Do we know if leakage is currently under test?

This test is poorly designed for .lan because the opposite problem is more likely: that many people using .lan will have any resolution attempts swallowed by their routers. This is certainly true for OpenWrt and GL.iNet. It may be true for Unifi AmpliFi, which reserves .lan by default. It's potentially true for other vendors when .lan is configured as the local domain (which many online guides suggest people do).

uncannily fritz.box even displays AVM.de style text at present and a Grand Cayman technical contact.

i can't understand why AVM don't allow this to be configured!

RFCs were originally formalization of what was being used in practice, home.arpa was chosen apparently for reasons of beauracratic convenience rather than what would best serve existing users, who all would prefer .lan and continue to do so since that was published in 2018

and most people dont use it because its an incredibly poor name.

It would be awesome if Ubiquity will actually follow this RFC too. The Amplifi product line from Ubiquity have `.lan` support but no `home.arpa`.

[0]: https://amplifi.com/

But why is it that nowadays, it's enough for a vulture corporation to have enough money to be able to privatize a part of the "web" that is in common usage (in the sense of common good) since so long?

It should be logical even without thinking that the request have to be rejected.

yeah I'm not going to tell my s/o to use plex.home.arpa. instead of plex.lan

That's nice and all, but OpenWrt (and its use of .lan) predates this particular RFC by a rough 14 years.

I hope the gTLD application gets struck down.

But what if my LAN is in the garage?

Internal. is also an valid option. I moved everything there about a year ago

.internal as well I believe

It's always hard because when you contrive possible examples of how it goes wrong, every single example sounds contrived because of course they are contrived.

Sure one day your printer might start spewing random json code meant for some microservice of the rightful IP owner.

Sure the IP's might be owned by the Air Force and one day they might start getting traffic from your pos ipad that they decide looks like an attempt to attack one of their internal secret networks...

Sure one day traffic meant to go to your printer ends up flooding and dossing a windmill controller, preventing the rightful operators from turning it the right direction during bad weather and causing $25M damage...

And of course the real failures are more like, only people from the Maldives can't send email to your email server, a failure with no impact.

The problem is that they wouldn't be able to talk to any internet service that legitimately used those addresses. Whether that was likely to be a problem very much depends on whose addresses they were.

I used to do consulting for companies that weren't connected to the Internet yet. This was the early-mid-1990s and "Private IP Network" assignments literally did not exist until 1996.

Therefore, people who weren't on the Internet yet, or didn't expect to be connected to any particular WAN, or even had their own intranet WAN without public access, they improvised like crazy. Like, whatever IP address ranges worked for them, they just plugged 'em in.

Since it was indeed early, and IPv4 networks were being handed out like candy, the savvy companies just applied for their own network space, hopefully of an appropriate size. The applications at the time didn't specify or require that they route the traffic or put it into BGP, so registering your intranet with IANA was the right thing to do, and future-proof. Unfortunately, in the wild-west early days before CIDR, IANA needed to find either a chunk of class C, or class B without significant nuance. And that is how Apple, HP, and Ford came to control gigantic swaths of "Class A" space.

Renumbering private networks was one of the nightmare scenarios of consulting firms like mine. And it hasn't really stopped, I suppose. If your company does an M/A their private LANs may clash, and they either renumber or they NAT.

By the way, OpenWRT isn't supposed to be using ".lan". That's a ridiculous non-compliant behavior. Someone should've stopped that, long ago.

There are ways to subdomain properly and IETF has provided dedicated TLDs for it even now, but back in the day, it was not easy, and I get it. When I needed DNS for my homelab, I discovered that the best practice among bad practices was to subdomain your ISP's. Like, make up a fictitious subdomain and hang it off their real one. Then your DNS had an anchor in reality, even if it was all made up, never delegated, unreachable, unresolvable from the outside.

There's a good reason to do this if you can't be certain what reserved subnets are used in a given network and you absolutely need a static ip for some reason.

At least that's the conclusion I've arrived at at some point, but I don't remember what was the exact use case anymore.

However there are still several global IPv4 ranges that are not local reserved ranges but are effectively reserved and you could use them if you really want to without any issues.

When I was working with Linux based kiosks and PoS systems I had a good share of issues with the Microsoft MVP signature use of .local on their forests. Back then their training material recommended .local for Active Directory services.

In the UK, Virgin Media uses UK Ministry of Defence's 25.0.0.0/8 for CGNAT

Given that the plain text meaning of .lan is even more unambiguous than .home, it's overwhelmingly likely that .lan will suffer the same fate, where delegation was "indefinitely deferred".

