8 ms·

ICANN proposes creating .INTERNAL domain to do the same job as 192.168.x.x

58 points by talboren 3y ago

bell-cot 3y ago
Would this even be an issue if ICANN hadn't gone rogue years ago, and started minting new TLD's as if they had a license to print money?
- ranger207 3y ago
  Yes. You couldn't just assume that a TLD that wasn't being used would forever continue being unused. .local was introduced for an RFC rather than for profit
- sybercecurity 3y ago
  This is one of those "damned if you do..." type deals. ICANN was created to expand the gTLD options as one of its goals.
- Caligatio 3y ago
  There's a difference between something working by design vs. working by happenstance. I would argue using a gTLD that isn't supposed to be registered is working by happenstance whereas the proposed .internal would be working by design. As an example, some (terrible) ISPs intercept NXDOMAIN records which could leak into misconfigured networks that are squatting on unregistered gTLDs. This behavior would be far worse if they did this for the proposed .internal.
- margalabargala 3y ago
  Counterpoint, if TLDs were more limited then having one of those is a license to print money. The existence of more TLDs reduces domain name scarcity and is strictly better for us the users.
- yjftsjthsd-h 3y ago
  Alternatively, a few of these internal TLDs (.internal, .local, .home, .dev, .lan, ...) should have been reserved from the very start and then we should have intentionally leaned into the explosion of top level domains because shoving everything under .com was always kind of dumb. (But yeah, arguably what actually happened was a little bit the worst of both worlds and we get to deal with all kinds of fun growing pains until everything is brought to the new standard and hopefully we can stick with that.)
xg15 3y ago
Waiting for Google's announcement that they added this to the HSTS preload list, purely to anger admins and developers.
- candiddevmike 3y ago
  Why would you put this out into the universe?
photonbeam 3y ago
They should also do .home but I guess its too late for that
- dinosaurdynasty 3y ago
  they have .home.arpa
mjevans 3y ago
.lan. Please also reserve 'lan' since so many of us running from .local which Apple decided to takeover screwed over. Just reserve that it's for site specific / local / 'internal' use and that no other brilliant **hole can screw up a perfectly good network for another protocol or extension with it.
- loudmax 3y ago
  I tend to agree. `.internal` is too easy to misspell or misread. Not that it's that hard, but operating at scale you really want to make things as simple and easy as possible.
  - kmoser 3y ago
    .lan might be easily misspelled as .Ian (or .1an), and the three letters look like a "normal" TLD. If anything, .local might be a better choice.
    - deleted 3y ago
      [deleted]
    - AnthonyMouse 3y ago
      Except that .local in 2024 is already in use for mDNS. Moreover, there is no such thing as a "normal" TLD. These are some existing public top level domains: .company .industries .network The reason .lan (or, for that matter, .local) isn't really that great is there will be large corporations wanting an internal use domain that spans multiple sites, which is neither local nor Local Area Network. But since it's likely to see widespread use, it does make sense for it to be short and so easy to type, which .internal is not. A decent one would be .pri, since a lot of companies already use it and "private" is what we're going for here.
    - kps 3y ago
      There's an obvious solution: .local for mDNS, and any (or all) of .Iocal, .locaI, or .IocaI for internal use.
  - 3y ago
guluarte 3y ago
probably the only point is to milk .local, .dev, .home, etc.
whartung 3y ago
I don't understand how this will work. The "magic", as I understand it, of the 192.x.x.x network is that the Internet "knows" to not route it. Networking isn't my strength, so I don't know where, or what part of the my local network decides that 192.x.x.x can't be routed, and so doesn't. (I guess it's the router at the edge, but I don't know about internal routers.) But anyway, however it's manifest, the "magic" of it is that 192 is "safe" because, at the assorted gateways that are emplaced on the Internet, that traffic just "stops". So, how does ".internal" work? I mean, it's just a hostname, and DNS responds to queries about hostnames. Would it work similarly where the DNS server "knows" where a request came from, and thus, "knows" that "oh this is internal traffic, so if they're asking for an .internal domain name, I can safely respond the appropriate IP"? Is that how this supposed to work? Is that where the magic happens?
- wmil 3y ago
  I think it's just reserving .internal for that use. So a network admin has a guarantee that he'll never have to deal with an external .internal domain. Whereas something like .pri for private might one day be set up as a new TLD.
- ranger207 3y ago
  The way DNS works, if a local resolver doesn't have the record for a domain name, then it'll ask a higher level resolver. This proposal says that .internal will never be added to those higher level resolvers so if your local resolver doesn't have a record for a .internal hostname then locally that hostname doesn't exist
- micw 3y ago
  The "magic" is that the TLD is reserved for internal use. Before, people used different domains like ".lan", ".local". Problem with those is that it can happen at any time that one of these becomes a valid TLD which can cause a lot of unexpected side effects (starting from "cannot reach somenicepage.lan because my local DNS resolved *.lan" to "someone registered server.lan and can not issue valid SSL certificates for my internal service").
  - 3y ago
gnabgib 3y ago
A prior recent discussion:[0] (322 points, 4 days ago, 227 comments) [0]: https://news.ycombinator.com/item?id=39152306 https://news.ycombinator.com/item?id=39152306
jawns 3y ago
Darn, I was really hoping they'd repurpose .test or .invalid!
spydum 3y ago
M&A integration going to be so fun!
teaearlgraycold 3y ago
Because it seems like most people that bother to comment on posts about .internal are upset I’ll say that I’m perfectly happy with this decision and will gladly migrate my internal services to this new TLD.
deleted 3y ago
[deleted]
ChrisArchitect 3y ago
[dupe]
1vuio0pswjnm7 3y ago
Personally, I have been running a personalised root.zone on the home network for decades now. If I want to disable or create a TLD, then I can do it in seconds. I often read about changes by ICANN that are supposed to stop internet users from needlessly sending queries to ICANN root servers. Because I run own personal root server on personal home network, I never send queries to ICANN root servers. If I want to know what's in the ICANN root.zone, I just download it. ftp -vd4 ftp://192.0.32.9/domain/root.zone Long time ago I wrote a C wrapper around certain stub resolvers that can be used to non-recursively, i.e., iteratively, resolve any domain name without using ICANN root servers at all; thus, it saves needless queries. The namservers for every TLD are contained in the binary. If the ICANN root.zone changes, which is rare, the binary can be updated in seconds.

