What kind of tests would this break? Aside from the advice on the page itself (which, iirc, is new anyway), i'm wondering why any testing would actually involve the contents of design of the page. Just a weird 'sanity' check?

> For the desperate people whose tests all just broke...

The web page at example.com is maintained as a courtesy by IANA in order to explain the purpose of the example.com domain to wayward humans.

In the nomenclature of RFC 2119, one MUST NOT design computer systems that rely on the correct operation of an HTTP server at that domain. [0] Plus, it's _really_ rude to pound on a small-scale service being provided as a courtesy... go hit the home page of a tech megacorp (such as Microsoft or Google) or the status page for a major CDN (such as Cloudflare or Akamai) instead!

[0] I expect that someone here will want to pop up with a "gotcha" where they say something like "Oh, but IANA's email says that automated use is strongly recommended against, rather than prohibited and besides, they can't actually stop me from doing it!". To that, I reply "Sure, and standards-writers can't actually stop implementers that do the profoundly antisocial thing and do the things they MUST NOT. As any adult who's been paying attention to the world around them throughout their lives knows, there's only so much you can do to stop people who are very determined to be enormous assholes.".

I think we're on the verge of a big disruption coming for the example.com's business. I can see a SaaS opportunity. We can use AI to speed up time to market.

/s

That's an excellent reason to change the page design occasionally, so that people learn not to rely on it (the hard way if necessary).

If 1.1.1.1 ever stops responding to pings…

that's a really good point I'd not considered but if you just hash the response and the followups remain consistent (they do in this case)... you're gonna do just fine.

Yes, the revised version that alternated through the translations was posted a week ago on Monday. It was revised to no longer do that on Friday based on reasonable feedback that it wasn't the best idea for accessibility. Now all the translations are presented together, but your preferred language will be bumped to the top based on your browser language preference.

Aww, I was wondering if I was just looking at an older version. How disappointing. But I suppose, unsurprising given the conversation here. I'm sure such transitions would be bringing a surprising amount of instrumentation down.

It still probably is as it is now. But there's better arguments to support localization than transitions.

Thanks! Macroexpanded:

IANA's email about why example.com changed - https://news.ycombinator.com/item?id=49915060 - Sept 2026 (20 comments)

And the "statement" in this article is the text from that email, disingenuously edited. I'm not sure why, but it rubs me the wrong way.

You also failed to make it a link. In order to automatically create links, you should use the format https://example.com/ with scheme included. So in your case you'd do https://example.com/

Outrageous. How will people ever find it?!

More the DNS and DNSSEC and the like. Whether or not there is actually an HTTP server responding is irrelevant to whether or not those securely point anywhere but a malicious system.

Yeah there’s definitely a lot of sensitive data that gets sent to the domain just because of people not changing configs

I don't understand, what risk would there be if they chose _not_ to serve a site?

Cloudflare is the latest in a number of different CDN providers we've used to serve this over many years. I guess the question is, why is it important not to use a CDN?

IANA has a history of hosting even more important services with third-parties [0] [1], so this doesn't seem too problematic to me.

[0]: https://root-servers.org/

[1]: https://datatracker.ietf.org/doc/html/rfc6305.html

Same reason everyone else uses CF. Static page CDN only became too cheap to meter ~16 years ago, but if CF was around in the 90s IANA would have used it in the 90s too

NB. IANA isn't responsible for "root servers"

It's only responsible for root.zone, root.hints, .arpa and .int zones

AS112 is a volunteer project not a company

If it's a name in com/net/org only meant for documentation then why serve a page there for decades. If traffic is a problem then take it offline

Years ago IANA started requiring a user-agent header

FTP access to root.zone remains

*assets

Well, it's a popular website. By using Cloudflare I think they will save a lot of bandwidth and traffic because the page and assets can be cached.

I put this on all my websites that don’t have a favicon. I hate the default browser behavior of making a request to /favicon.ico without being asked.

