The trailing dot in domain names matter (opens in new tab)

(lacot.org)

68 pointsDamin0u1y ago18 comments

18 comments

This article, and the article linked upthread, is giving a novel definition of FQDN.

https://en.wikipedia.org/wiki/Fully_qualified_domain_name

https://datatracker.ietf.org/doc/html/rfc1594#section-5

The trailing dot (root zone) is implicit in a Fully Qualified Domain Name. The trailing dot is not what makes a domain name fully qualified.

mattashii1y ago

Lacking the trailing dot that anchors the FQDN to the root zone, how would I be able to determine that I need to use the global root zone rather than local lookups? The DNS spec allows users to have local zones named similarly to all TLDs, which would be authorative responders for DNS requests that don't anchor to the root with a trailing dot - or have I missed something?

cedilla1y ago

You are completely right - but this distinction is just dead today. I read a lot of technical documentation that involves FQDNs and they almost never include a dot. Adding the dot often leads to problems as example.com and example.com. will not be normalized. End users also are just befuddled when they encounter the extra dot.

On practice, instead of trying to follow a dead specification it makes your live easier to never use local zones and always use FQDN search domains if you can. Having a local zone that appears in the public suffix list is outright dangerous, and with how fast that grows, no local name is safe.

echoangle1y ago

Is duplicate content really a problem for search engines? I thought you just have to set the canonical URL and it’s ok.

em-bee1y ago

not only this, if webservers can treat both versions as the same, and if in fact the specification treats them as the same, then so should search engines. if there is a problem, then the search engines are at fault. it seems ridiculous that i have to configure a webserver to add a redirect in order to avoid this. actually i think this is something that could also be fixed in the browser. i just checked, firefox treats them as separate domains. i don't think it should.

in practice of course this is not a problem because nobody really puts a trailing dot on hostnames.

Kwpolska1y ago

I would also expect search engines to (a) ~never end up on a URL with a dot, unless someone explicitly linked to one, (b) merge the two sites on their end if they appeared.

m4631y ago

A lot of people learn about things like this configuring DNS servers.

If you're setting up bind and forget a trailing dot, it is quite easy to get extra weird resolver queries like foo.com.example.com before foo.com is resolved.

konimex1y ago

On this topic, I believe it's obligatory to bring up JdeBP's comment: http://jdebp.info./FGA/web-fully-qualified-domain-name.html

fanf21y ago

The web has never coherently dealt with the trailing dot issue. Roughly the only standard that makes a clear requirement is for TLS PKIX certificates, which cannot have a trailing dot. So to avoid certificate matching bugs it’s best to redirect a trailing-dot domain to a no-trailing-dot domain. Sadly web servers do not make this easy, and traditionally they encourage configurations that do unpredictably wrong things with requests that have trailing-dot domains. It sucks.

AStonesThrow1y ago

Chris Siebenmann blogged this, 2 months ago: https://utcc.utoronto.ca/~cks/space/blog/tech/DomainDotAtEnd...

ratg131y ago

This is a commonly used attack vector by threat actors to get around various defenses.

kristopolous1y ago

This reminds me of how you can use different bases for urls. Take http://3520653007/item?id=41982974 or http://032166163317/item?id=41982974 for example

janjones1y ago

For anyone wondering, this is just the IP address written in a different form: https://stackoverflow.com/a/56814434

tape_measure1y ago

Adding this dot used to be a way to bypass the paywall on nytimes.com. It's been fixed in the last 2 years or so.

lanstin1y ago

Don't leave it out in your named config files!

_def1y ago

This seems to be content marketing for their company.

imwillofficial1y ago

I found it fascinating.

_def1y ago

I also think it is interesting. I didn't want to dismiss it - content marketing can still contain valuable information, that's the whole point of it after all.

j / k navigate · click thread line to collapse

18 comments

AStonesThrow1y ago

This article, and the article linked upthread, is giving a novel definition of FQDN.

https://en.wikipedia.org/wiki/Fully_qualified_domain_name

https://datatracker.ietf.org/doc/html/rfc1594#section-5

The trailing dot (root zone) is implicit in a Fully Qualified Domain Name. The trailing dot is not what makes a domain name fully qualified.

mattashii1y ago

cedilla1y ago

echoangle1y ago

Is duplicate content really a problem for search engines? I thought you just have to set the canonical URL and it’s ok.

em-bee1y ago

in practice of course this is not a problem because nobody really puts a trailing dot on hostnames.

Kwpolska1y ago

I would also expect search engines to (a) ~never end up on a URL with a dot, unless someone explicitly linked to one, (b) merge the two sites on their end if they appeared.

m4631y ago

A lot of people learn about things like this configuring DNS servers.

If you're setting up bind and forget a trailing dot, it is quite easy to get extra weird resolver queries like foo.com.example.com before foo.com is resolved.

konimex1y ago

On this topic, I believe it's obligatory to bring up JdeBP's comment: http://jdebp.info./FGA/web-fully-qualified-domain-name.html

fanf21y ago

AStonesThrow1y ago

Chris Siebenmann blogged this, 2 months ago: https://utcc.utoronto.ca/~cks/space/blog/tech/DomainDotAtEnd...

ratg131y ago

This is a commonly used attack vector by threat actors to get around various defenses.

kristopolous1y ago

This reminds me of how you can use different bases for urls. Take http://3520653007/item?id=41982974 or http://032166163317/item?id=41982974 for example

janjones1y ago

For anyone wondering, this is just the IP address written in a different form: https://stackoverflow.com/a/56814434

tape_measure1y ago

Adding this dot used to be a way to bypass the paywall on nytimes.com. It's been fixed in the last 2 years or so.

lanstin1y ago

Don't leave it out in your named config files!

_def1y ago

This seems to be content marketing for their company.

imwillofficial1y ago

I found it fascinating.

_def1y ago

I also think it is interesting. I didn't want to dismiss it - content marketing can still contain valuable information, that's the whole point of it after all.

j / k navigate · click thread line to collapse