Before the gTLDs were expanded it was easy: just choose an unused word. These days I tend to see either subdomains of the main public domain, or a public domain registered solely for internal use.

The proper way to do it, though it does mean that things such as using ssl for wildcard domains at an arbitrary level become difficult and potentially expensive.

If they're internal domains you can run your own CA. No need to use wildcard certs or pay anything at all.

Are there any reasons not to use a real domain?

.local ?

https://en.m.wikipedia.org/wiki/.local

Like the linked wikipedia article says, .local is used by mDNS(zeroconf/bonjour/avahi/etc.), so you might see weird stuff if you use it for a "normal" DNS environment.

AFAICT current "best practice" for private networks is to use a private subdomain of your real domain. Say, .internal.example.com.

Google registered the .dev gTLD for their internal use. So I've been doing the same, hijacking all requests for the .dev gTLD and serving up my own zones.

That's fine until Google buys your company. :)

I am willing to take that risk. :)

I will not be that sad.

Google has both .dev and .prod.

FYI, some Linux distributions default to .localdomain instead.

But for my machines, I just use a domain that I own.

That's why i use sometimes simply .loc.. :)

The annoying part is that Chrome treats valid (g)TLDs differently. If you type test.dev in your browser it will try to resolve test.dev. But if you type test.loc, it will google for test.loc.

There are a lot of workarounds sure, but try explaining that to everyone else.

Unfortunately that is less and less possible due to multicast DNS which hijacked that TLD.

Isn't .private reserved?

Yes, but that just means they can decide to do something special with it in the future, not that you can use it for your own purposes.

It would be great if mDNS was reliable enough that you wouldn't need to hack together a private DNS in most cases.

.local is for mdns only. I've been using .lan instead for locally poisoned DNS entries (in my case, dnsmasq being both DNS server and dhcpd to make it easy).

No, absolutely not. If people choose that for a local domain, that breaks mDNS.

I agree with you. There should exist a standardized tld for internal networks that we can use and be sure that no one else has control over. Buying a domain and use a subdomain of that one is not a good workaround. .internal would be nice and is not used by now. I may go write an rfc now :)

related discussion:

http://serverfault.com/questions/17255/top-level-domain-doma...

What happens as soon as two different organizations want to connect their networks together and they both turn otu to be using the same hijacked TLD?

Use a real domain name instead.

> What happens as soon as two different organizations want to connect their networks together and they both turn otu to be using the same hijacked TLD?

Why "hijacked" TLD? It would be a standard TLD.

If two orgs merge, and they both happen to use the same hostnames for some things, like say git.internal, they just refactor those hosts, or merge them since they merge.

It is not usually as easy as you suggest to just merge or refactor conflicting domains.

Even if you're lucky, and it is git.internal - rather than source.internal with VSS on one and ClearCase on the other - there may be conflicting repository names. These'll be configured on developer's PCs, CI servers, automated deployment scripts. And that's just one domain name.

That's potentially a lot of work to connect two organizations: who may well not be connecting because of a merger - they may simply be contractors.

If ABC Corp and XZY Corp had their local stuff on internal.abc.com and internal.xyz.com, then all their old domains - and urls - keep working after they connect their networks. Whether and when to merge their services together becomes a decision based on the merits of each merge, rather than something that is forced because they choose a bad naming scheme.

How is this simpler than just using real domain names? I use an int.company.com domain for my internal hosts and have for 20+ years.

Why go through all the pain of renaming hosts if you can avoid it by using a real domain name in the first place?

I thought .local was a de-facto standard for this?

.local is used for link-local domains, for resolution by multicast DNS ('zeroconf'). See https://tools.ietf.org/html/rfc6762.

Microsoft used to suggest using it for local networks, but now advise against it.

Presumably single-letter TLDs will never be allocated. So you could allocate yourself one of those. Or maybe something with hyphens in not beginning with xn--.