware is smart enough to know that you meant ".arpa" not ".apra" you actually typed in. Typos are not really a valid argument, it can happen for any type of domain.
- peanut-walrus 5y ago
  If you want to be a polite DNS resolver operator, root servers from B to G allow zone transfer, so you can just host the root zone locally. This way none of the typos or other bogus requests will leave your network.
traceroute66 5y ago
> My DNS server, my rules, no? That's the same line taken by network admins who think they know better than using RFC1918 IP ranges for their LAN.
- sokoloff 5y ago
  Worked at a company which did this (dating back to when they probably figured they’d never need to connect to the net). As a satellite office and an acquisition, we played all kinds of games to try to figure out whether we should send a given IP address out to the Internet or to corporate. Apple’s IP range was entirely overlapping and of course the corporate networking group just threw up their hands and said “send it to us; the internet is not a business critical function.” This was in the early 2000s, not the early 90s.
- Wowfunhappy 5y ago
  I'm not suggesting this would be intelligent for anything larger than your own home network!
geofft 5y ago
Does every single network client on your network use your DNS server for name resolution? No DNS-over-HTTPS? No widgets configured to talk to public DNS servers? Also, does your DNS server correctly filter "out"-of-bailiwick responses for .lan etc. zones that are actually perfectly well in-bailiwick because they're from the actual delegated-by-the-real-root-servers nameservers, they're just not from your private server that you've configured? If not, I can execute a cache-poisoning attack against you.
tialaramex 5y ago
On your network, sure. But you seem to be on our network with all of us and so here you need to obey our rules or things won't go so well for you.
- renewiltord 5y ago
  Oh yeah? What are you going to do? Complain that you can’t run the root nameservers and try to blackhole my traffic but fail since I am DHCP configured by my ISP? Sounds like a toothless threat.
minimaul 5y ago
For what it's worth, this does work. For now. The main issue is if it gets sold later, or assigned by RFC. As an example, more than one company I've worked for used .dev as a TLD for their dev environments, with local DNS to override it. Once google bought .dev, this meant that: - we couldn't access anything Google put on .dev - suddenly, all of our test sites had HTTPS forced, because .dev was HSTS preloaded by Google The point here is that an unexpected change that you might not be aware is coming can break your setup in ways that are awkward to resolve - eg HSTS preloading means that you can no longer access non HTTPS endpoints unless you do it by IP and that leads to a frustrating afternoon - and it's inevitably always when you don't want it. Like it or not, ICANN operates the DNS space. There's a proper way to get your own piece of this space, and you can run home or business networks under your own piece and you have a guarantee that no one will break you - because it's yours. (edited for formatting)
- minimaul 5y ago
  And as an extra point - can you actually guarantee that all your DNS lookups hit your DNS server first? That's harder than it sounds, with more and more apps implementing their own DNS over HTTPS clients - Firefox does it for instance, so does Chrome.
  - k4rli 5y ago
    How come DNS requests initiated from Chrome/FF still reach my pi-hole and get blocked just fine? I would think this browsers' solution would have prevented that.
  - willis936 5y ago
    If you run your own router: yes up to a certain point. https://www.myhelpfulguides.com/2018/07/30/redirect-hard-coded-dns-to-pi-hole-using-edgerouter-x/ https://www.myhelpfulguides.com/2018/07/30/redirect-hard-cod... Afaik nobody has a fix for the client hostility that DoH brings to the table.
    - Spivak 5y ago
paranoidrobot 5y ago
Try using something under .local and see how much fun you have. That's what a former employer had set up for their internal environments. Worked great until mDNS came along and Apple devices insisted that .local had to go through mDNS rather than our DNS servers. The Mac users had a constant stream of complaints because of it: "I can't connect to the printer", "Shared drives don't work", "I can't access the CI environment in Safari/Chrome/whatever"
- globular-toast 5y ago
  Place I worked at set up the network using .local around 2010 when mDNS was already common. Turns out the admin had seen/heard of .local and thought that's what it was for. A little knowledge is a dangerous thing...
d2wa 5y ago
As long as you properly configure your server to not bother the root servers, then sure. Do what you want. But you need to set up the TLD zone in addition to your domain zone. It’s extra work.
nucleardog 5y ago
I'm with ya. I use `.zz`. It's short, easy to type, and in order for that to be assigned out, we'd need an entirely new country to be created (one that decided the other bazillion free CCTLDs are not to their liking). And like you say, I only run into a problem if I decide I want to access things from said country. Would I do this in any professional setting? Absolutely not. For my own stuff at home? The risk is pretty minimal and the work involved in updating if I ever have to is not too bad. DHCP automatically registers everything under <hostname>.zz, and I cname well-known things from <thing>.svc.zz to the appropriate hostname so I can hit, e.g., `blueiris.svc.zz` or `homeassistant.svc.zz`. For SSL I just run my own CA.
- Symbiote 5y ago
  You can use ZZ freely, as it's an ISO 3166 code reserved for private use. AA, QM to QZ and XA to XZ are also reserved.
  - pwdisswordfish8 5y ago
    Not exactly. The RFC that would make it safe is draft status, and the draft is set to expire in <2 months and does not come off as particularly confident itself: https://tools.ietf.org/id/draft-ietf-dnsop-private-use-tld-01.txt https://tools.ietf.org/id/draft-ietf-dnsop-private-use-tld-0... > are thought to be plausible choices for the implementation of private namespaces
    - tremon 5y ago
      The RFC may expire, but it quotes the ISO3166 guidelines as to why .zz is safe for personal use. Those guidelines will not change because of this draft: [ISO3166 clause 8.1.3] "User assigned code element": "If users need code elements to represent country names not included in this part of ISO 3166, the series of letters AA, QM to QZ, XA to XZ, and ZZ, and the series AAA to AAZ, QMA to QZZ, XAA to XZZ, and ZZA to ZZZ respectively and the series of numbers 900 to 999 are available."
      - 5y ago
unraveller 5y ago
I briefly considered their advice and am now using the-com-remote-home8080-amail.local.fu why? because it Further Upsets authoritarians. To pick your own free TLD just run a nameserver check against the TLD on [1] and watch out for TLDs that hit root servers [1] https://dns.google/resolve?micro.soft&type=NS https://dns.google/resolve?micro.soft&type=NS

