Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am setting up a new Windows Server 2008-based domain and I am thinking about the domain name. Some time ago I read some documentation from Microsoft where they advised to use a .local suffix for "internal", corporate domains so that they do not clash with public, internet-exposed domains. For example, if my company is called Acme and our publicly visible domain (including a web site hosted with a colo provider) is, then our "internal" Windows domain should be named acme.local.

However, some time later I read some other documentation from Microsoft where they contradicted this and advised against it.

What do you think? What's the best way to name an internal domain? Any relevant experiences?

Edit. It seems that, despite of recommending against using the .local suffix for "internal" networks, Microsoft does impose it on some products such as SBS. Are there any reasons why using .local would be clearly a problem?


share|improve this question
Turns out you can actually create a non-.local domain on SBS. You need to create an answer file with the desired name, and provide that during the install. See… – Martijn Heemels Nov 9 '11 at 20:39

The .local domain suffix is not an FQDN and therefore 'non-routable'. This protects your domain somewhat from passing information outside of its perimiter.

For example, a user with a laptop on your internal-only domain plugs into their home network. It attempts to resolve and talk to its nearest DC. Your external is suddently batting off AD-related traffic and that traffic is flowing directly across the internet.

Worst-case scenario is that you pick an internal domain name, and someone else owns that same domain name externally. Now when your users go off-site, their machine attempts to resolve and contact the domain, only to have their traffic being sent to some random company that owns the name out in Timbuktu.

There's also some complications that may arise around internal and external DNS configuration if you choose to use the same name for internal and external domains. Even using a sub-domain of your external domain name (e.g. can lead to issues with DNS down the line, often in granting internal users access to your resources that are also available externally.

Best practice IMO is using mycompanyname.local for your internal domain, and (or such) for external.

share|improve this answer
Thanks Chris. In that case, why is Microsft discouraging from using .local now? – CesarGon Dec 1 '09 at 1:46
Hi Cesar. I've not encountered this position from MS. Can you link? Thanks. – Chris Thorpe Dec 1 '09 at 5:01
From "Generally, we recommend that you register DNS names for internal and external namespaces with an Internet registrar. This includes the DNS names of Active Directory domains, unless such names are subdomains of DNS names that are registered by your organization name.". I remember reading a more explicit argument against ".local" somewhere else in TechNet or MSDN, but I can't remember where! – CesarGon Dec 1 '09 at 19:38

Don't use .local. Bonjour for OS X uses .local to do its "magic." Accordingly, if you use .local for your TLD, you'll need to jump through additional hoops if you ever plan on adding Macs to your network. .lan is nice and short.

share|improve this answer

While not reserved .local is used by UPnP SSDP on the microsoft side of the world (apple uses it in Bonjour). I usually reccomend using .internal (note that .int is reserved)

share|improve this answer

Microsoft actually doesn't recommend a .local suffix. They recommend a non-routable, yet unique domain or subdomain under the control of your company. They use as an example.

share|improve this answer
I know, I know... that's what I read. Why is Microsoft discouraging people from using the .local suffix if it's an officially recognised non-routable pseudo-TLD? Also, how can I obtain a non-routable, yet unique domain or subdomain under the control of my company? I mean, how can I guarantee that it's non-routable? Thanks. – CesarGon Dec 1 '09 at 1:48
In Small Business Server you get no choice over your domain TLD. It's set to .local and that's it. Interesting that they don't recommend this... – Mark Henderson Dec 1 '09 at 1:50
say you own You can make your internal AD domain and not have it externally routable. Or you can register a domain name and just never put anything externally accessible on it. No DNS enteries, etc. – MDMarra Dec 1 '09 at 2:23
I see. Well, thanks. – CesarGon Dec 1 '09 at 2:29

I would also discourage the use of .local for the internal domain name. Choose something that's "not routable" but is significant to you and\or your organization.

share|improve this answer

If you have desktop linux systems that run AVAHI, you may run into trouble. I've been tracking this Ubuntu bug for nearly 3 years now where Ubuntu has trouble resolving DNS names that end in .local. So when I plug my linux laptop into a client network and try 'ssh admin@switch1.client.local' I end up with huge delays. There is a work-around in that bug, but it's still annoying. A lot of people have been recommending '.lan' instead of '.local'. On the other hand, you could always register a valid domain name or use a subdomain like

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.