Posting because OpenWRT, possibly others as well, assign .lan names to devices on the LAN by default. People who make use of this might want to follow the application, and, if it goes through, either change the name or make sure queries can't get incorrectly get sent to upstream resolvers.
Regarding that last point, I've had issues with dnsmasq in the past where it was remotely resolving domains even when they were configured to resolve locally. For .lan domains, this could be disastrous because I often send plaintext traffic to them. I did submit a fix/workaround[0], but it's still something to look out for. If anyone knows more about this issue or other ways queries could leak, please share!
RFCs were originally formalization of what was being used in practice, home.arpa was chosen apparently for reasons of beauracratic convenience rather than what would best serve existing users, who all would prefer .lan and continue to do so since that was published in 2018
> RFCs were originally formalization of what was being used in practice
You may be confusing it with the IETF’s policy.
In early days of the RFCs, most started out as proposals, often but not always with some existing implementation as a jumping-off point to conversation (hence the name). I no longer remember why they started to be numbered and tracked, as the process naturally preceded that.
You can verify what I say by just reading some old ones at the rfc editor site.
If you actually think it's a trivial affair to change a well-established default with more than 20 years of history that is, on top of all other difficulties that such a change typically encompasses, used to identify and name things, I hereby beg you to never design or provide any kind of infrastructure.
This reminds me of when I used to do IT work for small businesses in college. One printing company I worked for, had about 100 computers on their network, and was using public ipv4 addresses, that they did not own, on their internal network. I forget what range they were using now. But imagine seeing a DHCP server handing out addresses like 142.250.110.1/16 on a LAN and the public ip being something totally different.
It was funny, because when I brought it up to them, it was hard to articulate why it was a problem and I couldn't convince them it was worth the effort of trying to fix. They never ran into a specific issue due to this while I was there but it felt so gross.
The problem is that they wouldn't be able to talk to any internet service that legitimately used those addresses. Whether that was likely to be a problem very much depends on whose addresses they were.
When I was working with Linux based kiosks and PoS systems I had a good share of issues with the Microsoft MVP signature use of .local on their forests. Back then their training material recommended .local for Active Directory services.
It's always hard because when you contrive possible examples of how it goes wrong, every single example sounds contrived because of course they are contrived.
Sure one day your printer might start spewing random json code meant for some microservice of the rightful IP owner.
Sure the IP's might be owned by the Air Force and one day they might start getting traffic from your pos ipad that they decide looks like an attempt to attack one of their internal secret networks...
Sure one day traffic meant to go to your printer ends up flooding and dossing a windmill controller, preventing the rightful operators from turning it the right direction during bad weather and causing $25M damage...
And of course the real failures are more like, only people from the Maldives can't send email to your email server, a failure with no impact.
There's a good reason to do this if you can't be certain what reserved subnets are used in a given network and you absolutely need a static ip for some reason.
At least that's the conclusion I've arrived at at some point, but I don't remember what was the exact use case anymore.
However there are still several global IPv4 ranges that are not local reserved ranges but are effectively reserved and you could use them if you really want to without any issues.
This seems like a good time to educate myself about the application (and objection) process.
The bureaucracy seems precision-engineered to stultify, but apparently the public have 104 days after “String Confirmation Day” (17th Nov; capitalization theirs) to lodge objections, assuming the “GAC” doesn’t beat them to it…
…welp, hope somebody more organized (and better-funded) than I can organize an objection. Much as I feel like I’m giving up my right to gripe by assuming somebody else will come along to do the weeding.
As former AD person and dealing with that several companies, the recommendation for internal network DNS has long been subdomain.company.com that is not on public internet.
Even today when setting up greenfield networks, I generally use internal.company.com. It also lets you get public trusted SSL certificates so you don't have to deal with internal PKI.
while .local is reserved, it's reserved for mDNS, and should be avoided on things like active directory. using an internal subdomain of a registered public domain is best practice. .internal is also okay.
Then why hasn't there been a gTLD reserved for local use? The only ones that are reserved are .local and .home.arpa. .local is out, since it is entirely for use with mDNS / Bonjour.
That leaves .home.arpa, which is very awkward and only a thing since 2018 (my home network's use of .lan definitely predates this). Especially as a non US citizen. It also seemed so far that .lan was the "unofficial" gTLD to be used, since much software like OpenWRT was already using it anyway.
Either way: making .lan internet routable seems entirely unhinged to me. LAN has always been the acronym for Local Area Network. Why would anyone sane think that it is a good idea to make this into a gTLD that can be internet routable? The only way I see forward to do this justice, is to only allow RFC 1918 and IPv6 addresses that are within the assigned prefix for your router.