PostThisTooFast 5y ago

Interesting, but I don't understand how to set this up. If I go into my router's admin pages (it's a Ubiquiti EdgeRouterX), then Services, then DNS... the only options are: DNS Forwarding Cache size Interface (currently set to Switch0) Dynamic DNS (Add DDNS interface) Now what?

dmd 5y ago

In similar news, do not use "dev.host", because someone owns it[0] and can and will do increasingly hilarious things to your traffic. [0] me

adjkant 5y ago
Good boy: https://dev.host/~shmup/thot/2017/IMG_3091.JPG https://dev.host/~shmup/thot/2017/IMG_3091.JPG

traceroute66 5y ago

The blog post misses the (controversial if you're one of the ex-applicants) decision by ICANN to ban .corp, .home and .mail from ever appearing on the internet. So you've got those options too. Or in ICANN management-speak: "Whereas, the Board considered that the applicants were not aware before the application window that the strings .CORP, .HOME, and .MAIL would be identified as high-risk, and that the delegations of such high-risk strings would be deferred indefinitely." [1] [1]https://features.icann.org/addressing-new-gtld-program-applications-corp-home-and-mail https://features.icann.org/addressing-new-gtld-program-appli...

zamadatix 5y ago
"to be not assigned" is generally less safe than "assigned for local use". E.g. 1.1.1.0/24 was first held back too see if bogus traffic would decreased then a ssigned for research purposes then assigned for cloudflare DNS causing a lot of grief for corporate networks that used 1.1.1.1 or 1.1.1.2 for network clustering or portal gateways instead of ones explicitly assigned for internal use.
- traceroute66 5y ago
  >"to be not assigned" is generally less safe than "assigned for local use" Normally I would agree. But in this case, 5 years (2018-2013), a $185,000 refund, high-profile media coverage and an explicit "deferred indefinitely" statement later ? I don't think any of us will see .CORP, .HOME and .MAIL on the internet in our lifetimes !
twobitshifter 5y ago
It actually mentioned .home as something not to use (along with .lan and.homenetwork)
- CRConrad 5y ago
  Maybe the GP meant "missed" as in "was wrong about". [EDIT:] (I'm not saying it is; just that GP may think so.) [/EDIT]
5y ago

vbezhenar 5y ago

IMO the best approach is to register somedomain.com and use its subdomains. It’s guaranteed not to interfere with anything, you can get LE certificate, you can make it available from the Internet if necessary.

