Network Working Group K. Davies Internet-Draft IANA Intended status: Informational A. McConachie Expires: 7 November 2026 ICANN W. Kumari Google 6 May 2026 A Top-level Domain for Private Use draft-davies-internal-tld-06 Abstract This document describes the "internal" top-level domain for use in private applications. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 7 November 2026. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Davies, et al. Expires 7 November 2026 [Page 1] Internet-Draft Private use top-level domain May 2026 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Using the "internal" Namespace . . . . . . . . . . . . . . . 2 3. Comparisons to Similar Namespaces . . . . . . . . . . . . . . 3 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 3 5. Security Considerations . . . . . . . . . . . . . . . . . . . 3 6. Additional Information . . . . . . . . . . . . . . . . . . . 4 7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 5 8. Informative References . . . . . . . . . . . . . . . . . . . 5 Notes (for removal before publication) . . . . . . . . . . . . . 6 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 6 1. Introduction There are situations in which private network operators may wish to use their own domain naming scheme that is not intended to be used or accessible by the global domain name system (DNS), such as within corporate or home networks. The "internal" top-level domain (TLD) is specifically designated for this purpose. Domains under this TLD are not resolvable in the global DNS but can be configured and utilized within private networks according to the operator's requirements. This concept is analogous to private-use IP address ranges (e.g., [RFC1918]), providing a similar function within the DNS ecosystem. 2. Using the "internal" Namespace Network operators have long relied on various unregistered names for private-use DNS, often in an uncoordinated manner. This practice can lead to incompatibilities and unintended consequences for Internet users. For instance, an organization might adopt a name for internal use that is later introduced into the global DNS, resulting in name collisions and unpredictable behavior. In almost all cases, an entity should use a sub-domain of a global DNS name that it controls. This ensures that names are globally unique and avoids the potential for confusion that may arise from the use of private-use namespaces. However, in some cases, such as for isolated networks that will never be connected to the global Internet, use of the "internal" top-level domain may be appropriate. Entities choosing to do so should be cognizant of the implications of this decision, including: 1. The potential for collisions if multiple networks using "internal" are interconnected in the future. Davies, et al. Expires 7 November 2026 [Page 2] Internet-Draft Private use top-level domain May 2026 2. The risk of leakage of "internal" names into the global DNS. 3. The lack of global uniqueness of "internal" names. 4. DNSSEC validating resolvers relying on the global DNS trust anchor will fail to resolve names ending in "internal". 3. Comparisons to Similar Namespaces Other namespaces are reserved for similar purposes, which superficially may seem to serve the same purpose as the "internal" domain, but are intended for different use cases. * The "local" namespace [RFC6762] is reserved for use with the multicast DNS protocol. This protocol allows for resolution between devices on a local network. This namespace does not use typical DNS zones for name allocation, and instead uses the multicast DNS protocol to negotiate names and resolve conflicts. It is expected "internal" will be used for applications where names are specified in locally-configured zones. * The "alt" namespace [RFC9476] is reserved for contexts where identifiers are used that may look like domain names, but do not use the DNS protocol for resolution. This is in contrast to the "internal" domain which is to be used with the DNS protocol, but in limited private-use network scope. * The "home.arpa" namespace [RFC8375] is reserved for use within residential networks, including with the Home Networking Control Protocol [RFC7788]. 4. IANA Considerations The document requires no IANA actions. For the reasons stated above, the "internal" top-level domain is reserved from being used in the global DNS. 5. Security Considerations While the "internal" namespace is designated for private use, it is important to recognize its limitations and potential risks: 1. *Leakage into the broader Internet*: Names within the "internal" namespace may inadvertently appear in log files, email headers, or other contexts, leading to potential exposure. Users should not rely on the confidentiality of these names. Davies, et al. Expires 7 November 2026 [Page 3] Internet-Draft Private use top-level domain May 2026 2. *Lack of global uniqueness*: Names in the "internal" namespace are not globally unique. For example, multiple networks may use the same name, such as "accounting.internal," for entirely different purposes. This is similar to the use of the "local" namespace in multicast DNS, where many devices might share the name "printer.local." Users should exercise caution when performing operations that require authenticity, such as entering credentials. 