This seems like a worse version of allowing .zip to be a gTLD. Remember the idea of downloading something from https://github.com/[...]@evil.zip?
Pihole here will still serve .lan internal domains. Anyone that registers .lan globally are the ones guilty of using a culturally busy domain that was unreserved before.
In time we'll see articles like "Don't register a .lan domain if you want people to visit your site"
Eh, maybe someone spinning up a brand new environment using it in 2026 should have known better. But you don't have to go that far back to reach a point where the current list of gTLDs would make .lan feel safe.
I just bought mysefl a '.casa' domain, got wildcard cert for it from lets encrypt and haven't bothered with any of these. Downside, if internet goes down resolver stops, but thats why I have local NS mirror and all DNS queries go through my resolver.
You can buy a cheap domain to make sure no one else uses it and just roll it on your lan. Throw some DNS ACME challenges and you have valid certificates too.
Beside the fact that was standard or not it made sense to use .lan domain for local devices, and a lot of router sold were configured with that domain for resolving local network hosts.
To me is a very bad idea to implement this proposal, it should instead be standardized and reserved for internal usage as a fix. There were even RFC like https://www.rfc-editor.org/info/rfc6762/#appendix-G that suggested their usage for local devices in a network.
What is the point of selling the .lan domain, except for making money at the expense of a security risk for millions of networks that already use that domain for internal hosts?
BTW to me there was never any sense to add new TLD domain despite country code. They decided to render internet less secure, by giving scammers infinite TLD to register they scam domain like "apple.lan", with the sole purpose of making for them easy money.
While you're not wrong, I suspect that .lan sees more real world usage than .local
It may not be an official standard, but it does have some weight as a de-facto standard.
I've tried briefly to try and find some numbers to back that up, but can't find much beyond apple's bonjour vs consumer routers - although I've seen companies with AD domains using .lan as well. (Although, I've also seen companies using 1.0.0.0/8 for their internal addressing...)
it definitely gets used, and i hope that the application is denied, but i also hope this is another wake up call for people that pick unreserved domains.
> RFC 8375 defines the intranet domain as .home.arpa, but ICANN in 2024 says it should use .internal instead. Is ICANN not choosing .lan or .home because these two domains might still fetch a good price?
The .lan domain has been on an rpz blocklist along with several other commonly used names in my networks for quite some time. I have no plans for that domain to ever successfully resolve regardless of whether or not it goes live.
For those not in the know, Google lobbied ICANN to get the name and in their application they stated (repeatedly) that the intent was to buy it so that it could be reserved; as .dev was already used by developers and if someone bought it for commercial purposes it would harm the developer community.[0]
.... they then proceeded to start selling them.
Leading to all kinds of issues, the exact issues that they raised...
I've been using a single letter "fake" tld for my internal LAN DNS zone. Looks like ICANN requires 3+ letters in tld applications, so hopefully should be safe for quite a while.
Debian should apply for this so they can take advantage of case insensitivity and sans-serif fonts so to let people go to DEB.lAN to view their website
Why would you even want something like “lan” as a global TLD? Does it mean something else than the obvious?
Fortunately there’s no need to speculate as the application explains this clearly:
AGB Q118: What is the meaning/definition of the applied-for gTLD string?
Answer: Lan commonly refers to a broadly recognized term used across a wide range of contexts.
Man, my whole life I’ve identified with, related to, and wished to finally just be associated with “the concept represented by the applied-for string”!
The applicant appears to be an agglomeration of LLCs and legal diversions to hide responsible parties. It does lead me to assumptions about their motivations, whomever they may be.
Source: the application refers to multiple layers of LLC ownership, and the responsible parties listed are general counsels at some IP financialization company, "Identity Digital"
Every year around $4B is spent on websites. Where is the money going, who's getting rich?
It's monopolies like Verisign (of the .com tld) that have luxurious profits. No competition, plus they are allowed to raise their prices above inflation while their infrastructure costs go down every year.
Posting because OpenWRT, possibly others as well, assign .lan names to devices on the LAN by default. People who make use of this might want to follow the application, and, if it goes through, either change the name or make sure queries can't get incorrectly get sent to upstream resolvers.
Regarding that last point, I've had issues with dnsmasq in the past where it was remotely resolving domains even when they were configured to resolve locally. For .lan domains, this could be disastrous because I often send plaintext traffic to them. I did submit a fix/workaround[0], but it's still something to look out for. If anyone knows more about this issue or other ways queries could leak, please share!
[0]: https://github.com/openwrt/openwrt/pull/18610
RFC 8375: Special-Use Domain 'home.arpa.' is supposed to be used for this.
https://www.rfc-editor.org/info/rfc8375/
and most people dont use it because its an incredibly poor name.