fsckboy 5y ago
somedomain.com is not guaranteed not to interfere! example.com is guaranteed not to interfere (and example.org) http://www.iana.org/domains/reserved http://www.iana.org/domains/reserved
- thundermuffin 5y ago
  I believe you took their post too literally; they mean to go register some domain you would like to have (such as ilovemycoolhouse.com or bearinabigblue.house) and use it, because the only way it will ever interfere with something is if you cause it to.
  - inetknght 5y ago
    I hope you never forget to renew that registration...
    - thundermuffin 5y ago
      I agree! It always boggles my mind how people and companies can forget to renew their domain names when you receive so many email reminders now a days.
      - manquer 5y ago
        It is quite easy, the original owner/ responsible PoC left long ago, or the email goes to an barely read inbox/ group or bounces completely. If a task only recurs less frequently like say every 3-5 years, it is more likely to be forgotten it is the same whether it is individual or companies.

flemhans 5y ago

What if it's an office building?

geofft 5y ago
Buy a real domain name and use that. It is probably cheaper than a single square foot of office space. (This can either be your normal domain name that you already have, using split DNS to make more things resolve on the internal network, or an entirely separate domain name, whichever is operationally easier for you.)
- flemhans 5y ago
  But homes could do that too. I bet many homes have more money for domain names than some shops/offices. Just wondering why they didn't call it 'localnet' or some other unused synonym for local.

jitl 5y ago

I use cozy.systems

johnchristopher 5y ago

What about .localhost? Asking for a friend.

d2wa 5y ago
That is actually another special-use domain name that is supposed to be resolved by the local stub resolver to 127.0.0.1 and ::1. It’s not suitable for use on your local network, however.
- pwdisswordfish8 5y ago
  It’s supposed to be resolved to a loopback address. Chrome forces it to 127.0.0.1, because Google knows better than you. Obviously. <https://bugs.chromium.org/p/chromium/issues/detail?id=489973 https://bugs.chromium.org/p/chromium/issues/detail?id=489973>
francislavoie 5y ago
Works great for things you run on the same machine, less-so for LAN.
- deleted 5y ago
  [deleted]

WalterBright 5y ago

"pennygetyourownwifi" works for me.

davemtl 5y ago

I use a sub-domain of a domain I registered. For example, I use in.[myname].ca.

rootusrootus 5y ago

I just use a real domain name, so I can easily obtain LE certs. Only the internal DNS server will actually return internal addresses.

sigjuice 5y ago
A real domain name is the way to go. The convenience of using LE wildcard certificates is huge. However, running split-horizon DNS is not straightforward, at least in a home setting. I don't see a huge problem with putting a couple of internal addresses in external DNS servers. lexicon cloudflare --auth-token $(gopass cloudflare) create my-real-domain.xyz A --name my-rpi --content 192.168.1.201
- jeroenhd 5y ago
  You don't necessarily need a split-horizon DNS. You only need a few records for the LE wildcard certificate to renew. In fact, DNS-01 only seems to require a single TXT record to resolve. In theory you could set up a small home server or dev machine script that pulls in a wildcard certificate and let all the real A/AAAA queries go to your LAN DNS server (or resolve through mDNS!). A record that doesn't resolve in global DNS won't usually cause much trouble in local DNS either. Putting internal IP addresses in your DNS could pose problems for (small) companies using this trick (because it allows hackers to map out your network) and it could cause confusion (when systems reverse-lookup domains and suddenly a spoofed 10.0.0.1 address is shown as myfunkyservice.sigjuice.xyz in the log files). The issues are minor and unlikely to be a problem, but they're there to serve as footguns years down the line.
  - sigjuice 5y ago
    I didn't say split-horizon DNS is needed for getting LE certs. Just that a real domain name is a requirement to obtain LE certs in the first place. How will an A/AAAA query from something like https://my-rpi.my-real-domain.xyz https://my-rpi.my-real-domain.xyz resolve using mDNS? All DNS queries go to my LAN DNS server by default. I don't particularly care that I can't create A/AAAA records on my LAN DNS server (which is a Time Capsule, btw) to keep the queries inside. To me, the potential leakage of internal addresses/names is an acceptable tradeoff for the convenience. Btw, how is a reverse DNS lookup ever going to do what you mention? I am not creating any PTR records anywhere.

