Browsers and other Web software tend to allow the system resolver to use the local domain search list when resolving URLs. E.g. www -> www.example.com., if your domain search list is example.com. Browsers tend not to update the address bar, or the transmitted Host: header, to reflect the fully qualified domain name.

This has been documented as expected behaviour, for example here: https://tools.ietf.org/html/rfc2396#section-3.2.2

This raises concerns about spoofing, or ambiguity generally. One way to avoid this is to write the trailing dot, www.example.com.. However it is very unusual to see this. Apple's Bonjour implementation was (is?) a notable exception.

I could have just quoted more from the Bonjour link. But it also appeared to be attributing blame, which is not what I want to talk about.

  1. In terms of practical examples, what are the series of conditions required for this to cause a significant problem?

    I accept as somewhat significant, "user visits http://msnbc.com but receives fake news" and so on, provided your example outlines why DNS search manipulation will be cheaper than HTTP interception.

  2. Are there any examples where it is common to see the trailing dot used, to rule out these problems?

I'm not looking for an exhaustive list, but feel free to include more than one example if it will help show the real significance of the problem.

A lot of Linux now mitigates this problem by default, unless someone deliberately set ndots to greater than 1 in resolv.conf.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.