Why don't they just put home.arpa or .arpa in their search path?
It would be awesome if Ubiquity will actually follow this RFC too. The Amplifi product line from Ubiquity have `.lan` support but no `home.arpa`.
[0]: https://amplifi.com/
RFCs were originally formalization of what was being used in practice, home.arpa was chosen apparently for reasons of beauracratic convenience rather than what would best serve existing users, who all would prefer .lan and continue to do so since that was published in 2018
> RFCs were originally formalization of what was being used in practice
You may be confusing it with the IETF’s policy.
In early days of the RFCs, most started out as proposals, often but not always with some existing implementation as a jumping-off point to conversation (hence the name). I no longer remember why they started to be numbered and tracked, as the process naturally preceded that.
You can verify what I say by just reading some old ones at the rfc editor site.
That's nice and all, but OpenWrt (and its use of .lan) predates this particular RFC by a rough 14 years.
I hope the gTLD application gets struck down.
God forbid OpenWrt ever receives an update or something.
You know, just because it's in an RFC doesn't mean it's actually practical. 'home.arpa' is significantly worse than every other option.
An update wouldn't change all the existing configurations.
If you actually think it's a trivial affair to change a well-established default with more than 20 years of history that is, on top of all other difficulties that such a change typically encompasses, used to identify and name things, I hereby beg you to never design or provide any kind of infrastructure.
Internal. is also an valid option. I moved everything there about a year ago
.internal is ICANN and not (yet?) an IETF RFC:
* https://en.wikipedia.org/wiki/.internal
Other special use domains:
* https://en.wikipedia.org/wiki/Special-use_domain_name
* https://en.wikipedia.org/wiki/Top-level_domain#Reserved_doma...
* https://datatracker.ietf.org/doc/html/rfc6761
But what if my LAN is in the garage?
This reminds me of when I used to do IT work for small businesses in college. One printing company I worked for, had about 100 computers on their network, and was using public ipv4 addresses, that they did not own, on their internal network. I forget what range they were using now. But imagine seeing a DHCP server handing out addresses like 142.250.110.1/16 on a LAN and the public ip being something totally different.
It was funny, because when I brought it up to them, it was hard to articulate why it was a problem and I couldn't convince them it was worth the effort of trying to fix. They never ran into a specific issue due to this while I was there but it felt so gross.
In the UK, Virgin Media uses UK Ministry of Defence's 25.0.0.0/8 for CGNAT
The problem is that they wouldn't be able to talk to any internet service that legitimately used those addresses. Whether that was likely to be a problem very much depends on whose addresses they were.
When I was working with Linux based kiosks and PoS systems I had a good share of issues with the Microsoft MVP signature use of .local on their forests. Back then their training material recommended .local for Active Directory services.
It's always hard because when you contrive possible examples of how it goes wrong, every single example sounds contrived because of course they are contrived.
Sure one day your printer might start spewing random json code meant for some microservice of the rightful IP owner.
Sure the IP's might be owned by the Air Force and one day they might start getting traffic from your pos ipad that they decide looks like an attempt to attack one of their internal secret networks...
Sure one day traffic meant to go to your printer ends up flooding and dossing a windmill controller, preventing the rightful operators from turning it the right direction during bad weather and causing $25M damage...
And of course the real failures are more like, only people from the Maldives can't send email to your email server, a failure with no impact.
There's a good reason to do this if you can't be certain what reserved subnets are used in a given network and you absolutely need a static ip for some reason.
At least that's the conclusion I've arrived at at some point, but I don't remember what was the exact use case anymore.
However there are still several global IPv4 ranges that are not local reserved ranges but are effectively reserved and you could use them if you really want to without any issues.
.lan should just become reserved
This seems like a good time to educate myself about the application (and objection) process.
The bureaucracy seems precision-engineered to stultify, but apparently the public have 104 days after “String Confirmation Day” (17th Nov; capitalization theirs) to lodge objections, assuming the “GAC” doesn’t beat them to it…
https://newgtldprogram.icann.org/en/application-rounds/round...
…of course there’s a “filing fee,” priced in “hours of a panel of lawyers’ time,” to lodge such an objection…
https://newgtldprogram-2026-agb.icann.org/en/8-module-4-comm...
…welp, hope somebody more organized (and better-funded) than I can organize an objection. Much as I feel like I’m giving up my right to gripe by assuming somebody else will come along to do the weeding.
Following "String Confirmation Day" there's also a "Name Collision Risk Management Framework" assessment that new gTLDs will need to pass in order for the application to proceed: https://icannwiki.org/Name_Collision_Risk_Management_Framewo...