swiley 5y ago

I just set static IPs for important things and put them in my domain. There's also MDNS although most of the MDNS responders are pretty fat for what they do. I tried hacking some basic MDNS stuff into busybox a few years ago but never cleaned it up and sent a patch.

karmanyaahm 5y ago

I use homenet.<my lastname>.tld

j1elo 5y ago

> Your time is better spent ensuring all your devices support mDNS resolution Heh. I starred this Android feature request and kind of regret it because it's been a continuous stream of "+1" emails (but I want to stay subscribed in case some meaningful conversation happens at last): https://issuetracker.google.com/issues/140786115 https://issuetracker.google.com/issues/140786115 (A login is required; any Google account will do)

CRConrad 5y ago
Starred (not +1'd).
yrro 5y ago
I wonder which Android will support first, MDNS or DHCPv6?

xcskier56 5y ago

This is a complete tangent, but does anyone else really hate white text on black background? After reading only a few lines my eyes hurt and I have ghosting where the lines were when I look away. Websites like this one are basically unusable for me

thrownaway810 5y ago
I think it’s a device issue for you. My device sees it as black text on a white background.
frosted-flakes 5y ago
Turn off dark mode in your system settings if you don't want dark mode. It's black-on-white in light mode.

jeroenhd 5y ago

Honestly, just spend the five bucks a year and reserve a real domain name with auto renew. You don't need to make it publicly resolvable, but you'll be 100% sure all of your internal service names won't ever conflict with anything used in the real world. If you pick the right registrar, you can easily get your hands on a wildcard DNS cert as well through Let's Encrypt, so you can protect your internal services with HTTPS! You don't suddenly want to be restricted to HTTPS only (i.e. when Google bought .dev). There's also the minor risk of someone eventually buying your domain and causing all kinds of funky hell, like setting proxies to your internal network (through WPAD) and the names of local services (printer, router, etc.) being queried to a real DNS server because your computer sometimes appends the domain name to TLD-less queries. I've seen it happen that someone set something like example.com as their local domain (including in the DHCP config) who then saw constant slowdowns as their browser tried to resolve http://local-service/ http://local-service/ as http://local-service.example.com/ http://local-service.example.com/, going out to the internet every time, and not caching the error response.

bb88 5y ago
I'm not saying your wrong, but frankly, it's 2021, and it should be a lot easier than this to set up hosts internally for home use. We've largely had the internet broadly for the last 25 years, and the average person should not have to be an expert on wildcard certs/DNS/zeroconf if they want to just have a server running locally. In fact, that's part of the reason things have gone to the cloud, because what should be local internet style appliances (think of a media server that you just plug in and works with your stereo/tv) can't find each other easily -- all because you can't resolve a freakin name on the local DNS without setting up bonjour or your own DNS server.
- milofeynman 5y ago
  You could just create your own cert and add it to all of your devices, I suppose
  - bb88 5y ago
    That doesn't work for certain devices, TV's/IoT devices, etc.

ill0gicity 5y ago

My solution was to use a single domain for everything, with different locations broken out under their own subdomains. My colocated rack is "fmt2". VPSs are under normal IATA 3-letter codes. Homes, not just mine, are under "<STREET_NUMBER><STREET_NAME_INITIAL>". Internal services available for all homes are under "int". And so on. There are a bunch of reserved names under each to provide consistent access to per-location devices and services... "network" for a jump-off point to other devices, "edge<N>" for internet-connected routers, "sw<N>" for switches, "svc<N>" for per-location services (Wireguard, DNS, DHCP, NTP, LDAP, RADIUS, BIRD, HTTP/HTTPS, Home Assistant, Home Bridge), "ap<N>" for access points, "print<N>" for document printers, "fdm<N>" for 3D printers, ad nauseum. It's worked great to keep things organized. It also simplifies certificates since I can use wildcards.

