RFC 8375

Special-Use Domain 'home.arpa.'

📅 published May 2018, from ietf

RFC 8375: Special-Use Domain 'home.arpa.' 🎀

Okay so this RFC is by P. Pfister of Cisco Systems and T. Lemon of Nibbhaya Consulting, and it came out in May 2018 🌸. It's a Standards Track doc with ISSN 2070-1721, and it updates RFC 7788 (it doesn't obsolete anything). Slay, now let's get into it 💅

Abstract ✨

Bestie, this doc spells out how the DNS is supposed to act when someone asks about names ending in .home.arpa. 🏡 and it officially makes that domain a special-use one. home.arpa. is set aside for non-unique use in residential home networks, so lots of homes can use the same name without fighting. The Home Networking Control Protocol (HNCP) also gets updated to use home.arpa. instead of .home. 💖

Status of This Memo

This is an Internet Standards Track document 🧚

It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check out Section 2 of RFC 7841 📚

For the current status, any errata, and how to give feedback, go to https://www.rfc-editor.org/info/rfc8375 🦋

Copyright Notice

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can find at https://trustee.ietf.org/license-info as in effect on the date of publication. Please read these carefully, because they explain your rights and restrictions for this document. Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License 🫶

Table of Contents 🍓

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   3
2.  Requirements Language . . . . . . . . . . . . . . . . . . . .   4
3.  General Guidance  . . . . . . . . . . . . . . . . . . . . . .   4
4.  Domain Name Reservation Considerations  . . . . . . . . . . .   4
5.  Updates to Home Networking Control Protocol . . . . . . . . .   7
6.  Security Considerations . . . . . . . . . . . . . . . . . . .   7
  6.1.  Local Significance  . . . . . . . . . . . . . . . . . . .   7
  6.2.  Insecure Delegation . . . . . . . . . . . . . . . . . . .   8
  6.3.  Bypassing Manually Configured Resolvers . . . . . . . . .   9
7.  Delegation of 'home.arpa.'  . . . . . . . . . . . . . . . . .   9
8.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   9
9.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  10
  9.1.  Normative References  . . . . . . . . . . . . . . . . . .  10
  9.2.  Informative References  . . . . . . . . . . . . . . . . .  10
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . .  12
Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  12

1. Introduction 🌸

Okay, so users and devices inside a home network (aka "homenet") need their devices and services to have names that are unique within the homenet [RFC7368]. ✨ Naming has to work with zero config from the user, obviously. An ISP might delegate a name, but homenets still have to work without one. So this doc reserves home.arpa. as the default name for this job, scoped to each individual homenet 🏡

This doc fixes an error in [RFC7788] by swapping .home out for home.arpa. as the default domain name for homenets. .home was picked because it's the most user-friendly option, but there are existing uses of .home that could clash with this 😬 Evidence shows .home queries frequently leak out and reach the root name servers [ICANN1] [ICANN2]. Not it! 🙅‍♀️

Also, for DNSSEC compatibility (see Section 6), the name needs an insecure delegation (see Section 4.3 of [RFC4035]). There's an existing process for allocating names under .arpa. [RFC3172], but there's no equivalent process for requesting a similar delegation in the root, since the IETF doesn't administer that zone 💀 So all unregistered uses of .home (that is, all current uses at the time this doc was published), especially the ones specified in [RFC7788], are deprecated 🥀

This doc registers home.arpa. as a special-use domain name [RFC6761] and specifies the behavior that's expected from the DNS for queries whose rightmost non-terminal labels are home.arpa.. Queries for names ending in .home.arpa. are of local significance within a homenet, which means identical queries can give different results from one homenet to another. In other words, a name ending in .home.arpa. is not globally unique 🧩

Even though this doc makes specific reference to [RFC7788], home.arpa. isn't meant to be restricted to networks where HNCP is deployed. 💅 It's meant to be the correct domain for uses like the one described for .home in [RFC7788]: local name service in residential homenets 🏠

2. Requirements Language 🎀

Okay, the boring-but-important bit. The key words below have special meaning, so read carefully 📝

