5 ms·

> Do not use undelegated domain names like .lan, .home, .homenet, .network, nor should you make up your own domain name. ...why? My DNS server, my rules, no?

> Do not use undelegated domain names like .lan, .home, .homenet, .network, nor should you make up your own domain name. ...why? My DNS server, my rules, no? Why should I feel obligated to follow ICANN? Obviously, I'll need to make changes if someone ever registers the domain with ICANN (and I want to access the ICANN version), but other than that...

manicdee 5y ago
The issue here being: what happens when you have your proxy configured as "proxy.lan" but you make a typo when entering it in local DNS or in your browser settings? That DNS request for "proxy.lan" will now go all the way out to the root servers for every page load, multiple times. Not so important for you with your 200 tabs open, but quite important to the people maintaining the root servers who see a significant percentage of all queries being for bogus domains that don't exist.
- prox 5y ago
  Does this happen often? How do they mitigate this?
  - d2wa 5y ago
    They burn money on the problem.
- rualca 5y ago
  > (...) but quite important to the people maintaining the root servers who see a significant percentage of all queries being for bogus domains that don't exist. I get the boys out rule sentiment, but isn't resolving domain names, even those that don't exist, the whole purpose of root servers? I mean, your suggestion reads like asking not to type URLs wrong because a significant percentage of requests are 404s.
  - ratsmack 5y ago
    >... even those that don't exist, the whole purpose of root servers? The root servers shouldn't be a dumping ground for unnecessary traffic when proper DNS configuration is not that difficult.
    - rualca 5y ago
      I'm not sure you're getting it. You're complaining about a scenario where there's a misconfiguration error that's totally unintentional. No one is intentionally driving traffic to domains that don't exist. In fact, of said traffic hits the root servers, odds are that the system is effectively down and not receiving the traffic it's expected to receive, and a few developers are trying to figure out what's broken.
- Shank 5y ago
  What if you make a typo on .home.arpa? e.g., .home.arps? How is that any different?
  - d2wa 5y ago
    Because all DNS software is supposed to know that the .arpa domain name is managed by the IETF and not ICANN. Or, rather, they know not to try to resolve it. There are a handful of different .arpa domains in use, and they all require special handling from your DNS server. E.g. reverse DNS/rDNS uses in-addr.arpa., and the DNS server in even the dumbest consumer-grade router will know how to respond to requests under that domain.
    - manquer 5y ago
      that doesn't mean anything if you typo on ".arpa". No DNS hardware is smart enough to know that you meant ".arpa" not ".apra" you actually typed in. Typos are not really a valid argument, it can happen for any type of domain.
- peanut-walrus 5y ago
  If you want to be a polite DNS resolver operator, root servers from B to G allow zone transfer, so you can just host the root zone locally. This way none of the typos or other bogus requests will leave your network.
traceroute66 5y ago
> My DNS server, my rules, no? That's the same line taken by network admins who think they know better than using RFC1918 IP ranges for their LAN.
- sokoloff 5y ago
  Worked at a company which did this (dating back to when they probably figured they’d never need to connect to the net). As a satellite office and an acquisition, we played all kinds of games to try to figure out whether we should send a given IP address out to the Internet or to corporate. Apple’s IP range was entirely overlapping and of course the corporate networking group just threw up their hands and said “send it to us; the internet is not a business critical function.” This was in the early 2000s, not the early 90s.
- Wowfunhappy 5y ago
  I'm not suggesting this would be intelligent for anything larger than your own home network!
geofft 5y ago
Does every single network client on your network use your DNS server for name resolution? No DNS-over-HTTPS? No widgets configured to talk to public DNS servers? Also, does your DNS server correctly filter "out"-of-bailiwick responses for .lan etc. zones that are actually perfectly well in-bailiwick because they're from the actual delegated-by-the-real-root-servers nameservers, they're just not from your private server that you've configured? If not, I can execute a cache-poisoning attack against you.
tialaramex 5y ago
On your network, sure. But you seem to be on our network with all of us and so here you need to obey our rules or things won't go so well for you.
- renewiltord 5y ago
  Oh yeah? What are you going to do? Complain that you can’t run the root nameservers and try to blackhole my traffic but fail since I am DHCP configured by my ISP? Sounds like a toothless threat.