philsnow 5y ago
I had set up some minecraft servers in my k8s homelab behind a proxy that routes clients to the right server depending on the domain name they're connecting to. Everything inside the k8s homelab uses subdomains of k.myvanitydomain.com. The minecraft proxy is at mc.k.myvanitydomain.com. So, to connect to the "valinor" minecraft server, it's just valinor.mc.k.myvanitydomain.com. Dead simple (to me). I tried explaining that to my kids and suddenly I knew what it was like for whoever explained to me the whole /ls/<chubby_cell>/borg/<borg_cell>/bns/<mdb_user>/<job_name>/<index> setup from google prod

SavantIdiot 5y ago

Weird, my Linksys WRT1900AC applies `.home` to its local DNS, but this article says not to?

d2wa 5y ago
Don’t use the .home domain. It was mistakenly recommended in RFC 7788. But that RFC was updated by RFC 8375 recommending the home.arpa domain. (RFCs are published by the IETF who manages the .arpa TLD. That’s one of the few TLDs not managed by ICANN for historical reasons. The .home TLD falls under ICANN’s root domain, so the RFC shouldn’t have assigned it.)
- SavantIdiot 5y ago
  Ah, thanks. Oddly, it is the default and the current firmware won't let me change it.

theteapot 5y ago

What's wrong with .localdomain? Or is that for something else??

d2wa 5y ago
It’s an unassigned top-level domain. So, don’t use it. Some Linux distributions erroneously resolve it to 127.0.0.1, but there’s no RFC or consensus around this TLD.
- theteapot 5y ago
  Jeez, all this time :/. Thanks.

scolby33 5y ago

I truly do not understand why this problem has gone on for so long. It's clear that many people think `.home.arpa` is ugly. It boggles my mind that the IETF and ICANN can't come up with some agreement to get `.home` or something similar codified like RFC 7788 tried to do. This just seems like a fight between giant bureaucracies while meanwhile the users suffer and bad decisions like assigning `.dev` are made. I get that there are rules around this sort of critical infrastructure and its management, but come ON. /rant With the rant ended: can anyone explain to me why all the relevant organizations can't get together and assign a TLD for this purpose that doesn't end in `.arpa`?

pwdisswordfish8 5y ago
Delegating .dev was fine. Sick of hearing about this. As the meme goes, "well, well, well, if it isn't the consequences of my own actions." Everyone who got burned by .dev got what they deserve and needs to grow up already, take responsibility for themselves, and get over it.
- labawi 5y ago
  Delegating .dev was not fine. Does everything need to be for rent? The name system is a unique non-renewable resource. And it's not like ICANN gave people a lot of choice for unregistered domains. By your logic, I suppose .onion was not fine either, till cca 2015 when it got special-use status? And all the name system alternatives should be abolished, because we need to rent their TLDs to some uninterested party?
  - pwdisswordfish8 5y ago
    > I suppose .onion was not fine either, till cca 2015 when it got special-use status? You are correct.

lttlrck 5y ago

No mention of .internal https://datatracker.ietf.org/doc/html/draft-wkumari-dnsop-internal-00 https://datatracker.ietf.org/doc/html/draft-wkumari-dnsop-in... (Though maybe it's not a great name for this particular application, it seems to make a lot of sense for enterprise level infrastructure)

