My development server is on my local machine ( I have created an A record in my DNS settings that points dev.mydomain.com to so that I can use this domain name for accessing my local web app. I know I could use my /etc/hosts file but I feel it is easier to manage by using DNS and when we want to add a developer on the team, it removes the step of having to add a line in their hosts file.

My question is: is it safe to do this? Is there anything that can go wrong?

  • I used to do something similar, until I discovered Vagrant vagrantup.com – spuder May 26 '13 at 19:47
  • 2
    I also use Vagrant and I fail to see in what way Vagrant solves that problem since modifying the hosts file in the VM won't let the host machine use that domain. – Olivier Lalonde May 27 '13 at 17:35

Is it safe to do this?

I see no security problem with this.

Is there anything that can go wrong?

Possibly, though I am not sure I understood this correctly:
Has each developer their own development server and does each one work on their own local copy? Then this will work fine.

However if there is only one dev. server and you use this as your workstation then this might not work as expected since is local host. As in each developers own localhost.

In ASCII graphics:

                                           Assigned IPs:
Your own computer                 
(with dev.server)         -----------      ::1
                                           'Normal' static or DHCP assigned IP

Other developers computer        
(Just a workstation)      -----------      ::1
                                           'Normal' static or DHCP assigned IP

If the other developer tries to access dev.mydomain.com then DNS will successfully translate that to No need to add anything to the hosts file. But the other developer will not arrive at your dev. server. Localhost for him or her will be local.

  • 1
    > Has each developer their own development server and does each one work on their own local copy? Yes. – Olivier Lalonde May 26 '13 at 12:43

A relevant security issue is the "same site scripting" described here: http://www.securityfocus.com/archive/1/486606/30/0/threaded

Although this issue is pretty old, some websites still make this mistake recently: https://hackerone.com/reports/1509

  • Good answer, but please consider link rot. – Hennes Nov 7 '17 at 12:07

There is nothing security wise that would be a problem with this. It might block a valid domain name unless you are actually the owner of the domain, but it's a technique I've used for both development and sending ad servers DNS queries to invalid addresses.

As far as the potential side effects from a general networking standpoint, you'd probably want to ask on SuperUser or ServerFault.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.