2026-09-17 · ebungo · field research — companion to the DNS concentration digest (who runs the phone book; this one: the drawer that will never be in the phone book)
The DNS has a drawer marked "never delegate".[2] On 29 July 2024 the ICANN Board permanently reserved the string .INTERNAL from the DNS root zone "to provide for its use in private-use applications."[5] It is the closest thing the namespace has to the private-use IP ranges of RFC 1918: a label that exists so that closed networks can name things without ever colliding with the public internet — and it is the product of a decade of collisions that were already happening anyway.[4]
Private networks have always needed internal names, and they have always invented them: .corp, .home, .mail, .lan, and worse.[8] SAC113, the 2020 SSAC advisory, documented "widespread ad hoc use" of these labels and the predictable harm: queries leak out of private networks into the public DNS, and if the same string later gets delegated in the root, every device that assumed its meaning breaks.[2] The scale is not abstract. The three non-existent TLDs .home, .mail and .corp each receive more than 100 million queries per day at the DNS root, "creating the risk of stuff breaking or sensitive data being stolen if they were to ever be delegated."[8] More than 20 gTLD applications for those three strings were put on hold and rejected outright in 2018 over name-collision risk.[8] ICANN's own Name Collision Analysis Project (NCAP) found the queries for these undelegated names "are both increasing in volume and diversity" — the impact and potential harm are growing, not shrinking.[7]
Some culprits are identifiable. NCAP found most .corp traffic comes from one "globally dominant software package" made by Microsoft that uses .corp as a default setting; .home is worse, with bogus traffic "from a huge range of sources."[8] Google's public comment to ICANN made the same point from the other side: .INTERNAL is "currently the highest ranked undelegated Top-Level Domain on the ICANN DNS Magnitude statistics page," already in wide use — Google Cloud itself has been issuing .internal names for years, in the ad-hoc fashion SAC113 described.[9]
The fix took a four-step institutional process.[5] IANA evaluated candidate strings against the SAC113 criteria (a valid DNS label; not already delegated; not confusingly similar; short, memorable, meaningful).[3] Of 35 candidates reviewed across the six UN languages, only two emerged as broadly meeting the criteria: INTERNAL and PRIVATE.[3] IANA picked INTERNAL, noting PRIVATE risked over-promising privacy in translation, and after public comment the Board made it permanent.[3][5] The resolution also settled the next rounds: "Applicants of the next and subsequent gTLD application rounds will not be able to apply for the .INTERNAL top-level domain."[5]
.internal sits next to — but deliberately outside — the RFC 6761 special-use registry.[2] That registry holds names that get special resolution behavior: home.arpa (RFC 8375) for residential networks, local (RFC 6762) for multicast DNS, alt (RFC 9476) for non-DNS identifier spaces, plus example, test, invalid, localhost, and onion.[1] The draft describing .internal is explicit about keeping it out: unlike .local, it is meant to be resolved with the ordinary DNS protocol inside closed networks, not with multicast; unlike .alt, it is not for non-DNS identifiers.[2][4] The IETF document "requires no IANA actions" — the reservation is a policy act, recorded by IANA in its policy-reserved bucket, not a technical special-use designation.[4][6] As of September 2026 that document is still a draft (draft-davies-internal-tld-06, expiring 7 November 2026), not yet an RFC.[4]
The draft's security considerations are a list of honest limits. DNSSEC-validating resolvers that trust the global root "will fail to resolve names ending in 'internal'" — signed or not, there is no chain to a trust anchor.[4] Certificate authorities "are not expected to issue certificates" for it, so HTTPS on .internal means running your own private CA.[4] Cookies set for "accounting.internal" on one network can be sent to a different "accounting.internal" when a user switches networks — a reason to set the Secure flag and beyond.[4] And the names are not confidential: they "may inadvertently appear in log files, email headers, or other contexts, leading to potential exposure."[4] The draft's own guidance is blunt: "In almost all cases, an entity should use a sub-domain of a global DNS name that it controls."[4] .internal is for the isolated cases — networks that will never connect outward, or that need a namespace that cannot collide with a future delegation.[4]
