My development server is on my local machine ( I have created an A record in my DNS settings that points dev.mydomain.com to so that I can use this domain name for accessing my local web app. I know I could use my /etc/hosts file but I feel it is easier to manage by using DNS and when we want to add a developer on the team, it removes the step of having to add a line in their hosts file.

My question is: is it safe to do this? Is there anything that can go wrong?

  • I used to do something similar, until I discovered Vagrant vagrantup.com
    – spuder
    May 26, 2013 at 19:47
  • 4
    I also use Vagrant and I fail to see in what way Vagrant solves that problem since modifying the hosts file in the VM won't let the host machine use that domain. May 27, 2013 at 17:35

4 Answers 4


Is it safe to do this?

I see no security problem with this.

Is there anything that can go wrong?

Possibly, though I am not sure I understood this correctly:
Has each developer their own development server and does each one work on their own local copy? Then this will work fine.

However if there is only one dev. server and you use this as your workstation then this might not work as expected since is local host. As in each developers own localhost.

In ASCII graphics:

                                           Assigned IPs:
Your own computer                 
(with dev.server)         -----------      ::1
                                           'Normal' static or DHCP assigned IP

Other developers computer        
(Just a workstation)      -----------      ::1
                                           'Normal' static or DHCP assigned IP

If the other developer tries to access dev.mydomain.com then DNS will successfully translate that to No need to add anything to the hosts file. But the other developer will not arrive at your dev. server. Localhost for him or her will be local.

  • 2
    > Has each developer their own development server and does each one work on their own local copy? Yes. May 26, 2013 at 12:43

A relevant security issue is the "same site scripting" described here: http://www.securityfocus.com/archive/1/486606/30/0/threaded

Although this issue is pretty old, some websites still make this mistake recently: https://hackerone.com/reports/1509

  • 1
    Good answer, but please consider link rot.
    – Hennes
    Nov 7, 2017 at 12:07

There is nothing security wise that would be a problem with this. It might block a valid domain name unless you are actually the owner of the domain, but it's a technique I've used for both development and sending ad servers DNS queries to invalid addresses.

As far as the potential side effects from a general networking standpoint, you'd probably want to ask on SuperUser or ServerFault.


(Not too sure the below is considered a security issue around here, but still:)

Five minutes ago, I was severely confused when visiting http://thesaurus.org/ and, out of the blue, looked at a website I had developed. Turns out, dig thesaurus.org at the time of writing points to, and I was looking at a website in my machine. From this experience:

A subdomain pointing to could be an invitation for website spoofing. For example, if dev.microsoft.com points to localhost, links in e-mails etc. will appear to show a valid Microsoft website that is actually controlled by the attacker if:

  • The attacker is able to install a webserver on the user's machine, or to exploit software that provides this.

  • And if the user ignores the fact that there will be no SSL connection.

  • You are talking about a very different scenario.
    – schroeder
    Mar 30, 2020 at 22:36
  • "And if the user ignores the fact that there will be no SSL connection." Some web developers enable the chrome option to ignore HTTPS problems on localhost, making this point less of a protection
    – Ferrybig
    May 21, 2021 at 20:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .