4 ms·

This is why I never use these IANA-reserved domains like .test, .example, .invalid, .localhost. I always make up some impossible domains like domain.tmptest O

by hu3 9mo ago

This is why I never use these IANA-reserved domains like .test, .example, .invalid, .localhost. I always make up some impossible domains like domain.tmptest Otherwise you're one DNS "misconfiguration" away from sending dev logs and auth tokens to some random server. > Since at least February 2020, Microsoft's Autodiscover service has incorrectly routed the IANA-reserved example.com to Sumitomo Electric Industries' mail servers at sei.co.jp, potentially sending test credentials there.

whizzter 9mo ago
.example is probably far safer than example.com. https://www.akamai.com/blog/security/autodiscovering-the-great-leak https://www.akamai.com/blog/security/autodiscovering-the-gre... According to it, it seems that if someone registers autodiscover.com then example.com lacking autodiscover.example.com will make Outlook try checking if autodiscover.com has an entry. It's just a braindead system.
jsheard 9mo ago
It's all fun and games until Donuts buys .tmptest for some reason.
wongarsu 9mo ago
brb, just filing paperwork to apply for the .tmptest gTLD /s
- lagniappe 9mo ago
  I suspect you'd download a car.
- ThePowerOfFuet 9mo ago
  $100K
  - thequux 9mo ago
    $227k just to apply, and another few hundred thousand in legal, compliance, and contracting to reach delegation. Source: I'm on the board of dotMeow and wrote the financial plan
Cthulhu_ 9mo ago
Would that really make a difference in this case? It's a configuration error / bug in Microsoft's discovery server, they could have a fallback that goes "any unknown address, return this .jp address".
tialaramex 9mo ago
It so happens that in this very specific case your obviously bad choice didn't make anything worse, that doesn't make it a good choice. "Aha, the defective trucks only cause injuries to people who have their hands on the wheel at highway speeds, but I've never bothered holding the wheel at high speed, I just YOLO so I wouldn't be affected" If people had used IANA's reserved TLDs they too would be unaffected because although Windows will stupidly try to talk to for example autodiscover.example that can't exist by policy and so the attempt will always fail.
larrik 9mo ago
And then you fire off 100k emails, they all bounce, and your mail service shuts you off...
dc396 9mo ago
As others have pointed out, using 'tmptest' works until someone buys tmptest -- unlikely, but people will buy anything these days. I always use the ISO-3166 "user-assigned" 2-letter codes (AA, QM-QZ, XA-XZ, ZZ), with the theory being that ISO-3166 Maintenance Agency getting international consensus to move those codes back to regular country codes will take longer than the heat death of the universe, so using them for internal domains is probably safe.
xaerise 9mo ago
The correct one to use is .internal It is reserved by ICANN since 2024-07-29. https://en.wikipedia.org/wiki/.internal https://en.wikipedia.org/wiki/.internal https://www.ietf.org/archive/id/draft-davies-internal-tld-00.html https://www.ietf.org/archive/id/draft-davies-internal-tld-00...
- fc417fc802 9mo ago
  You can also safely use .home .corp and .mail as those have been explicitly rejected by ICANN on the basis that they would cause widespread naming conflicts. I have my devices configured to redirect queries against .home to a local nameserver, leaving .local open for avahi.

by hu3 9mo ago

whizzter 9mo ago

.example is probably far safer than example.com. https://www.akamai.com/blog/security/autodiscovering-the-great-leak https://www.akamai.com/blog/security/autodiscovering-the-gre... According to it, it seems that if someone registers autodiscover.com then example.com lacking autodiscover.example.com will make Outlook try checking if autodiscover.com has an entry. It's just a braindead system.

jsheard 9mo ago

It's all fun and games until Donuts buys .tmptest for some reason.

wongarsu 9mo ago

brb, just filing paperwork to apply for the .tmptest gTLD /s

lagniappe 9mo ago
I suspect you'd download a car.
ThePowerOfFuet 9mo ago
$100K
- thequux 9mo ago
  $227k just to apply, and another few hundred thousand in legal, compliance, and contracting to reach delegation. Source: I'm on the board of dotMeow and wrote the financial plan

Cthulhu_ 9mo ago

Would that really make a difference in this case? It's a configuration error / bug in Microsoft's discovery server, they could have a fallback that goes "any unknown address, return this .jp address".

tialaramex 9mo ago

It so happens that in this very specific case your obviously bad choice didn't make anything worse, that doesn't make it a good choice. "Aha, the defective trucks only cause injuries to people who have their hands on the wheel at highway speeds, but I've never bothered holding the wheel at high speed, I just YOLO so I wouldn't be affected" If people had used IANA's reserved TLDs they too would be unaffected because although Windows will stupidly try to talk to for example autodiscover.example that can't exist by policy and so the attempt will always fail.

larrik 9mo ago

And then you fire off 100k emails, they all bounce, and your mail service shuts you off...

dc396 9mo ago

As others have pointed out, using 'tmptest' works until someone buys tmptest -- unlikely, but people will buy anything these days. I always use the ISO-3166 "user-assigned" 2-letter codes (AA, QM-QZ, XA-XZ, ZZ), with the theory being that ISO-3166 Maintenance Agency getting international consensus to move those codes back to regular country codes will take longer than the heat death of the universe, so using them for internal domains is probably safe.

xaerise 9mo ago

The correct one to use is .internal It is reserved by ICANN since 2024-07-29. https://en.wikipedia.org/wiki/.internal https://en.wikipedia.org/wiki/.internal https://www.ietf.org/archive/id/draft-davies-internal-tld-00.html https://www.ietf.org/archive/id/draft-davies-internal-tld-00...

fc417fc802 9mo ago
You can also safely use .home .corp and .mail as those have been explicitly rejected by ICANN on the basis that they would cause widespread naming conflicts. I have my devices configured to redirect queries against .home to a local nameserver, leaving .local open for avahi.