4 ms·

http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/web-fully-qualified-domain-name.html http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/web... >

by derleth 14y ago

http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/web-fully-qualified-domain-name.html http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/web... > [The trailing dot in the domain name is] there for a reason. It made the domain name a fully qualified one, and thus unambiguous and not prone to search path spoofing. [snip] > For example: Posit that the web browser uses the BIND DNS Client library and the search example.net directive is present in that library's resolv.conf configuration file. > In the case that the URL provided by the user is http://example.com/ http://example.com/, a web browser would pass example.com to the BIND DNS Client library for looking up its IP address(es). Because the RES_DNSRCH option is set and the domain name does not end in a trailing dot, the BIND DNS Client library would take the domain name to not be in fully-qualified form and apply its "search path" mechanism. It would look up example.com.example.net. and, if that domain name happened to exist, would return the IP address(es) corresponding to that domain name instead of the IP address(es) corresponding to example.com.. The web browser would contact the content HTTP server at the former IP address(es) without the user being aware of it. > In the case that the URL provided by the user is http://example.com./ http://example.com./, a web browser would pass example.com. to the BIND DNS Client library for looking up its IP address(es). Because the domain name ends in a trailing dot, the BIND DNS Client library would take the domain name to be in fully-qualified form and not apply its "search path" mechanism. It would look up example.com. and, would return the IP address(es) corresponding to that domain name. > The fully-qualified domain name would thus prevent search path spoofing. (See RFC 1535 and RFC 1536 § 6 for more discussion of this.)

zimbatm 14y ago
The search path spoofing argument is weak. If you depend on a DNS resolver that spoofs domain searches, what guaranteed that it wouldn't simply spoof the full resolution as well ? In practice nobody uses the dot at the end except when writing BIND files.
- sp332 14y ago
  The DNS resolver doesn't need to spoof anything. If you're on network example.net and there's a server on that network called "google" then typing "google" into your address bar will resolve to google.example.net in a completely legitimate way, with no DNS spoofing.
- AnthonyMouse 14y ago
  >If you depend on a DNS resolver that spoofs domain searches, what guaranteed that it wouldn't simply spoof the full resolution as well ? A lot of DHCP servers do DDNS. That allows you to change your computername and get your computer registered in the local DNS as whatever-you-want followed by the local domain which is usually in the search domains list. You can't get registered as "google.com" but you can get registered as "google.com.example.com" when "example.com" is in the search domain, and now you're "google.com" (but not "google.com.") to everybody on the local network.
  - zimbatm 14y ago
    Yeah agreed but what's the most likely outcome. You rewriting your urls or you fixing your network / kicking the offending user ? You're not only impacting browsing experience but also all the scripts that are trying to connect to the domain like your google drive sync agent.
    - AnthonyMouse 14y ago
      >Yeah agreed but what's the most likely outcome. You rewriting your urls or you fixing your network / kicking the offending user ? Who is "you"? The person who can fix the URLs is rarely the same person who can kick the offending user off the local network. If the latter person is not doing their job (or is about to but hasn't yet), you're still better off fixing your URLs. >You're not only impacting browsing experience but also all the scripts that are trying to connect to the domain like your google drive sync agent. You don't have to break the old stuff, just start using the final dot for new stuff.

by derleth 14y ago

zimbatm 14y ago

The search path spoofing argument is weak. If you depend on a DNS resolver that spoofs domain searches, what guaranteed that it wouldn't simply spoof the full resolution as well ? In practice nobody uses the dot at the end except when writing BIND files.

sp332 14y ago
The DNS resolver doesn't need to spoof anything. If you're on network example.net and there's a server on that network called "google" then typing "google" into your address bar will resolve to google.example.net in a completely legitimate way, with no DNS spoofing.
AnthonyMouse 14y ago
>If you depend on a DNS resolver that spoofs domain searches, what guaranteed that it wouldn't simply spoof the full resolution as well ? A lot of DHCP servers do DDNS. That allows you to change your computername and get your computer registered in the local DNS as whatever-you-want followed by the local domain which is usually in the search domains list. You can't get registered as "google.com" but you can get registered as "google.com.example.com" when "example.com" is in the search domain, and now you're "google.com" (but not "google.com.") to everybody on the local network.
- zimbatm 14y ago
  Yeah agreed but what's the most likely outcome. You rewriting your urls or you fixing your network / kicking the offending user ? You're not only impacting browsing experience but also all the scripts that are trying to connect to the domain like your google drive sync agent.
  - AnthonyMouse 14y ago
    >Yeah agreed but what's the most likely outcome. You rewriting your urls or you fixing your network / kicking the offending user ? Who is "you"? The person who can fix the URLs is rarely the same person who can kick the offending user off the local network. If the latter person is not doing their job (or is about to but hasn't yet), you're still better off fixing your URLs. >You're not only impacting browsing experience but also all the scripts that are trying to connect to the domain like your google drive sync agent. You don't have to break the old stuff, just start using the final dot for new stuff.