It's quite sad to see incompetence at these levels. This is a static page that loads JS. They even inject styles via JS...

see https://news.ycombinator.com/item?id=42705284 for some historic detail on this

the 'about' link on example.com sends you here https://www.iana.org/help/example-domains

which does appear to say that yes, IANA hosts this

I believe your use is what they're trying to discourage.

example.com is meant to be legally allowed to be used in text such as "You visit a website (example.com) to browse the internet"

It is not meant to be queried by automated tests or used as a service.

> and was wondering why I saw a giant blob of dynamic nonsense instead of a small bit of markup.

It's 4.5x the size of the original. Which sounds bad, until you notice this means it's 2540 bytes and serves the explanatory text in 6x the number of languages. And it's now served with brotli compression, for a total of 1713 bytes. Or 334 bytes if you only request the HTML (which still has a usable page with the full English version of the explanatory text), like a basic scraper or a health check would. So for the vast majority of traffic, it's now half the size of the old version.

I notice it's been through several revisions, the pre-2025 version of the site most people are familiar with is 1270 bytes because it didn't make use of any minification, and it also triggered an unnecessary `/favicon.ico` request because it didn't use the trick to cancel the request.

> It's meant to be small [...], even if [...] it's not meant to be used that way

It is not, in fact, _meant_ to be used that way.

Reducing egress bandwidth, if you have automated clients that don't support JS you save precious bytes from being served by not embedding the SVG, which at example.com scale may be worth it

Simple answer is the article is wrong, I tried it with disabled JS and still see the SVG.

The whole article reads like something put together with AI, so maybe it’s not too surprising.

The government. It was a top secret skunkworks project to see if centering a <div> was possible.

Whose. Who's is a contraction of who + is

I've used http://www.com for that.

Same here! Yes, I used it as the well-known site that supported unencrypted http and no HSTS. Yes, I was one of those guys using the site "as a service" rather than simply documentation. Admittedly, it was perhaps interchangeable with other sites, but since it reliably worked for that purpose, I couldn't be arsed to find other ones.

Isn't there a dedicated site called nohttps or something? NeverSSL? I just tried http NeverSSL, and it redirected me to an https page with a random hostname and an Amazon SSL certificate!

Does example.com still function this way, with http and no HSTS? I noticed that my Chrome browser was immediately redirected in the customary way.

I find it pretty neutral, if maybe a bit bureaucratic. It explains what this domain does, and what it’s not supposed to be used for – that’s it.

>When a newbie learning programming

A newbie shouldn't test their programs using example.com

The language translation animation only lasted a few days. Now it’s static with English at the top and translations below.

You understand that the GIF would be larger than the JS, right? (Apart from other problems with this idea.)

Overkill for a web of humans loading sites in browsers. Not overkill for a dead internet with swarms of agents DDoSing everything in sight.

For a moment I thought you were saying ipinfo runs example.com.

Instead it just seems to be an advert for ipinfo on a post about example.com?

I think what you describe is exactly right, it has organically become a service and it is maintained with that in mind. That doesn't mean you shouldn't be clear about what its for and what should be avoided. Otherwise it is setting up an implicit contract that it will service those needs without limitation which turns it into an even bigger dependency.

Example.com is one of the sites I visit most often for troubleshooting my connection on the go. It's great for tickling a captive Wi-Fi login that didn't trigger properly.

This feels like a “falsehood developers think about localization.”

It’s always funny when I get French YouTube ads. As if YouTube is desperately trying to offload the adbuys anywhere they can by pretending that Canada must mean French.

I think the whole point is for it to be a static site that is easily distributed with little-to-no overhead, as it probably receives a non-trivial amount of traffic.

That assumes that (i) every region has a primary language, and (ii) everyone in that region speaks that language, both of which are false.

(And false often enough that guessing language based on IP address works badly in practice, I hear.)

Just check the Accept-Language header

I believe it's just using the official languages of the UN