58 points by talboren 3y ago

Would this even be an issue if ICANN hadn't gone rogue years ago, and started minting new TLD's as if they had a license to print money?

ranger207 3y ago
Yes. You couldn't just assume that a TLD that wasn't being used would forever continue being unused. .local was introduced for an RFC rather than for profit
sybercecurity 3y ago
This is one of those "damned if you do..." type deals. ICANN was created to expand the gTLD options as one of its goals.
Caligatio 3y ago
There's a difference between something working by design vs. working by happenstance. I would argue using a gTLD that isn't supposed to be registered is working by happenstance whereas the proposed .internal would be working by design. As an example, some (terrible) ISPs intercept NXDOMAIN records which could leak into misconfigured networks that are squatting on unregistered gTLDs. This behavior would be far worse if they did this for the proposed .internal.
margalabargala 3y ago
Counterpoint, if TLDs were more limited then having one of those is a license to print money. The existence of more TLDs reduces domain name scarcity and is strictly better for us the users.
yjftsjthsd-h 3y ago
Alternatively, a few of these internal TLDs (.internal, .local, .home, .dev, .lan, ...) should have been reserved from the very start and then we should have intentionally leaned into the explosion of top level domains because shoving everything under .com was always kind of dumb. (But yeah, arguably what actually happened was a little bit the worst of both worlds and we get to deal with all kinds of fun growing pains until everything is brought to the new standard and hopefully we can stick with that.)

xg15 3y ago

Waiting for Google's announcement that they added this to the HSTS preload list, purely to anger admins and developers.

candiddevmike 3y ago
Why would you put this out into the universe?

photonbeam 3y ago

They should also do .home but I guess its too late for that

dinosaurdynasty 3y ago
they have .home.arpa

mjevans 3y ago

.lan. Please also reserve 'lan' since so many of us running from .local which Apple decided to takeover screwed over. Just reserve that it's for site specific / local / 'internal' use and that no other brilliant **hole can screw up a perfectly good network for another protocol or extension with it.

