4 ms·

This is a good reason to use domain names with a trailing dot, right? Such as https://news.ycombinator.com./ https://news.ycombinator.com./ to specify a FQDN, i

This is a good reason to use domain names with a trailing dot, right? Such as https://news.ycombinator.com./ https://news.ycombinator.com./ to specify a FQDN, instead of https://news.ycombinator.com/ https://news.ycombinator.com/ which is not fully qualified. The trailing dot keeps the DNS resolver from trying system domain suffixes.

farhaven 2y ago
In this case, that won't help, because `.box` is already a TLD and `fritz.box` has been registered by someone. Compare these two, the first is from my laptop connected to a Fritz!Box, the 2nd. one is from a server that's not connected to any sort of Fritz!Box: Expected result, resolved by the box itself: $ host fritz.box. fritz.box has address 192.168.178.1 fritz.box has IPv6 address fd00::e72:74ff:fece:6656 fritz.box has IPv6 address 2a02:908:616:a8c0:e72:74ff:fece:6656 Result if for some reason, DNS resolution fails on the box (e.g. you're not connected to your own network, someone disabled the resolver on the box, someone configured a non-box DNS on your machine): $ host fritz.box. fritz.box has address 45.76.93.104 fritz.box has IPv6 address 2001:19f0:6c00:1b0e:5400:4ff:fecd:7828
- FL410 2y ago
  Your query results make sense, since the Fritz!Box is authoritative for the (local) .box tld. Try again with google.com and google.com. If you're using Windows, it should append .fritz.box to the former, which is the issue here.
compumike 2y ago
I'll note that many websites do NOT support this: https://duckduckgo.com./ https://duckduckgo.com./ - blank page https://www.google.com./ https://www.google.com./ - 301 redirect to non-trailing-dot https://www.amazon.com./ https://www.amazon.com./ - works But even "works" means that the page makes lots of requests to other subdomains etc which do not have the trailing dot, so are still vulnerable for DNS hijack if you have search domains set on your system. So while using domains with a trailing dot is a strongly good idea for calling APIs, etc. it is not a practical solution for the end user with a web browser.

farhaven 2y ago

In this case, that won't help, because `.box` is already a TLD and `fritz.box` has been registered by someone. Compare these two, the first is from my laptop connected to a Fritz!Box, the 2nd. one is from a server that's not connected to any sort of Fritz!Box: Expected result, resolved by the box itself: $ host fritz.box. fritz.box has address 192.168.178.1 fritz.box has IPv6 address fd00::e72:74ff:fece:6656 fritz.box has IPv6 address 2a02:908:616:a8c0:e72:74ff:fece:6656 Result if for some reason, DNS resolution fails on the box (e.g. you're not connected to your own network, someone disabled the resolver on the box, someone configured a non-box DNS on your machine): $ host fritz.box. fritz.box has address 45.76.93.104 fritz.box has IPv6 address 2001:19f0:6c00:1b0e:5400:4ff:fecd:7828

FL410 2y ago
Your query results make sense, since the Fritz!Box is authoritative for the (local) .box tld. Try again with google.com and google.com. If you're using Windows, it should append .fritz.box to the former, which is the issue here.

compumike 2y ago

I'll note that many websites do NOT support this: https://duckduckgo.com./ https://duckduckgo.com./ - blank page https://www.google.com./ https://www.google.com./ - 301 redirect to non-trailing-dot https://www.amazon.com./ https://www.amazon.com./ - works But even "works" means that the page makes lots of requests to other subdomains etc which do not have the trailing dot, so are still vulnerable for DNS hijack if you have search domains set on your system. So while using domains with a trailing dot is a strongly good idea for calling APIs, etc. it is not a practical solution for the end user with a web browser.