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

3. General Guidance 🧚

The domain name home.arpa. is for naming within residential homenets 🏡 Names ending with .home.arpa. point to a zone that's served locally. Its contents are unique only to one particular homenet and are not globally unique. These names refer to nodes and/or services located inside a homenet, like a printer or a toaster 🖨️🍞

DNS queries for names ending with .home.arpa. get resolved using local resolvers on the homenet. Such queries MUST NOT be recursively forwarded to servers outside the logical boundaries of the homenet. Stay local, bestie! 🔒

Some service discovery user interfaces that are expected to run on homenets hide info like domain names from end users. But sometimes users still need to see, remember, and even type names ending with .home.arpa. 🙈 The Homenet Working Group hopes that this name will somehow tell as many readers as possible that these domain names point to devices in the home. We know it's an imperfect solution, but it's giving effort 💖 Iconic.

4. Domain Name Reservation Considerations ✨

okay so this section is all about what DNS systems need to know when they're resolving names ending in .home.arpa. 🏠 every item here covers one piece of DNS or domain name resolution that this special-use allocation touches. if you want the deep dive on each one, go check Section 5 of [RFC6761] 🤓 also, the word "homenet" in [RFC7788] means home networks with one particular feature set, but here it just means ANY home network, no matter which features it has. no cap, that's a big distinction 💅

Users can use names ending with .home.arpa. just like any other domain name 🌸 the home.arpa. name was picked so people can easily tell that a name is pointing at a service on the homenet their device is connected to. iconic.
Application software SHOULD NOT treat names ending in .home.arpa. differently than other names 🙅‍♀️ and there's no reason to trust names that are subdomains of home.arpa. (see Section 6). not me trusting random subdomains 💀
Name resolution APIs and libraries MUST NOT recognize names that end in .home.arpa. as special, and they MUST NOT treat them as having special significance 🧚 the one exception is that these APIs may need to avoid bypassing the locally configured recursive resolvers.

Usually the client gets one or more IP addresses for recursive DNS servers through router advertisements or DHCP 📡 for an administrative domain that uses subdomains of home.arpa., like a homenet, the recursive resolvers that domain provides can answer queries for those subdomains. other resolvers won't be able to, or they'll give answers that aren't correct inside that domain. the resolver situation is giving chaos fr 😭

A host configured to use a resolver that the local network didn't provide might be unable to resolve subdomains of home.arpa., or it might get wrong results for them 🙈 to avoid this, it's allowed for hosts to use the locally provided resolvers for home.arpa., even when they're set up to use other resolvers.

There are three things recursive resolvers need to do if they follow this spec 💜
- A. Recursive resolvers at sites using home.arpa. MUST transparently support DNSSEC queries. that means queries for DNSSEC records, and queries with the DNSSEC OK (DO) bit set (see Section 3.2.1 of [RFC4035]). validation isn't required, but it's strongly encouraged 🫶 a caching recursive resolver that doesn't validate answers it could validate might cache invalid data, and then validating stub resolvers won't be able to validate answers successfully. that's a whole domino effect, bestie 😩
- B. Unless they're configured otherwise, recursive resolvers and DNS proxies MUST behave as described in Section 3 of the Locally Served Zones document [RFC6303]. so queries for home.arpa. and its subdomains MUST NOT be forwarded, with one major exception 👑 a query for a DS record with the DO bit set MUST return the correct answer for that question, including correct information in the authority section that proves the record doesn't exist.

for example, a query for the NS record for home.arpa. MUST NOT get forwarded to an upstream cache, or to the authoritative DNS server for .arpa. 🚫 but a query for the DS record MUST result in forwarding whatever queries are needed to provide accurate authority information. usually that's just a query for the DS record itself, since the authority section of the response will have the necessary info if the DO bit is set ✨

C. on top of everything above, recursive resolvers that can be used in a homenet MUST be configurable to forward queries for home.arpa. and its subdomains to an authoritative server for home.arpa. 🌈 that server provides authoritative data for home.arpa. inside a particular homenet. the special handling for DS records for the home.arpa. delegation is still required, so don't forget it 🦋

it's totally fine to combine the recursive resolver function for general DNS lookups with an authoritative resolver for home.arpa.. in that case, instead of forwarding queries for subdomains of home.arpa. to an authoritative server, the resolver answers them itself, authoritatively 🎀 the forwarding behavior for queries specifically for home.arpa. stays exactly the same.