reaperducer 5y ago
I tried to get my company's IT department to put my latest project on a .internal domain. They wouldn't go for it, even though it can and will only be used by people internally. They bound it to a sub domain of the company's main web site claiming that Microsoft (maybe something with Active Directory? Or Azure?) doesn't support any domains that you don't actually own. I wouldn't be surprised if this is false because the people in charge of the domains think GoDaddy is awesome. Would love to hear an HN expert tell me if they're full of crap or not.
- xorcist 5y ago
  While it is certainly possible that a Microsoft-managed network places additional restrictions on what addresses are used, there are several good reasons to not to create unique "snowflake" situations for individual applications. There might be silent assumptions everywhere what domain addresses answer to, in log collection, in monitoring, in address management tools. Simple things like domain search strings becomes harder. Any non trivial enterprise is going to have a ton of these (semi-)automated tools that your address will end up in. It also carries the risk of complicating future work. The company might merge with another company. Or imagine a mandate where all communication will need to switch to TLS, only to discover there are addresses used under other domains internally.
rdpintqogeogsaa 5y ago
That's an Internet Draft, not a standard or even at least a published RFC. An Internet Draft cannot be used Internet-Drafts as reference material or cited as anything other than "work in progress." There are some more reserved domains in RFC 6761 (https://datatracker.ietf.org/doc/html/rfc6761 https://datatracker.ietf.org/doc/html/rfc6761) though: - .test (Application software SHOULD NOT recognize test names as special, and SHOULD use test names as they would other domain names. [...] Caching DNS servers SHOULD recognize test names as special and SHOULD NOT, by default, attempt to look up NS records for them, or otherwise query authoritative DNS servers in an attempt to resolve test names. Instead, caching DNS servers SHOULD, by default, generate immediate negative responses for all such queries.) - .localhost (Users are free to use localhost names as they would any other domain names. Users may assume that IPv4 and IPv6 address queries for localhost names will always resolve to the respective IP loopback address.) - .invalid (Users are free to use "invalid" names as they would any other domain names. Users MAY assume that queries for "invalid" names will always return NXDOMAIN responses. Name resolution APIs and libraries SHOULD recognize "invalid" names as special and SHOULD always return immediate negative responses. Name resolution APIs SHOULD NOT send queries for "invalid" names to their configured caching DNS server(s).) - .example, .example.com, .example.net (Users SHOULD understand that example names are reserved for use in documentation.) Unfortunately, none of these address the same needs as .internal would.

livinginfear 5y ago

What method are people using to configure this oin their own network? The router supplied by my ISP doesn't support using a custom DNS server like a pihole, unfortunately. I don't consider using /etc/hosts a longterm worthwhile solution. I'd love to find another useful way of setting this up.

nine_k 5y ago
I was lucky enough to ask my ISP to set their box to bridge mode and have my request granted, then attached my own router.
- livinginfear 5y ago
  I just looked, and my router does indeed support bridged mode. That might be my answer. Thanks for pointing this out!
jannes 5y ago
Does your router support disabling DHCP? You can just run your own DHCP server in that case.
- KozmoNau7 5y ago
  That's what I do, even though I run my own router. The pi-hole acts as both DNS and DHCP. It sets the DNS domain correctly via DHCP, unlike a lot of routers.
- livinginfear 5y ago
  It does. I might go with this option. It seems like it'll be easier than running the router in bridged mode, and adding another physical router.

aussieguy1234 5y ago

An interesting trick I discovered is that you can make a public domain point to a local IP. So I could make foo.mylocal.com point to 127.0.0.1 or the printer, or anything else really.

pininja 5y ago

For those curious about the (spoiler) .arpa domain, here’s an RFC https://www.rfc-editor.org/rfc/rfc3172 https://www.rfc-editor.org/rfc/rfc3172

ComputerGuru 5y ago

I think it’s safe to assume that the one gtld ICANN will never sign off on - even if they sell .home, .lan, and everything else - is .icann So if they won’t give us a tld to use, just use that :)

nsgi 5y ago
What if they start using it?
d2wa 5y ago
.dev comes to mind.

pwdisswordfish8 5y ago

> Do not use undelegated domain names like .lan OpenWRT: *glances aside nervously*

citrin_ru 5y ago
.lan should be OK, it has no it’s own RFC, but it is a reserved domain nevertheless: https://datatracker.ietf.org/doc/html/rfc6762#appendix-G https://datatracker.ietf.org/doc/html/rfc6762#appendix-G
- pwdisswordfish8 5y ago
  > We do not recommend use of unregistered top-level > domains at all, but should network operators decide to do this, the > following top-level domains have been used on private internal > networks without the problems caused by trying to reuse ".local." for > this purpose: This is hardly ‘reserved’. It just describes existing practice without in any way designating it as safe, recommended or future-proof.
  - labawi 5y ago
    It's fine as long as people keep using it.

