2014-12-14

I read this question How can URLs have a dot . at the end, e.g. www.bla.de.? and realise that FQDN should contain a trailing . for the root label of the DNS tree:

example.com. instead of example.com

However, there are issues as pointed out in this blog article:

If you do not consider the fact that the user can accidentally enter
the domain name with a dot at the end, or follow a link received from
some "well-wisher" and get on your domain name with the dot at the
end, as the result it may lead to unexpected consequences:

1) If the website uses HTTPS, when navigating to the domain name with
the dot at the end, the browser will display the warning on untrusted
connection.

2) Authentication may be broken, as cookies are usually set for the
domain name without a dot at the end. User in this case will be quite
surprised why he can’t log in. It is noteworthy, that if you set a
cookie for a domain name with a dot at the end, this cookie will not
be passed to the domain name without the dot at the end and vice
versa.

3) JavaScript on the page may be broken.

4) There may be problems with the caching of website pages (for
example, https://www.cloudflare.com/ does not clear the pages cache if
domain name has a dot at the end considering it an invalid domain
name).

5) If in conditions in the web server configuration you rely on the
particular domain name ($http_host in Nginx, %{HTTP_HOST} in Apache)
without the dot at the end, you may face a variety of unexpected
situations: unexpected redirects, basic-authorization problems, etc.

6) If the web server is not configured to accept requests on the
domain name with the trailing dot, any user who accidentally typed a
domain name with the trailing dot will see something like Bad Request
- Invalid Hostname.

7) It is possible that search engines may find that your resource has
a duplicate content, if someone accidentally or intentionally post
links to your web pages with a dot at the end of the domain name.

I also realise that http://webmasters.stackexchange.com./ does a 400 Bad Request. But since the domain name proper should contain a . at the end, shouldn't we be issuing 400 error or 301 redirect for hostnames without a trailing dot? What is the proper way to deal with this issue in a coherent and consistent manner?

Show more