minimaul 5y ago
For what it's worth, this does work. For now. The main issue is if it gets sold later, or assigned by RFC. As an example, more than one company I've worked for used .dev as a TLD for their dev environments, with local DNS to override it. Once google bought .dev, this meant that: - we couldn't access anything Google put on .dev - suddenly, all of our test sites had HTTPS forced, because .dev was HSTS preloaded by Google The point here is that an unexpected change that you might not be aware is coming can break your setup in ways that are awkward to resolve - eg HSTS preloading means that you can no longer access non HTTPS endpoints unless you do it by IP and that leads to a frustrating afternoon - and it's inevitably always when you don't want it. Like it or not, ICANN operates the DNS space. There's a proper way to get your own piece of this space, and you can run home or business networks under your own piece and you have a guarantee that no one will break you - because it's yours. (edited for formatting)
- minimaul 5y ago
  And as an extra point - can you actually guarantee that all your DNS lookups hit your DNS server first? That's harder than it sounds, with more and more apps implementing their own DNS over HTTPS clients - Firefox does it for instance, so does Chrome.
  - k4rli 5y ago
    How come DNS requests initiated from Chrome/FF still reach my pi-hole and get blocked just fine? I would think this browsers' solution would have prevented that.
  - willis936 5y ago
    If you run your own router: yes up to a certain point. https://www.myhelpfulguides.com/2018/07/30/redirect-hard-coded-dns-to-pi-hole-using-edgerouter-x/ https://www.myhelpfulguides.com/2018/07/30/redirect-hard-cod... Afaik nobody has a fix for the client hostility that DoH brings to the table.
    - Spivak 5y ago
paranoidrobot 5y ago
Try using something under .local and see how much fun you have. That's what a former employer had set up for their internal environments. Worked great until mDNS came along and Apple devices insisted that .local had to go through mDNS rather than our DNS servers. The Mac users had a constant stream of complaints because of it: "I can't connect to the printer", "Shared drives don't work", "I can't access the CI environment in Safari/Chrome/whatever"
- globular-toast 5y ago
  Place I worked at set up the network using .local around 2010 when mDNS was already common. Turns out the admin had seen/heard of .local and thought that's what it was for. A little knowledge is a dangerous thing...
d2wa 5y ago
As long as you properly configure your server to not bother the root servers, then sure. Do what you want. But you need to set up the TLD zone in addition to your domain zone. It’s extra work.
nucleardog 5y ago
I'm with ya. I use `.zz`. It's short, easy to type, and in order for that to be assigned out, we'd need an entirely new country to be created (one that decided the other bazillion free CCTLDs are not to their liking). And like you say, I only run into a problem if I decide I want to access things from said country. Would I do this in any professional setting? Absolutely not. For my own stuff at home? The risk is pretty minimal and the work involved in updating if I ever have to is not too bad. DHCP automatically registers everything under <hostname>.zz, and I cname well-known things from <thing>.svc.zz to the appropriate hostname so I can hit, e.g., `blueiris.svc.zz` or `homeassistant.svc.zz`. For SSL I just run my own CA.
- Symbiote 5y ago
  You can use ZZ freely, as it's an ISO 3166 code reserved for private use. AA, QM to QZ and XA to XZ are also reserved.
  - pwdisswordfish8 5y ago
    Not exactly. The RFC that would make it safe is draft status, and the draft is set to expire in <2 months and does not come off as particularly confident itself: https://tools.ietf.org/id/draft-ietf-dnsop-private-use-tld-01.txt https://tools.ietf.org/id/draft-ietf-dnsop-private-use-tld-0... > are thought to be plausible choices for the implementation of private namespaces
    - tremon 5y ago
      The RFC may expire, but it quotes the ISO3166 guidelines as to why .zz is safe for personal use. Those guidelines will not change because of this draft: [ISO3166 clause 8.1.3] "User assigned code element": "If users need code elements to represent country names not included in this part of ISO 3166, the series of letters AA, QM to QZ, XA to XZ, and ZZ, and the series AAA to AAZ, QMA to QZZ, XAA to XZZ, and ZZA to ZZZ respectively and the series of numbers 900 to 999 are available."
      - 5y ago
unraveller 5y ago
I briefly considered their advice and am now using the-com-remote-home8080-amail.local.fu why? because it Further Upsets authoritarians. To pick your own free TLD just run a nameserver check against the TLD on [1] and watch out for TLDs that hit root servers [1] https://dns.google/resolve?micro.soft&type=NS https://dns.google/resolve?micro.soft&type=NS