8fingerlouie 5y ago

I use NextDNS, so in the configuration for my LAN devices i have rewrites that maps host.somewhere.com to 192.168.x.x. The external DNS maintains a single host record for VPN access, and since NextDNS also handles external requests, i have to set different hostnames for internal/external access. It's (probably not) optimal, but it works. It was pretty much the same approach i used with PiHole/AdGuard Home. Edit: To allow multiple hostnames i use a wildcard certificate from LetsEncrypt, though once i'm connected through VPN it doesn't matter much as it will resolve the internal hostname just fine.

cookiengineer 5y ago

I have to chime in here now and call the article what it is: wrong at least in regards to misinformation about ".local". > DNS clients may defer the resolution of .local spTLDs to the system’s mDNS resolvers instead of its DNS resolver. This is not true. First off: You can always misconfigure your DNS resolver, but usually they can be used in parallel. Multicast DNS usually is only used when your router is too stupid to manage the hostname; and if multicast DNS is active on every host, then it's a setting that fixes even that broken router. Also, "hostname.local" will never conflict with DNS based service discovery [1] of resolving a host via multicast DNS. And even if so, you can just use one of the other reserved multicast addresses and be done with it. As long as you don't use e.g. "._tcp." or "._udp." inside your hostname, you never have domain name conflicts. I think there's also a huge misconception about what DNS-based service discovery is. In DNS-SD, there are questions to a service identifier with a PTR inside, and the response contains A,AAAA,SRV and TXT entries to describe everything you need to know to make a connection to the correct host, ip, port and version of the service. Airprint, airplay, airscan and others additionally use their service name as a prefix in regards to the IANA-registered service names [2] so printers, scanners and other Multicast-DNS compatible hardware never conflicts with the existing network. /ragecomment Personally, I would actually embrace the use of .local, because it allows you to build a self-discovery service that is unrelated to DHCP and unrelated to ARP mechanisms, and works peer-to-peer; as long as the IPs are in the same NAT or, with IPv6/UDP6, have at least one discoverable scope. In DNS-SD, you literally just have to be able to reach other IPs, and you have a working handshake mechanism to discover other devices without having to know their hostnames, IPs, or anything. It's pretty amazing once you realize its network automation potential. Source: Me, building a web browser that uses peer-to-peer TLS encryption on "username._stealth._tcp.tholian.network" and "username._stealth._tcp.tholian.local" [3] [1] https://www.ietf.org/rfc/rfc6763.txt https://www.ietf.org/rfc/rfc6763.txt [2] http://dns-sd.org/ServiceTypes.html http://dns-sd.org/ServiceTypes.html [3] https://github.com/tholian-network/stealth https://github.com/tholian-network/stealth

sko- 5y ago

This still won't fix the bat-shit-stupid idea of browser developers to just forward anything they think is not resolvable (and often even if it IS a valid local FQDN) to the next best search engine...

Joker_vD 5y ago
IIRC all browsers try to perform name resolution if you append "/" at the end of your input in the address bar. After that fails they redirect to a search engine, but not before.
d2wa 5y ago
Well, browsers do a very sensible thing of attempting to anything that is a valid domain names. For everything else, including undelegated (and therefore unresolvable) top-level domains get passed on as search queries. Forwarding as much traffic to search engines is how they make money, after all. If you don’t like it, stick to valid domains.

r1ch 5y ago

For all the things saying not to use it, I've not run in to any issues with .local. It's reserved so it won't be delegated on the internet, it makes sense as a word and mDNS continues to work correctly. So far I haven't seen any devices that try to resolve over mDNS instead of DNS.

PostThisTooFast 5y ago

Yeah, thanks for the insight, "bros."