3. *Collision risks*: If two networks using the "internal" namespace are interconnected, name collisions may occur. This is analogous to IP address conflicts when private-use IP ranges (e.g., [RFC1918]) are interconnected. Organizations should carefully evaluate this risk before adopting the "internal" namespace. 4. *DNSSEC limitations*: DNSSEC-validating resolvers that rely on the global DNS trust anchor will fail to resolve names ending in "internal." This limitation should be considered when planning network configurations. 5. *Implications for HTTP cookies*: Cookies set for a domain like "accounting.internal" on one network may be sent to a different "accounting.internal" if the user switches networks. To mitigate this, organizations can use the Secure flag for cookies. Additionally, since the "internal" namespace does not resolve in the global DNS, Certificate Authorities are not expected to issue certificates for it. Organizations requiring HTTPS for "internal" domains will need to establish their own private Certificate Authority (CA), which is beyond the scope of this document. 6. *Impacts on traceability*: Users should also not assume the appearance of such names is indicative of the true source of transmissions. When diagnosing network issues, the appearance of such addresses must be interpreted with the associated context to ascertain the private network with which the name is being used. A name within the "internal" namespace can never be used by itself to identify the origin of a communication. 6. Additional Information This reservation is the result of a community deliberation on this topic over many years, most notably [SAC113]. The SAC113 advisory recommended the establishment of a single top-level domain for private-use applications. DNS records within this top-level domain will not be resolvable in contexts outside of a private network. Davies, et al. Expires 7 November 2026 [Page 4] Internet-Draft Private use top-level domain May 2026 A selection process [IANA-Assessment] determined "internal" was the best suited string given the requirement that a single string be selected for this purpose, and subsequently reserved for this purpose in July 2024. [ICANN-Board-Resolution] 7. Acknowledgments The authors would like to thank the members of the Internet community who participated in the discussions that led to the establishment of the "internal" top-level domain, including those who contributed to the SAC113 advisory and the IANA assessment process. The authors would especially like to thank Eliot Lear for extensive discussion and feedback on this document. Additional feedback and suggestions were received from Joe Abley, Mark Andrews, Wes Hardakerm Paul Hoffman, Philip Homburg, David Lawrence, John Levine, Benno Overeinder, Petr Špaček, Ondrej Surý, Peter Thomassen and Suzanne Woolf. 8. Informative References [IANA-Assessment] "Identification of a top-level domain for private use", January 2024, . [ICANN-Board-Resolution] "Reserving .INTERNAL for Private-Use Applications", July 2024, . [RFC1918] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G. J., and E. Lear, "Address Allocation for Private Internets", BCP 5, RFC 1918, DOI 10.17487/RFC1918, February 1996, . [RFC6762] Cheshire, S. and M. Krochmal, "Multicast DNS", RFC 6762, DOI 10.17487/RFC6762, February 2013, . [RFC7788] Stenberg, M., Barth, S., and P. Pfister, "Home Networking Control Protocol", RFC 7788, DOI 10.17487/RFC7788, April 2016, . [RFC8375] Pfister, P. and T. Lemon, "Special-Use Domain 'home.arpa.'", RFC 8375, DOI 10.17487/RFC8375, May 2018, . Davies, et al. Expires 7 November 2026 [Page 5] Internet-Draft Private use top-level domain May 2026 [RFC9476] Kumari, W. and P. Hoffman, "The .alt Special-Use Top-Level Domain", RFC 9476, DOI 10.17487/RFC9476, September 2023, . [SAC113] "SSAC Advisory on Private-Use TLDs", September 2020, . Notes (for removal before publication) * I-D source is maintained at: https://github.com/kjd/draft-davies- internal-tld (https://github.com/kjd/draft-davies-internal-tld) Authors' Addresses Kim Davies Internet Assigned Numbers Authority Email: kim.davies@iana.org Andrew McConachie Internet Corporation for Assigned Names and Numbers Email: andrew.mcconachie@icann.org Warren Kumari Google Email: warren@kumari.net Davies, et al. Expires 7 November 2026 [Page 6]