This may very well end up to be determined too risky to be delegated, like .corp, .home and .mail in 2018.
It's a shame that ICANN did get so greedy and put everyone at risk.
Having internal domain names owned by some guy on the internet has already compromised multiple corporate networks. See the talk from this guy:
https://www.romhack.io/wp-content/uploads/2025/10/Internal-D...
As former AD person and dealing with that several companies, the recommendation for internal network DNS has long been subdomain.company.com that is not on public internet.
Even today when setting up greenfield networks, I generally use internal.company.com. It also lets you get public trusted SSL certificates so you don't have to deal with internal PKI.
`.internal` and `.local` are safe and won't be used in the future. There are reserved for internal networks
while .local is reserved, it's reserved for mDNS, and should be avoided on things like active directory. using an internal subdomain of a registered public domain is best practice. .internal is also okay.
im not super keen on all of these gTLDs, but anyone choosing to use .lan should have been aware of the risks of using an unofficial/unreserved domain.
at the very least, the .dev stuff should have had people second-guessing their usage of unreserved domains.
Then why hasn't there been a gTLD reserved for local use? The only ones that are reserved are .local and .home.arpa. .local is out, since it is entirely for use with mDNS / Bonjour.
That leaves .home.arpa, which is very awkward and only a thing since 2018 (my home network's use of .lan definitely predates this). Especially as a non US citizen. It also seemed so far that .lan was the "unofficial" gTLD to be used, since much software like OpenWRT was already using it anyway.
Either way: making .lan internet routable seems entirely unhinged to me. LAN has always been the acronym for Local Area Network. Why would anyone sane think that it is a good idea to make this into a gTLD that can be internet routable? The only way I see forward to do this justice, is to only allow RFC 1918 and IPv6 addresses that are within the assigned prefix for your router.
This seems like a worse version of allowing .zip to be a gTLD. Remember the idea of downloading something from https://github.com/[...]@evil.zip?
>Then why hasn't there been a gTLD reserved for local use?
there is. it's .internal.
https://en.wikipedia.org/wiki/.internal
(note: i hope .lan does not get approved, but people have to understand that they are rolling dice when using unreserved names)
> Introduced 29 July 2024; 2 years ago
That explains why I hadn't heard of this yet. My current incarnation of my internal network dates from ~april 2024.
Pihole here will still serve .lan internal domains. Anyone that registers .lan globally are the ones guilty of using a culturally busy domain that was unreserved before.
In time we'll see articles like "Don't register a .lan domain if you want people to visit your site"
Eh, maybe someone spinning up a brand new environment using it in 2026 should have known better. But you don't have to go that far back to reach a point where the current list of gTLDs would make .lan feel safe.
>But you don't have to go that far back to reach a point where the current list of gTLDs would make .lan feel safe.
throughout most of my career, there was no unreserved domain that felt safe. but especially after .dev.
This is a security issue for many devices. What could possibly go wrong overriding a tld used for internal networking....
You would hope someone would finally learn after .dev and .local started getting used.
RFC 6762 reserves the .local. TLD for Multicast DNS. There are no reservations for .lan. so something like home.arpa. should be used instead.
router.home vs router.home.arpa
.home.arpa is so clunky. Why do I have to put the acronym of a US military project in my domain to access resources on my own local network?
Yes, I know that organization was central to the development of the l Internet, but it's not relevant as a domain 40 years later.
I just bought mysefl a '.casa' domain, got wildcard cert for it from lets encrypt and haven't bothered with any of these. Downside, if internet goes down resolver stops, but thats why I have local NS mirror and all DNS queries go through my resolver.
You can buy a cheap domain to make sure no one else uses it and just roll it on your lan. Throw some DNS ACME challenges and you have valid certificates too.
Why should I have to purchase something (yearly subscription, mind) in order to access something that is potentially half a meter away?
This is not how anything should work.
you dont have to. .internal is fine.
router.internal avoids the military arconym
What could go wrong using tlds that were not explicitly reserved for internal use?
Beside the fact that was standard or not it made sense to use .lan domain for local devices, and a lot of router sold were configured with that domain for resolving local network hosts.
To me is a very bad idea to implement this proposal, it should instead be standardized and reserved for internal usage as a fix. There were even RFC like https://www.rfc-editor.org/info/rfc6762/#appendix-G that suggested their usage for local devices in a network.
What is the point of selling the .lan domain, except for making money at the expense of a security risk for millions of networks that already use that domain for internal hosts?
BTW to me there was never any sense to add new TLD domain despite country code. They decided to render internet less secure, by giving scammers infinite TLD to register they scam domain like "apple.lan", with the sole purpose of making for them easy money.