Annatar 5y ago

"Do not use undelegated domain names like .lan, .home, .homenet, .network, nor should you make up your own domain name." But it doesn't explain why, and what the mechanism behind that statement is. I configured my internal DNS servers on my home network to be root top level domain servers for a made-up .tld. Why wouldn't that work? Don't know, because the author does not explain the mechanism in detail. As far as I can see for the past 15 years, having configured the internal DNS servers to be root top level domain name servers works like a charm, with no observed ill- or side-effects.

NDizzle 5y ago

There is a .casa TLD that you can use. It’s inexpensive to register, too.

KaiserPro 5y ago

This isn't networking advice, but its what I've done either professionally and for home in some limited cases. For fee paying networks, the "router" will most likley be in charge of some sort of DNS. If thats the case its made canonical for a subdomain that one owns. If you're lazy, just plain split horizon. However limit it strictly to DHCP. As soon as you start re-writing public services, you're sunk. Side note, its a really good time to start putting in location data into subdomains. using option 60(might not be this, its been a while) you can work out what switch the request came from and add a different subdomain based on that you can make subdomains like server01.rack3.datacenter.country.company.com. this allows you to make search params to create local services. ie "time" would first check rack3, then datacenter, then country, then company.

KaiserPro 5y ago
also my home domain name is "phartiphuckballs.com"

SeaWhales1000 5y ago

For us laymen, why would you need/want a domain name for a home network?

d2wa 5y ago
So you don't need to memorize and hard-code IP addresses for your network services. * router.home.arpa * nas.home.arpa * printer.home.arpa * htpc.home.arpa
- filomeno 5y ago
  Yes, but that can be achieved by using a hostname alone (router, nas, printer, htpc...). What does the domain bring?
  - hda111 5y ago
    Prevent collision with public domains. “ws” has an A record. It’s possible that your local Webserver also is named ws. With all new gTLDs it’s easy to have a collision when someone buys the “router” TLD.
  - d2wa 5y ago
    How, exactly, is that hostname being resolved, though? There is no magical protocol to resolve TLD-less hostnames in DNS. Your router probably adds entries for `hostname.dhcp-domain` but since `dhcp-domain` is empty, you end up with just `hostname`. No, go ahead and name a device `com` and see what happens. Your router will have a hard time resolving `example.com`. This is why you put your stuff behind apurpose-built TLD like `home.arpa.`
    - WorldMaker 5y ago
      In some cases today that hostname is being resolved via mDNS, which is a good reason to get into the habit of using .local for mDNS addresses. Using somehostname.local on many OSes today forces DNS lookups to always and only use mDNS and avoids accidentally calling DNS. (So long as you don't break mDNS support on your local network by doing something like trying to use .local for traditional DNS.) mDNS is probably sufficient for most people and you don't need to setup old school DNS on a local network. (But if you do, a purpose-built TLD like home.arpa is a good choice.)

crmrc114 5y ago

Just tossing this out there- apple only claimed .local in rfc as of 2013. There are plenty of 'legacy' production environments that I support that still use .local without issue with mac clients. Its possible there would be a collision- but in practice the pain point is not enough concern for many with the limited subset of apple devices on their corporate networks. Still pissed that apple was straight up allowed to usurp that tld instead of something like .mdns.local or .autoconf Also, please dont use .com/net/org for local networks. All you are going to do is punish yourself when you go to setup you AD domain. However if you want to setup a subdomain that you are willing to make the AD server authoritative for you may end up with less pain. If you have to use your own domain keep in mind that if you go to setup AD in your home/lab/small biz you will need to add records for your webserver/mailserver etc since AD will want to be the authoritative dns server for its domain. There are ways around this, but I digress. Using a public tld can cause pain, just be aware of that.

atsmyles 5y ago

I use .lan and will continue to do so. .home.arpa is fine for 1 lan, but if you want to connect to multiple lans, it no longer works well. Add to the fact the amount of typing. .lan should be reserved so that people can use it for addressing multiple local area networks. We already have .local for mDNS which is perfect for the single lan setup. If they won't do it de jure, then users like myself will make this standard de facto.

otterpro 5y ago

Can't we use .test and .example as well? They are reserved for testing locally, and although it sounds weird, ie nas.test, it will work. * [rfc6761](https://datatracker.ietf.org/doc/html/rfc6761 https://datatracker.ietf.org/doc/html/rfc6761)