manicdee 5y ago

The issue here being: what happens when you have your proxy configured as "proxy.lan" but you make a typo when entering it in local DNS or in your browser settings? That DNS request for "proxy.lan" will now go all the way out to the root servers for every page load, multiple times. Not so important for you with your 200 tabs open, but quite important to the people maintaining the root servers who see a significant percentage of all queries being for bogus domains that don't exist.

prox 5y ago
Does this happen often? How do they mitigate this?
- d2wa 5y ago
  They burn money on the problem.
rualca 5y ago
> (...) but quite important to the people maintaining the root servers who see a significant percentage of all queries being for bogus domains that don't exist. I get the boys out rule sentiment, but isn't resolving domain names, even those that don't exist, the whole purpose of root servers? I mean, your suggestion reads like asking not to type URLs wrong because a significant percentage of requests are 404s.
- ratsmack 5y ago
  >... even those that don't exist, the whole purpose of root servers? The root servers shouldn't be a dumping ground for unnecessary traffic when proper DNS configuration is not that difficult.
  - rualca 5y ago
    I'm not sure you're getting it. You're complaining about a scenario where there's a misconfiguration error that's totally unintentional. No one is intentionally driving traffic to domains that don't exist. In fact, of said traffic hits the root servers, odds are that the system is effectively down and not receiving the traffic it's expected to receive, and a few developers are trying to figure out what's broken.
Shank 5y ago
What if you make a typo on .home.arpa? e.g., .home.arps? How is that any different?
- d2wa 5y ago
  Because all DNS software is supposed to know that the .arpa domain name is managed by the IETF and not ICANN. Or, rather, they know not to try to resolve it. There are a handful of different .arpa domains in use, and they all require special handling from your DNS server. E.g. reverse DNS/rDNS uses in-addr.arpa., and the DNS server in even the dumbest consumer-grade router will know how to respond to requests under that domain.
  - manquer 5y ago
    that doesn't mean anything if you typo on ".arpa". No DNS hardware is smart enough to know that you meant ".arpa" not ".apra" you actually typed in. Typos are not really a valid argument, it can happen for any type of domain.
peanut-walrus 5y ago
If you want to be a polite DNS resolver operator, root servers from B to G allow zone transfer, so you can just host the root zone locally. This way none of the typos or other bogus requests will leave your network.

traceroute66 5y ago

> My DNS server, my rules, no? That's the same line taken by network admins who think they know better than using RFC1918 IP ranges for their LAN.

sokoloff 5y ago
Worked at a company which did this (dating back to when they probably figured they’d never need to connect to the net). As a satellite office and an acquisition, we played all kinds of games to try to figure out whether we should send a given IP address out to the Internet or to corporate. Apple’s IP range was entirely overlapping and of course the corporate networking group just threw up their hands and said “send it to us; the internet is not a business critical function.” This was in the early 2000s, not the early 90s.
Wowfunhappy 5y ago
I'm not suggesting this would be intelligent for anything larger than your own home network!

geofft 5y ago

Does every single network client on your network use your DNS server for name resolution? No DNS-over-HTTPS? No widgets configured to talk to public DNS servers? Also, does your DNS server correctly filter "out"-of-bailiwick responses for .lan etc. zones that are actually perfectly well in-bailiwick because they're from the actual delegated-by-the-real-root-servers nameservers, they're just not from your private server that you've configured? If not, I can execute a cache-poisoning attack against you.

tialaramex 5y ago

On your network, sure. But you seem to be on our network with all of us and so here you need to obey our rules or things won't go so well for you.

renewiltord 5y ago
Oh yeah? What are you going to do? Complain that you can’t run the root nameservers and try to blackhole my traffic but fail since I am DHCP configured by my ISP? Sounds like a toothless threat.

