Hacker News new | ask | show | jobs
by ekimekim 3124 days ago
Having read https://tools.ietf.org/html/rfc6761, I have a use-case which I've seen often but doesn't seem to be covered: What TLD should I use for internal, production domains? ie. names that are only resolvable within my network, but are definitely not "test" domains and calling them .test would generate confusion.

Mostly I tend to see companies either inventing an unregistered TLD, often using their own company name, or they use ".local", which can cause issues - some systems treat this name specially.

A third option would be putting all internal names under an "internal.yourcompany.com", but that's long and annoying.

Ideally I'd like to see a ".private" or ".internal" TLD recognised as special-use under the same semantics as ".test". Does anyone have any better option?

2 comments

> What TLD should I use for internal, production domains?

The currently safe way is to use a public domain that you own (you could use a distinct subdomain for this, which is not publicly exposed but which is in DNS on your internal network; e.g., intranet.example.com if you own example.com); as you note, this gives a long full domain.

> Mostly I tend to see companies either inventing an unregistered TLD, often using their own company name, or they use ".local", which can cause issues - some systems treat this name specially.

“.local” is a reserved domain with special semantics, see RFC 6762.

> Ideally I'd like to see a ".private" or ".internal" TLD recognised as special-use under the same semantics as ".test".

I'm kind of surprised that we haven't seen an RFC gain acceptance for this already, but I expect something like this will happen and be registered with the IANA special use domains registry.

My colleague has written a draft RFC for this very use case, in fact: https://datatracker.ietf.org/doc/draft-wkumari-dnsop-interna...

It's still very much in the early stages though.

Even then, though, you can end up with all sorts of problems during mergers/acquisitions when previously separate intranets end up getting joined, exposing naming conflicts. Ultimately you always need to use a globally unique namespace, so either use a real domain name (guaranteed unique) or do something unique on top of .internal, e.g. .yourcompanyname.internal (still not guaranteed unique, but better).

See also: https://jdebp.eu/FGA/dns-use-domain-names-that-you-own.html

The third option IMHO is the best, although I'd consider using a domain just for this instead of a subdomain. (can be shorter and uglier then as well)