Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I recently learned that a fully qualified domain name ends in a dot, e.g. www.microsoft.com.. Why do I almost never see this? We casually toss around www.microsoft.com, a relative domain name, without a second thought.

It's not mere pedantry, because it seems there's a security issue: someone in your network could create www.microsoft.com.example.com. to hijack your requests to www.microsoft.com. Why doesn't the internet community have a tradition of using genuinely fully qualified domain names?

Edit:

Thanks to everyone who answered. I misunderstood when domain suffixes were added.

If I understand correctly: First the application turns your input into a fully qualified domain name, by appending suffixes or just a dot. Then the formal DNS query is sent to a nameserver.

share|improve this question
    
Interesting question... –  Massimo Apr 21 '10 at 20:23
2  
IF someone takes over your dns servers (or puts up conflicting dhcp server handing out a custom DNS) it would be more effective to just override www.microsoft.com ... –  Zypher Apr 21 '10 at 20:25
    
@Zypher, nods if I can break your DNS server I wouldn't spend time messing around with things that depend on client appending an DNS suffix. –  Zoredache Apr 21 '10 at 20:35

5 Answers 5

Every reference I've ever read about DNS makes it perfectly clear that when performing a DNS lookup the trailing dot is implied and therefore redundant. There is absolutely no advantage in adding it.

share|improve this answer
    
+1. That's also been my understanding. The trailing . (root domain) is assumed and implied and coded into most (if not all) DNS client resolvers. –  joeqwerty Apr 21 '10 at 23:25
    
@Chris S - no, you'll never get a double dot. The libraries aren't stupid enough to add a trailing dot if there's already one there. In any case, the wire protocol doesn't actually use dots. –  Alnitak Apr 23 '10 at 13:04

This is straight from Wikipedia:

In the Domain Name System, and most notably, in DNS zone files, a fully qualified domain name is specified with a trailing dot

It is never used outside of DNS zones, thats probably why you never see it. But in DNS zones, it has HUGE significance. That little dot can break a lot of very important things.

share|improve this answer
    
It actually is used outside zones: http://to/ will try to connect a server in your LAN, http://to./ - to the insane URL shortener. –  grawity Apr 23 '10 at 14:05
    
@grawity that's just a Windows anachronism. OS X and UNIX-like systems don't exhibit this behaviour. Windows can be changed to behave the way everything else does by altering the registry. –  andrewtj Apr 25 '10 at 3:33
    
@andrewtj Not exactly. If I have search foodomain.tld in my resolv.conf, then opening to would first try to.foodomain.tld. –  grawity Apr 25 '10 at 12:42
    
@grawity yes but on OS X and UNIX-a-likes if "to.foodomain.tld" fails, they will try to resolve "to" as a single label DNS name — as far as I know Windows won't without a registry tweak. –  andrewtj Apr 26 '10 at 0:30
1  
@andrewtj I guess that's true. (I'm not going to argue about the differences between "/etc/foo.conf tweak" and "registry tweak".) –  grawity Apr 26 '10 at 13:28

Because people are lazy, and will type the shortest thing they can when given an option. See also no-www.org.

If you don't trust your network you could completely get rid of any DNS suffixes on your computer and point at some other DNS servers. Or even better create a VPN to some network you do trust.

Typically only your administrator has the ability to add records to the DNS server. If your sysadmin wants to hijack your web requests there are many other more effective ways from him to do that. If a blackhat can get control of the DNS servers you are pointing at they could possibly serve any address for any domain they want, even the valid fully qualified domain. Serving names depending on the client appending a suffix wouldn't be a very useful attack.

share|improve this answer
1  
no-www fundamentally bothers me. Internet > www –  Warner Apr 21 '10 at 20:35
    
/me chortles at the fact that the way you typed it, that URL has the trailing dot! –  GAThrawn Apr 23 '10 at 12:09
    
@GAThrawn Except it's not an URL if it does not have a scheme –  grawity Apr 26 '10 at 13:28

The relative name "www.bankofamerica.com.example.com." is only exploitable by those who told your computer that it's domain is "example.com". This comes from either DHCP or by the person who setup the computer.

In order to exploit that, your DHCP provider (your company or your ISP) would have to create these clearly fishy names in their DNS.

In reality, they don't have to bother to do this to attack you (if they wanted to). They're your ISP. They already control your DNS and in fact they control your traffic as well.

They could just as easily and more reliably capture and redirect your traffic by capturing and redirecting your traffic or hijacking all your DNS requests, not just the ones that look up wacky relative names (such as www.google.com.comcast.net.). Some ISPs already "attack" their customers in this way by redirecting "no such domain" errors from upstream DNS providers with their own advertisement pages.

So, you have to trust them anyhow, so you may as well trust them (and verify your ssl certificates!).

Lastly, the terminal dot on a hostname will break lots of web servers. For instance, the stack trilogy servers freak out if you go to "http://stackoverflow.com."

share|improve this answer

When the trailing dot is omitted and you do not have a search path, it does not matter. But when you have a search path it does, for the resolver will first try to append the domain names in the search path and resolve them and if unresolved will try the name alone. When .cs was a working ccTLD it was used as an example to demonstrate this: When you pinged host.cs was host.cs. that was replying or host.cs.dom.ain?

The trailing dot does matters, but the situations that one will observe this are very few.

You may want to read A "tinyurl" service for your domain to see a clever use of the search path and the trailing dot.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.