minimaul 5y ago

For what it's worth, this does work. For now. The main issue is if it gets sold later, or assigned by RFC. As an example, more than one company I've worked for used .dev as a TLD for their dev environments, with local DNS to override it. Once google bought .dev, this meant that: - we couldn't access anything Google put on .dev - suddenly, all of our test sites had HTTPS forced, because .dev was HSTS preloaded by Google The point here is that an unexpected change that you might not be aware is coming can break your setup in ways that are awkward to resolve - eg HSTS preloading means that you can no longer access non HTTPS endpoints unless you do it by IP and that leads to a frustrating afternoon - and it's inevitably always when you don't want it. Like it or not, ICANN operates the DNS space. There's a proper way to get your own piece of this space, and you can run home or business networks under your own piece and you have a guarantee that no one will break you - because it's yours. (edited for formatting)

minimaul 5y ago
And as an extra point - can you actually guarantee that all your DNS lookups hit your DNS server first? That's harder than it sounds, with more and more apps implementing their own DNS over HTTPS clients - Firefox does it for instance, so does Chrome.
- k4rli 5y ago
  How come DNS requests initiated from Chrome/FF still reach my pi-hole and get blocked just fine? I would think this browsers' solution would have prevented that.
- willis936 5y ago
  If you run your own router: yes up to a certain point. https://www.myhelpfulguides.com/2018/07/30/redirect-hard-coded-dns-to-pi-hole-using-edgerouter-x/ https://www.myhelpfulguides.com/2018/07/30/redirect-hard-cod... Afaik nobody has a fix for the client hostility that DoH brings to the table.
  - Spivak 5y ago

paranoidrobot 5y ago

Try using something under .local and see how much fun you have. That's what a former employer had set up for their internal environments. Worked great until mDNS came along and Apple devices insisted that .local had to go through mDNS rather than our DNS servers. The Mac users had a constant stream of complaints because of it: "I can't connect to the printer", "Shared drives don't work", "I can't access the CI environment in Safari/Chrome/whatever"

globular-toast 5y ago
Place I worked at set up the network using .local around 2010 when mDNS was already common. Turns out the admin had seen/heard of .local and thought that's what it was for. A little knowledge is a dangerous thing...

d2wa 5y ago

As long as you properly configure your server to not bother the root servers, then sure. Do what you want. But you need to set up the TLD zone in addition to your domain zone. It’s extra work.

nucleardog 5y ago

I'm with ya. I use `.zz`. It's short, easy to type, and in order for that to be assigned out, we'd need an entirely new country to be created (one that decided the other bazillion free CCTLDs are not to their liking). And like you say, I only run into a problem if I decide I want to access things from said country. Would I do this in any professional setting? Absolutely not. For my own stuff at home? The risk is pretty minimal and the work involved in updating if I ever have to is not too bad. DHCP automatically registers everything under <hostname>.zz, and I cname well-known things from <thing>.svc.zz to the appropriate hostname so I can hit, e.g., `blueiris.svc.zz` or `homeassistant.svc.zz`. For SSL I just run my own CA.

Symbiote 5y ago
You can use ZZ freely, as it's an ISO 3166 code reserved for private use. AA, QM to QZ and XA to XZ are also reserved.
- pwdisswordfish8 5y ago
  Not exactly. The RFC that would make it safe is draft status, and the draft is set to expire in <2 months and does not come off as particularly confident itself: https://tools.ietf.org/id/draft-ietf-dnsop-private-use-tld-01.txt https://tools.ietf.org/id/draft-ietf-dnsop-private-use-tld-0... > are thought to be plausible choices for the implementation of private namespaces
  - tremon 5y ago
    The RFC may expire, but it quotes the ISO3166 guidelines as to why .zz is safe for personal use. Those guidelines will not change because of this draft: [ISO3166 clause 8.1.3] "User assigned code element": "If users need code elements to represent country names not included in this part of ISO 3166, the series of letters AA, QM to QZ, XA to XZ, and ZZ, and the series AAA to AAZ, QMA to QZZ, XAA to XZZ, and ZZA to ZZZ respectively and the series of numbers 900 to 999 are available."
    - 5y ago

unraveller 5y ago

I briefly considered their advice and am now using the-com-remote-home8080-amail.local.fu why? because it Further Upsets authoritarians. To pick your own free TLD just run a nameserver check against the TLD on [1] and watch out for TLDs that hit root servers [1] https://dns.google/resolve?micro.soft&type=NS https://dns.google/resolve?micro.soft&type=NS