loudmax 3y ago
I tend to agree. `.internal` is too easy to misspell or misread. Not that it's that hard, but operating at scale you really want to make things as simple and easy as possible.
- kmoser 3y ago
  .lan might be easily misspelled as .Ian (or .1an), and the three letters look like a "normal" TLD. If anything, .local might be a better choice.
  - deleted 3y ago
    [deleted]
  - AnthonyMouse 3y ago
    Except that .local in 2024 is already in use for mDNS. Moreover, there is no such thing as a "normal" TLD. These are some existing public top level domains: .company .industries .network The reason .lan (or, for that matter, .local) isn't really that great is there will be large corporations wanting an internal use domain that spans multiple sites, which is neither local nor Local Area Network. But since it's likely to see widespread use, it does make sense for it to be short and so easy to type, which .internal is not. A decent one would be .pri, since a lot of companies already use it and "private" is what we're going for here.
  - kps 3y ago
    There's an obvious solution: .local for mDNS, and any (or all) of .Iocal, .locaI, or .IocaI for internal use.
- 3y ago

guluarte 3y ago

probably the only point is to milk .local, .dev, .home, etc.

whartung 3y ago

I don't understand how this will work. The "magic", as I understand it, of the 192.x.x.x network is that the Internet "knows" to not route it. Networking isn't my strength, so I don't know where, or what part of the my local network decides that 192.x.x.x can't be routed, and so doesn't. (I guess it's the router at the edge, but I don't know about internal routers.) But anyway, however it's manifest, the "magic" of it is that 192 is "safe" because, at the assorted gateways that are emplaced on the Internet, that traffic just "stops". So, how does ".internal" work? I mean, it's just a hostname, and DNS responds to queries about hostnames. Would it work similarly where the DNS server "knows" where a request came from, and thus, "knows" that "oh this is internal traffic, so if they're asking for an .internal domain name, I can safely respond the appropriate IP"? Is that how this supposed to work? Is that where the magic happens?

wmil 3y ago
I think it's just reserving .internal for that use. So a network admin has a guarantee that he'll never have to deal with an external .internal domain. Whereas something like .pri for private might one day be set up as a new TLD.
ranger207 3y ago
The way DNS works, if a local resolver doesn't have the record for a domain name, then it'll ask a higher level resolver. This proposal says that .internal will never be added to those higher level resolvers so if your local resolver doesn't have a record for a .internal hostname then locally that hostname doesn't exist
micw 3y ago
The "magic" is that the TLD is reserved for internal use. Before, people used different domains like ".lan", ".local". Problem with those is that it can happen at any time that one of these becomes a valid TLD which can cause a lot of unexpected side effects (starting from "cannot reach somenicepage.lan because my local DNS resolved *.lan" to "someone registered server.lan and can not issue valid SSL certificates for my internal service").
- 3y ago

gnabgib 3y ago

A prior recent discussion:[0] (322 points, 4 days ago, 227 comments) [0]: https://news.ycombinator.com/item?id=39152306 https://news.ycombinator.com/item?id=39152306

jawns 3y ago

Darn, I was really hoping they'd repurpose .test or .invalid!

spydum 3y ago

M&A integration going to be so fun!

teaearlgraycold 3y ago

Because it seems like most people that bother to comment on posts about .internal are upset I’ll say that I’m perfectly happy with this decision and will gladly migrate my internal services to this new TLD.

deleted 3y ago

[deleted]

ChrisArchitect 3y ago

[dupe]

1vuio0pswjnm7 3y ago

Personally, I have been running a personalised root.zone on the home network for decades now. If I want to disable or create a TLD, then I can do it in seconds. I often read about changes by ICANN that are supposed to stop internet users from needlessly sending queries to ICANN root servers. Because I run own personal root server on personal home network, I never send queries to ICANN root servers. If I want to know what's in the ICANN root.zone, I just download it. ftp -vd4 ftp://192.0.32.9/domain/root.zone Long time ago I wrote a C wrapper around certain stub resolvers that can be used to non-recursively, i.e., iteratively, resolve any domain name without using ICANN root servers at all; thus, it saves needless queries. The namservers for every TLD are contained in the binary. If the ICANN root.zone changes, which is rare, the binary can be updated in seconds.