When working in an intranet, it's often necessary to set up links to other computers (HTTP hyperlinks or shortcuts, hostname in various server config files, SSH shortcuts etc.).

In all these cases, technically I can either use the fully qualified name of the target system (e.g. http://server01.mydomain.local/ ), or just the hostname (e.g. http://server01/ ).

Technically, both should be the same (as long as the domain search list is set up correctly). However, I obviously need to choose one option.

So, is there any reason to prefer one over the other? What is the better option, especially with regards to later changes in the network, and to avoid maintenance problems?

  • 3
    Except that you should never use .local; always use a subdomain of the company's actual domain name, e.g. .intranet.example.com. – Michael Hampton Feb 18 '14 at 15:17
  • @MichaelHampton: Good point. I added it to my answer. – sleske Feb 18 '14 at 15:44

Use a local domain name.

If you use just single label hostnames you run the risk of clashing with the new gTLDs when they start popping up over the next few years.

It's also a good idea to avoid sharing URLs with single labels in them - if an employee clicks on an abbreviated URL whilst offsite there's no telling where they might end up, and worse still they might even end up leaking their internal authentication credentials.

  • Good point about people accidentally logging in to the wrong site with a short URL - didn't think about the security implications. – sleske Oct 9 '11 at 16:54
  • Also note that accidentally logging in to the wrong site is rather likely in a "foreign" network, because intranets often have some hosts that use "generic" hostnames like www, wiki, mail etc. For these names, it is quite likely that they will exist in the foreign network, too. – sleske Feb 18 '14 at 13:36

Another reason to use fully qualified names:

X.509 certificates for TLS/HTTPS use fully qualified hostnames (or at least they should; see e.g. Unqualified Names in the SSL Observatory). So if you access a server using HTTPS, you will get a host name mismatch during certificate verification if you do not use the fully-qualified name.

Note that the requirement for TLS/HTTPS is even stricter than just to use a fully qualified name: The domain part must actually be a valid domain registered to the person/company requesting the certificate - so a name like server01.localnet will not do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.