Hacker News Reader

Comment by ddol | Hacker News Reader

Vatican City (http://www.va/) used to have MX records pointing at va directly (so, pope@va or whatever)

So did .ai., at least for certain people (or maybe it was just the A record, but A records are enough for mail deliverability in the absence of an MX). I had one, back when I lived next to the .ai. registrar on Anguilla and shared his (very expensive) T1 via 10base2 ethernet.

Ukraine (.ua) has an MX record on the TLD. So user@ua is a valid address.

If that's his email it must be irritating getting all the old popes mail.

Edit: Delivery to the following recipient failed permanently:

    pope@va

As far as I can tell they still do:

va. 3600 IN MX 100 raphaelmx3.posta.va. va. 3600 IN MX 10 raphaelmx1.posta.va. va. 3600 IN MX 10 raphaelmx2.posta.va.

WTF! So "ai" is a sub domain of nothing!?

DNS root domains have no names. That makes http://ai/ a fully qualified domain name. But apparently ICANN has now banned such things. Gods know why. My eyes glazed over after the 10th "whereas". That document reads like a legal document. Ugh

> That document reads like a legal document.

That's because it is.

news.ycombinator.com is actually news.ycombinator.com. with a period at the end. http://ai./ is basically the same as http://com./, except that com doesn't have any IPs configured.

But as far as TLS name matching goes, it's different. Can something with the dot at the end have a different IP?

> Can something with the dot at the end have a different IP?

I guess or maybe you can do a hostname match. However, I remember back in the days Microsoft used to use http://microsoft.com. as their test site. Now it just yields an error.

That's because Microsoft uses hostname-based virtual hosting in IIS, and IIS happens to not recognize HTTP Host headers with trailing dots. This has nothing to do with IP addressing or DNS. In the absence of a resolver search list — which conventionally only applies to names without trailing dot — "microsoft.com" and "microsoft.com." result in the same DNS query, and therefore the same set of IP addresses.

Whether this behavior is an obscure bug, a security feature, or both, is left as an exercise.

Nope. If you don't have a "com" domain at your local network, "example.com" and "example.com." point to the same machine.

The TLS domain is matched by the web server, it has no relation to DNS, except that both use the same domains.

FQDNs have periods at the end. It's just convention that dictates they're not included.

A trailing period just represents the top of the domain hierarchy. http://reddit.com./ will work just fine.

http://news.ycombinator.com./

Reply on news.ycombinator.com