ICANN approves use of .internal domain for your network

Oh, that's LAN - I thought you'd put ian and I was trying to get the joke. Stupid sans-serif fonts.

Use it anyway.

I switched from .local to .honk and I'm never looking back.

I was using .local, but it ran into too many conflicts with an mDNS service I host and vice versa. I switched to .lan, but I'm certainly not going to switch to .internal unless another conflict surfaces.

I've also developed a host-monitoring solution that uses mDNS, so I'm not about to break my own software. 😅

It's also second only to .com in terms of query volume in ICANN's Magnitude statistics with 980 mil vs .internal's 60 mil. Not sure if that makes it a de facto standard, but it's close.

I went with .home and so far the problems are within reason

I still haven't heard a convincing argument to not use .local and I see no reason to stop.

I’ve had issues with .local on my Android device. Straight up doesn’t work. I had to change to .lan

What are you doing step-LAN?

I used to wonder why porn sites aren't required to use '.cum' instead of '.com'...

some sex toys are external

If you mean properly signed certificates (as opposed to self-signed) you'll need a domain name, and you'll need your LAN DNS server to resolve a made-up subdomain like lan.domain.com. With that you can get a wildcard Let's Encrypt certificate for *.lan.domain.com and all your https://whatever.lan.domain.com URLs will work normally in any browser (for as long as you're on the LAN).

Nothing, this is not about that.

This change gives you the guarantee that .internal domains will never be registered officially, so you can use them without the risk of your stuff breaking should ICANN ever decide to make whatever TLD you're using an official TLD.

That scenario has happened in the past, for example for users of FR!TZBox routers which use fritz.box. .box became available for purchase and someone bought fritz.box, which broke browser UIs. This could've even been used maliciously, but thankfully it wasn't.

Either ignore like I do or add a self signed cert to trusted root and use that for your services. Will work fine unless you're letting external folks access your self hosted stuff.

Quite literally my first thought. Great, but I can't issue certs against that.

One of the major reasons I have a domain name is so that I can issue certs that just work against any and all devices. For resources on my network. Home or work, some thing.

To folks recommending a private CA, that's a quick way to some serious frustration. For some arguably good reasons. On some devices I could easily add a CA to, others are annoying or downright bullshit, and yet others are pretty much impossible. Then that last set that's the most persnickety, guests, where it'd be downright rude!

Being able to issue public certs is easily is great! I don't use .local much because if it's worth naming, it's worth securing.

You can set up your own CA, sign certs and distribute the root to every one of your devices if you really wanted to.

I found options like .local and now .internal way too long for my private stuff. So I managed to get a two-letter domain from some obscure TLD and with Cloudflare as DNS I can use Caddy to get Let's Encrypt certs for hosts that resolve to 10.0.0.0/8 IPs. Caddy has plugins for other DNS providers, if you don't want to go with Cloudflare.

Accept them

Maybe browsers could be configured to automatically accept the first certificate they see for a given .internal domain, and then raise a warning if it ever changes, probably with a special banner to teach the user what an .internal name means the first time they see one

Try using .com for your internal network and watch the problems arise. Their choice to reserve .internal helps people avoid fqdn collisions.

See also https://traintocode.com/stop-using-test-dot-com/

Certain domain names are locally routed only. So if you use internal or local as a tld, you can just assign whatever names you want and your computer won't go looking out on the internet for them. This means you and I can both have fileserver.local as an address on our respective network without conflicting. It's the URI equivalent of 192.168.0.0/16.

YouCANN do anything you want?

The value of the DNS is that we all use the same one. You can declare independence, but you'd lose out on that value.

But what if your name is not Ian...

Tai'shar Malkier!

Well, I just realized I completely goofed, because I went with .arpa instead of .home.arpa, due to what was surely not my own failings.

So I guess I’m going to be changing my home’s domain anyway.

It was just always so annoying having to go into the iPhone keyboard punctuation twice for each domain

Except when it doesn't. It can have issues around multicast dns.

I've had issues with .local on my Android device. Straight up doesn't work. I had to change to .lan

It just means .internal won't be relayed out on the internet, as it will be reserved for local only.

Good luck with that. .local is reserved for mDNS calls, and not every OS treats it the same way. Ask me how I know.

I used to use .local but mDNS can get confused, .home has been fine though

home.arpa

Yes, I've been using this too. Here's the RFC for .home.arpa (in place of .home): https://www.rfc-editor.org/rfc/rfc8375.html

i loved that it was an option. not sure why it was changed.

You can milk anything with nipples!