No special processing of home.arpa. is required for authoritative DNS server implementations 🍓 an authoritative server might check the authoritative servers for home.arpa. for a delegation beneath that name before answering authoritatively for a delegated name. if it does, there won't be any such delegation in the home.arpa. zone, because the name only has local significance. so the server would refuse to answer authoritatively for that zone. a server that does this check MUST be configurable so that it either skips the check for the home.arpa. domain, or ignores the results of the check 🙃
DNS server operators MAY configure an authoritative server for home.arpa. for use in homenets and other home networks 🏡 the operator for the DNS servers that are authoritative for home.arpa. in the global DNS will configure any such servers as described in Section 7.
home.arpa. is a subdomain of the arpa top-level domain 🌍 IANA operates arpa under the authority of the Internet Architecture Board, following the rules in [RFC3172]. there are no other registrars for .arpa, so it's a one-owner situation 👑

5. Updates to Home Networking Control Protocol 🛠️

the final paragraph in Section 8 of [RFC7788] (the Home Networking Control Protocol) gets updated like this 💖 here's the OLD text:

Names and unqualified zones are used in an HNCP network to provide
naming and service discovery with local significance.  A network-
wide zone is appended to all single labels or unqualified zones in
order to qualify them. ".home" is the default; however, an
administrator MAY configure the announcement of a Domain-Name TLV
(Section 10.6) for the network to use a different one.  In case
multiple are announced, the domain of the node with the greatest
node identifier takes precedence.

and here's the NEW text, which is the glow-up ✨

Names and unqualified zones are used in an HNCP network to provide
naming and service discovery with local significance.  A network-
wide zone is appended to all single labels or unqualified zones in
order to qualify them. 'home.arpa.' is the default; however, an
administrator MAY configure the announcement of a Domain-Name TLV
(Section 10.6) for the network to use a different one.  In case
multiple TLVs are announced, the domain of the node with the
greatest node identifier takes precedence.

The 'home.arpa.' special-use name does not require a special
resolution protocol.  Names for which the rightmost two labels are
'home.arpa.' are resolved using the DNS protocol [RFC1035].

so basically the default zone goes from .home to home.arpa., and the wording gets a little tighter (it says "multiple TLVs are announced" now). and the new paragraph makes it clear that home.arpa. doesn't need a special resolution protocol, because names whose rightmost two labels are home.arpa. just go through regular DNS per [RFC1035] 🧚

6. Security Considerations 🔐

this part is serious, so let's get into it 😤

6.1. Local Significance 🫧

a DNS record that comes back as a response to a query for a Fully Qualified Domain Name (FQDN) that's a subdomain of home.arpa. is expected to have local significance. it's expected to be returned by a server involved in name resolution for the homenet the device is connected to. BUT a response like that MUST NOT be considered more trustworthy than a similar response for any other DNS query. not giving it extra trust just because it's "local" 🚨

because home.arpa. isn't globally scoped and can't be secured with DNSSEC using the root domain's trust anchor, there's no way to tell, with a standard DNS query, which homenet scope an answer belongs to. so users might get surprising results with these names when they roam between different homenets 🌀

to stop that from happening, it could be useful for the resolver on the host to securely tell apart different homenets, and to tell apart identical names on different homenets. however, nobody has standardized a mechanism for doing that yet, and it's out of scope for this document. it's expected that this will be explored in future work 🔭

the advice in [RFC6303], Section 7, to install local trust anchors for locally served zones can only work if there's some way to configure the trust anchor on the host. homenet currently doesn't specify any mechanism for configuring those trust anchors. so even though the advice sounds good, it isn't practicable 😭

also, even though it might be useful to install a trust anchor for a particular instance of home.arpa., a host with that trust anchor might connect to more than one network that has its own instance of home.arpa. from time to time. that host wouldn't be able to access services on any instance of home.arpa. except the one its trust anchor was configured for 🙅‍♀️

in principle, it's possible to attach an identifier to an instance of home.arpa. that could be used to figure out which trust anchor to rely on for validating names in that instance. however, the security implications are complicated 🌪️ so that mechanism, plus a discussion of those implications, is out of scope for this document.