Indeed. It akin to an application for a .local TLD.
>It akin to an application for a .local TLD.
it is not, as .local is designated as a special-use domain name and .lan is not.
While you're not wrong, I suspect that .lan sees more real world usage than .local
It may not be an official standard, but it does have some weight as a de-facto standard.
I've tried briefly to try and find some numbers to back that up, but can't find much beyond apple's bonjour vs consumer routers - although I've seen companies with AD domains using .lan as well. (Although, I've also seen companies using 1.0.0.0/8 for their internal addressing...)
it definitely gets used, and i hope that the application is denied, but i also hope this is another wake up call for people that pick unreserved domains.
This was my first thought as well. Yikes.
> RFC 8375 defines the intranet domain as .home.arpa, but ICANN in 2024 says it should use .internal instead. Is ICANN not choosing .lan or .home because these two domains might still fetch a good price?
My tweet on Sep 26, 2026
The .lan domain has been on an rpz blocklist along with several other commonly used names in my networks for quite some time. I have no plans for that domain to ever successfully resolve regardless of whether or not it goes live.
Full collection of proposed new gTLDs: https://newgtldprogram-aps.icann.org/statistics
Also see a .bldg application, which also might conflict with some legacy naming schemes.
I'm still seething about `.dev`.
For those not in the know, Google lobbied ICANN to get the name and in their application they stated (repeatedly) that the intent was to buy it so that it could be reserved; as .dev was already used by developers and if someone bought it for commercial purposes it would harm the developer community.[0]
.... they then proceeded to start selling them.
Leading to all kinds of issues, the exact issues that they raised...
https://github.com/basecamp/pow/issues/397
https://github.com/laravel/valet/issues/433
https://danielbachhuber.com/switch-laravel-valet-from-dev-to...
https://community.localwp.com/t/dev-domain-doesnt-work/4277
https://forums.theregister.com/forum/all/2017/11/29/google_d...
[0]: https://gtldresult.icann.org/applicationstatus/applicationde...
The way they've filled out the application surprises me.
There are questions that literally say as part of the question "Choose Yes or No", so they've answered "true"...
And Q165 is fun: "Is it likely that consumers will face significant risks if domain names in the TLD(s) in the application are abused?" Answer: "No"
Can I get a group of Ians and register .Ian?
I've been using a single letter "fake" tld for my internal LAN DNS zone. Looks like ICANN requires 3+ letters in tld applications, so hopefully should be safe for quite a while.
If that were to ever change, I bet there's a certain billionaire who'd be very interested in the .x gTLD.
gTLDs were a mistake. I say that as an owner of several domains with gTLDs.
There's almost no value.
Large businesses almost never use them. The potential for scams / phish / etc are now limitless.
Debian should apply for this so they can take advantage of case insensitivity and sans-serif fonts so to let people go to DEB.lAN to view their website
When ICANN reserved .internal a couple years ago, I was saying they should just flip and truncate it to .lan(retni) so everyone's happy.
21 separate applications for some variation on .agent/.agentic
I'm guessing that'll end up being expensive for someone...
I'm out of the loop on this, can someone explain who this is and why this is bad?
ICANN have locked the name .internal for private network use. Not sure why .lan is needed.
https://www.icann.org/en/board-activities-and-meetings/mater...
.lan is shorter, and has been widely used for many years (since before .internal or .home.arpa were "standardized")
Why would you even want something like “lan” as a global TLD? Does it mean something else than the obvious?
Fortunately there’s no need to speculate as the application explains this clearly:
Man, my whole life I’ve identified with, related to, and wished to finally just be associated with “the concept represented by the applied-for string”!
Related:
ICANN Reveals 2026 Round Applications for New Generic Top-Level Domains
https://news.ycombinator.com/item?id=49997301
We need to separate competitive gTLDs from those whose registration is controlled uncompetitively. Very few, e.g. .xyz, are competitive.
..Why? Just to annoy people?
The applicant appears to be an agglomeration of LLCs and legal diversions to hide responsible parties. It does lead me to assumptions about their motivations, whomever they may be.
Source: the application refers to multiple layers of LLC ownership, and the responsible parties listed are general counsels at some IP financialization company, "Identity Digital"
To sell to scammers for lots of money
No.
so so dumb. Pure greed. This is going to cause so many issues
Every year around $4B is spent on websites. Where is the money going, who's getting rich?
It's monopolies like Verisign (of the .com tld) that have luxurious profits. No competition, plus they are allowed to raise their prices above inflation while their infrastructure costs go down every year.
"America" has our best interests at heart /s