If we didn't have a bazillion TLDs these days we'd be ok and everyone can carry on using .local or .lan and be happy that they're not real TLDs. Now when anything could be a TLD because every word you've ever heard is a TLD, you don't know if its real or not.
Reserved TLDs are documented. The issue is they prioritized all the crazy ones before they added what people at home and businesses were actually using. ICANN won't sell .lan because it is used too much. They haven't tried so there is no official decision, but they won't - they did try .corp and .home and abandoned it.
.local is reserved in RFC 6762, but for multicast DNS.
Very few as this ruling would reserve .internal for local DNS only and forbid it at the global level. This is ICANN's solution to people picking random .lan .local .internal for internal uses. You'll be able to safely use .internal and it will never resolve to an address outside your network.
Seconding the other comment, lots of orgs picked .lan and then over the last few years have moved things into the cloud and .lan has become a meaningless soup since half the shit isn’t even on local network. Now it just means “needs a vpn or ztn to talk to”
Luckily my last three orgs finally bought a second domain for private dns. It’s quickly becoming a pattern that myorg.com owns myorg.tech or whatever for private traffic. Domains are cheap as fuck compared to everything else a business spends money on, it’s really silly how many people are using hacks for this
I think needing a VPN to access the internal network is a good practice. And if you're going to be used a VPN anyway, I don't see why you wouldn't use a "fake" TLD like .lan for internal stuff, after all it's just simple DNS rules.
It's used in many cases where the machine may not be on the LAN and LAN is a technical term. "Internal" is not and to me signifies that it's "not public" aswell as probably managed by someone, well, internally at the entity you're with.
Hopefully this .Internal domain takes off and becomes generally recognized as the only correct non-routable domain we all use. Otherwise it's just the latest addition to the list of possible TLDs and confusion continues.
It's such a shitty situation. ICANN is not going to sell .home or .corp as they found a crapton of traffic when they checked for it, but IETF never finished an RFC for them - however people easily stumble into the draft RFC that lists what they were thinking of, and assume stuff like .lan is good to go too. They're safe by ICANN policy, but unsanctioned.
.home.arpa is safe, per RFC, but user unfriendly to normal people. There are a few others but none a corporation would realistically use. I've used . internal for lab testing stuff for ages, so this is extra good news for me I guess.
Really I wish they'd have just reserved the most common ones rather than getting caught in some bureaucratic black hole.
Meanwhile, for my homelab I just use split DNS and a (properly registered+set up) .house domain - But that's because I have services that I want to have working with one name both inside and outside of my network
The net runs on numbers. The numbers have to be translated into/from the DNS name to the numbers.
Nominating a DNS name as internal is doesn't change the fact that we still have to, at some stage, find the (local) network mask that that corresponds to.
What am I missing?
Update: I'm not sure I formed my question correctly because I'm none the wiser. That's my fault, I think.
It’s for internal resources. You can really use whatever subdomain you want internally, but this decision would be to basically say to registrars, this TLD is reserved, we will never sell this TLD to anyone to use. That way you know that if you use it internally, there’s no way a whoopsie would happen where your DNS server finds a public record for this TLD.
A DNS Proxy/Forwarder server? That's where you would configure how your .internal domain resolves to IPs on your internal network. Machines inside the network make their DNS queries to that server, which either serves them from cache, or from the local mappings, for forwards them off to a public/ISP server.
I just use *.loc.al as a local dns entry in my own server with local addresses using devicename.loc.al and loc.al itself going to my gateway/routerpage. 😅