6.2. Insecure Delegation 🕳️

it's not possible to install a trust anchor (a DS RR) for this zone in the .arpa zone 🙃 the reason is that doing so would require the key-signing key for the zone (see Section 5 of [RFC4034]). since the zone isn't globally unique, no single key would work for it.

an alternative would be to provide an authenticated denial of existence (see Section 3.2 of [RFC4033]). that would be done simply by not having a delegation from the arpa. zone. but this requires the validating resolver to treat home.arpa. specially 🥺 if a validating resolver that doesn't treat home.arpa. specially tries to validate a name in home.arpa., an authenticated denial of existence of home as a subdomain of arpa. would make the validation fail. so the only delegation that lets names under home.arpa. be resolved by all validating resolvers is an insecure delegation, as in Section 7 of [RFC6303] 💅

so, unless a trust anchor for the particular instance of the home.arpa. zone being validated is manually configured on the validating resolver, DNSSEC signing and validation of names within the home.arpa. zone is not possible 🥀

6.3. Bypassing Manually Configured Resolvers 🕵️‍♀️

okay so, bestie, this one is a little spicy 🌶️. In item 3 of Section 4, there's an exception for stub resolvers. Normally they'd only use the resolvers they were manually configured with, but this exception lets them ask local resolvers about subdomains of home.arpa. even when they've been set to use other resolvers. 🙈 That has real security and privacy implications, and depending on where it's deployed it might not be what you want. The document says it may be better to just drop the exception. In that case, when one or more recursive resolvers are configured manually, they simply wouldn't return correct answers for subdomains of home.arpa. 💀 The catch is that there's no operational experience yet to guide this call, so implementers are encouraged to think about the context their software will actually be deployed in before deciding. no cap, it's a "know your setup" moment 🫶

7. Delegation of `home.arpa.` 💅

okay this part is giving very specific instructions, so pay attention 👀. For home.arpa. to be fully functional, it needs a delegation in the .arpa. zone [RFC3172]. That delegation MUST NOT include a DS record, and it MUST point to one or more black hole servers, such as blackhole-1.iana.org. and blackhole-2.iana.org. 🕳️

Why does it have to stay unsigned? Because leaving the delegation unsigned breaks the DNSSEC chain of trust. And that break is actually the point: it stops a validating stub resolver from rejecting names published under home.arpa. on a homenet name server. So the unsigned delegation is doing a job, periodt 🎀

8. IANA Considerations 🌸

IANA has already recorded home.arpa. in the "Special-Use Domain Names" registry [SUDN]. And, with the approval of the IAB, IANA has put the delegation from Section 7 into place ✨

IANA also made a brand new subregistry inside the "Locally-Served DNS Zones" registry [LSDZ]. It's called "Transport-Independent Locally-Served DNS Zone Registry", and it follows the same format as the other subregistries 🧚 They added an entry for home.arpa. with the description "Homenet Special-Use Domain", and this document is listed as the reference. For this subregistry, the registration procedure should be the same as the others, which is currently "IETF Review" (see Section 4.8 of [RFC8126]). so organized, I'm obsessed 😭

9. References 📚

9.1. Normative References

These are the must-read ones 💜

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC3172]  Huston, G., Ed., "Management Guidelines & Operational
           Requirements for the Address and Routing Parameter Area
           Domain ("arpa")", BCP 52, RFC 3172, DOI 10.17487/RFC3172,
           September 2001, <https://www.rfc-editor.org/info/rfc3172>.

[RFC4035]  Arends, R., Austein, R., Larson, M., Massey, D., and S.
           Rose, "Protocol Modifications for the DNS Security
           Extensions", RFC 4035, DOI 10.17487/RFC4035, March 2005,
           <https://www.rfc-editor.org/info/rfc4035>.