> Unfortunately there doesn't seem to be a way to tell ICANN that .lan has been widely used

ICANN isn't the DNS police, and lobbying them is pointless. We should campaign for open-source router projects[0], commercial hardware developers[1], DNS resolver developers, and major providers[2] to collectively designate commonly used private TLDs such as .home, .lan, .intranet, and .private as non-resolvable in public DNS.

Local resolution would continue to work, but these names would never be forwarded upstream. With sufficient adoption, we'd establish a de facto reservation and make the TLDs commercially worthless, regardless of what ICANN decides.

--

[0] There is precedence here. OpenWrt already reserves .lan in its default dnsmasq configuration.

[1] There is precedence here. GL.iNet inherits from its OpenWrt roots. Ubiquiti uses .lan as the default in its AmpliFi products. MikroTik documents it as part of its network-discovery mechanism.

[2] I'm thinking of Cloudflare, Quad9, and others.

`.internal` and `.local` are safe and won't be used in the future. There are reserved for internal networks

Then why hasn't there been a gTLD reserved for local use? The only ones that are reserved are .local and .home.arpa. .local is out, since it is entirely for use with mDNS / Bonjour.

That leaves .home.arpa, which is very awkward and only a thing since 2018 (my home network's use of .lan definitely predates this). Especially as a non US citizen. It also seemed so far that .lan was the "unofficial" gTLD to be used, since much software like OpenWRT was already using it anyway.

Either way: making .lan internet routable seems entirely unhinged to me. LAN has always been the acronym for Local Area Network. Why would anyone sane think that it is a good idea to make this into a gTLD that can be internet routable? The only way I see forward to do this justice, is to only allow RFC 1918 and IPv6 addresses that are within the assigned prefix for your router.

This seems like a worse version of allowing .zip to be a gTLD. Remember the idea of downloading something from https://github.com/[...]@evil.zip?

Pihole here will still serve .lan internal domains. Anyone that registers .lan globally are the ones guilty of using a culturally busy domain that was unreserved before.

In time we'll see articles like "Don't register a .lan domain if you want people to visit your site"

My personal head canon is that ICANN told Google they had to open registration or someone who would open it up would get it

Eh, maybe someone spinning up a brand new environment using it in 2026 should have known better. But you don't have to go that far back to reach a point where the current list of gTLDs would make .lan feel safe.

> but anyone choosing to use .lan [gTLD] should [be] aware of the risks of [of it being used for local routing for the last 20 years or more]

FTFY

>It akin to an application for a .local TLD.

it is not, as .local is designated as a special-use domain name and .lan is not.

RFC 6762 reserves the .local. TLD for Multicast DNS. There are no reservations for .lan. so something like home.arpa. should be used instead.

Beside the fact that was standard or not it made sense to use .lan domain for local devices, and a lot of router sold were configured with that domain for resolving local network hosts.

To me is a very bad idea to implement this proposal, it should instead be standardized and reserved for internal usage as a fix. There were even RFC like https://www.rfc-editor.org/info/rfc6762/#appendix-G that suggested their usage for local devices in a network.

What is the point of selling the .lan domain, except for making money at the expense of a security risk for millions of networks that already use that domain for internal hosts?

BTW to me there was never any sense to add new TLD domain despite country code. They decided to render internet less secure, by giving scammers infinite TLD to register they scam domain like "apple.lan", with the sole purpose of making for them easy money.

What could go wrong with puting the interests of a couple corporations over those of the rest of the internet community.

not putting lan in the most recent update to the reserved private namespace was a massive miss. It is defacto a reserved private namespace.

This has been widely used since before there were any TLDs explicitly reserved for internal use.

First ever pTLD?

They make sense given the history of the Internet, but not in hindsight. Most obviously, .gov, .edu and .mil should be under the .us TLD, but obviously the inventor's prerogative applies.

It's arguably defensible to have a limited number of non-geographic TLDs. "Dot com" was an aesthetic as much as a technical decision. I wonder though, if .com/net/org had never existed, we would have a different sense of aesthetic around domain names, and there's no reason to think that it would be any better or worse than what we have now.

.lan is indicative of topology not necessarily of accessibility.

.internal is all about the boundary between inside and the public internet, regardless of how you define ‘inside’.

For example I use a PiHole with local DNS records for my services like immich.lan, paperless.lan, etc.