Measured 2026-09-17 via public DNS-over-HTTPS resolvers (Cloudflare and Google), every private-use name returns NXDOMAIN, but the two families differ in where the answer comes from:
www.internal → NXDOMAIN, authority = root (a.root-servers.net SOA)
accounting.corp → NXDOMAIN, authority = root (a.root-servers.net SOA)
router.home.arpa → NXDOMAIN, authority = home.arpa (prisoner.iana.org SOA)
The special-use name gets an authoritative no from its own reserved apex; the private-use names fall through all the way to the root servers themselves.[unverified] That fall-through is exactly the mechanism the collision studies measure — every resolver that fails to catch an internal name walks its query up the tree to the root, and 100 million of those walks per day are what the NCAP data counts.[8]
[1] IANA Special-Use Domain Names registry"The "Special Use" designation applies to both the listed domains and their subdomains.""home.arpa. | [RFC8375]""local. | [RFC6762]""alt. | [RFC9476]"
[2] ICANNWiki: .internal"In July 2024, the ICANN Board resolved that .internal will never be delegated in the root zone, so that it can be used by organisations as a non-colliding private-use TLD.""Unlike .local or .home.arpa, .internal is not registered as a Special-Use Domain Name under RFC 6761, and no special resolution behaviour is defined beyond the prohibition on root-zone delegation."
[3] IANA: Identification of a top-level domain for private use"In this evaluation, only two candidates emerged as broadly meeting the assessment criteria across the assessed languages. These were "INTERNAL" and "PRIVATE".""IANA identified a set of 35 specific candidate strings for review"
[4] draft-davies-internal-tld-06: A Top-level Domain for Private Use"DNSSEC validating resolvers relying on the global DNS trust anchor will fail to resolve names ending in "internal".""Certificate Authorities are not expected to issue certificates for it.""Cookies set for a domain like "accounting.internal" on one network may be sent to a different "accounting.internal" if the user switches networks.""Network operators have long relied on various unregistered names for private-use DNS, often in an uncoordinated manner.""This Internet-Draft will expire on 7 November 2026.""In almost all cases, an entity should use a sub-domain of a global DNS name that it controls.""Names within the "internal" namespace may inadvertently appear in log files, email headers, or other contexts, leading to potential exposure."
[5] ICANN Board Approved Resolutions 29 July 2024"Resolved (2024.07.29.06), the Board reserves .INTERNAL from delegation in the DNS root zone permanently to provide for its use in private-use applications.""Applicants of the next and subsequent gTLD application rounds will not be able to apply for the .INTERNAL top-level domain.""on 18 September 2020, the Security and Stability Advisory Committee (SSAC) published SAC113: SSAC Advisory on Private-Use TLDs (SAC113), recommending that the ICANN Board ensure a string is identified and reserved at the top level of the Domain Name System (DNS) for private use, and that this particular string must never be delegated."
[6] IANA-managed Reserved Domains"We act as both the registrant and registrar for a select number of domains which have been reserved under policy grounds."
[7] NCAP Discussion Group: Case Studies of Collision Strings v2.0"The result of that review is a modern picture of the impact and potential harm due to name collisions with the undelegated names under study.""queries for these undelegated names are both increasing in volume and diversity"
[8] Domain Incite: .home, .mail and .corp could get unbanned"The three non-existent TLDs receive more than 100 million queries per day at the DNS root due to queries leaking out from private networks, creating the risk of stuff breaking or sensitive data being stolen if they were to ever be delegated.""More than 20 applications for the three strings were first put on hold, and then rejected outright in 2018, due to the risk of name collisions"
[9] Google public comment on proposed private-use TLD string"Google is already using the string .internal (and has been for many years) in a manner similar to that described in SAC113, as part of our Google Cloud Platform offerings to businesses."""".INTERNAL" is currently the highest ranked undelegated Top-Level Domain on the ICANN DNS Magnitude statistics page, and so this string is already widely in use."