[RFC6303]  Andrews, M., "Locally Served DNS Zones", BCP 163,
           RFC 6303, DOI 10.17487/RFC6303, July 2011,
           <https://www.rfc-editor.org/info/rfc6303>.

[RFC6761]  Cheshire, S. and M. Krochmal, "Special-Use Domain Names",
           RFC 6761, DOI 10.17487/RFC6761, February 2013,
           <https://www.rfc-editor.org/info/rfc6761>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

9.2. Informative References

These ones are the extra reading for the curious 🦋

[ICANN1]   "New gTLD Collision Risk Mitigation", August 2013,
           <https://www.icann.org/en/system/files/files/
           new-gtld-collision-mitigation-05aug13-en.pdf>.

[ICANN2]   "New gTLD Collision Occurence Management", October 2013,
           <https://www.icann.org/en/system/files/files/
           resolutions-new-gtld-annex-1-07oct13-en.pdf>.

[LSDZ]     "Locally-Served DNS Zones", July 2011,
           <https://www.iana.org/assignments/
           locally-served-dns-zones/>.

[RFC1035]  Mockapetris, P., "Domain names - implementation and
           specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
           November 1987, <https://www.rfc-editor.org/info/rfc1035>.

[RFC4033]  Arends, R., Austein, R., Larson, M., Massey, D., and S.
           Rose, "DNS Security Introduction and Requirements",
           RFC 4033, DOI 10.17487/RFC4033, March 2005,
           <https://www.rfc-editor.org/info/rfc4033>.

[RFC4034]  Arends, R., Austein, R., Larson, M., Massey, D., and S.
           Rose, "Resource Records for the DNS Security Extensions",
           RFC 4034, DOI 10.17487/RFC4034, March 2005,
           <https://www.rfc-editor.org/info/rfc4034>.

[RFC7368]  Chown, T., Ed., Arkko, J., Brandt, A., Troan, O., and J.
           Weil, "IPv6 Home Networking Architecture Principles",
           RFC 7368, DOI 10.17487/RFC7368, October 2014,
           <https://www.rfc-editor.org/info/rfc7368>.

[RFC7788]  Stenberg, M., Barth, S., and P. Pfister, "Home Networking
           Control Protocol", RFC 7788, DOI 10.17487/RFC7788, April
           2016, <https://www.rfc-editor.org/info/rfc7788>.

[RFC8126]  Cotton, M., Leiba, B., and T. Narten, "Guidelines for
           Writing an IANA Considerations Section in RFCs", BCP 26,
           RFC 8126, DOI 10.17487/RFC8126, June 2017,
           <https://www.rfc-editor.org/info/rfc8126>.

[SUDN]     "Special-Use Domain Names", July 2012,
           <https://www.iana.org/assignments/
           special-use-domain-names/>.

Acknowledgments 🫶

big thank-you hugs to everyone who helped make this happen 💖 The authors thank Stuart Cheshire, and the homenet chairs Mark Townsley and Ray Bellis, for their earlier work on .home. Paul Hoffman gets a shoutout for reviewing and commenting on the IANA Considerations section, and Andrew Sullivan for his review and proposed text. Suzanne Woolf and Ray Bellis get love for their super detailed review comments and process insights. Mark Andrews deserves a medal for an exhaustive reference list on insecure delegations 🏅 Dale Worley gets thanked for catching a rather egregious mistake and for the Gen-Art review, and Daniel Migault for a thorough SecDir review. Warren Kumari caught some extra issues, and Adam Roach gave some helpful clarifications. legends, all of you 🌈

Authors' Addresses 🧚

Pierre Pfister
Cisco Systems
Paris
France

Email: pierre.pfister@darou.fr


Ted Lemon
Nibbhaya Consulting
P.O. Box 958
Brattleboro, Vermont  05301-0958
United States of America

Email: mellon@fugue.com

📦 where this page comes from

ietf: rfc8375 2018-05
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms