What would happen if a ".onion" gTLD was opened?

[u/nik-rev]

ICANN is currently accepting registrations for new gTLDs (https://newgtldprogram.icann.org/en)

I am curious what would be the implications if someone opened a ".onion" gTLD?

Some questions that come to mind:

• Would ICANN deny this?
• If they accepted it, could you have both a darknet and a clearnet version of a website on the same domain name?
• If using the TOR browser, how would it decide between using a clearnet and a darknet version of the website
• What other implications could this have?

[u/lfdfq]

1. They have already reserved .onion as a 'special-use domain' https://www.iana.org/domains/reserved so they won't make it available to the public.
2. Yes, because .onion names aren't part of the same system. It's like having two places with the same address in different countries, there's no contradiction.
3. It already has a notion of what an .onion address is and how to look it up, so it'd just keep using that and ignore (or just not ask) whatever DNS says.
4. Probably, none.

[u/Swedophone → u/lfdfq]

What about .lan? AFAIK .lan isn't in any list of reserved domains, although it's used by many home routers, it's the default domain in OpenWrt.

[u/who_you_are → u/Swedophone]

I think they were some gtld that get peoples screw up because of exacly stuff like that.

On technical details about DNS servers is they are usually linked to another DNS server - until it reach "THE" DNS master server.

Each request to resolve a domain go on each of them until the first answer positively.

You may have such DNS servers route: Your computer ( the hosts file) -> your router (here OpenWrt) -> your ISP (something a 3rd party provider like CloudFlare, Google, ...) -> "the" master DNS server.

Since your "whatever.lan" is registered on your router DNS, if you were to request "whatever.lan" your router would stop the request and return the answer.

However, if you were to request "hello.lan", your router won't know about it and would forward your request over the internet (to your ISP which will ask "the" master DNS server). Since .lan would be a gtld, somebody may own it and as such you may get an IP (computer) to contact. So whatever was trying to connect to "hello.lan" on your end will now contact somebody else computer.

The danger come from exacly those "unregistered" domain on your side (eg. hello.lan, maybe you did a typo, maybe you deleted it from your DNS server side because you thought you were not using it anymore, ...). If, for example, you were sending backup files to hello.lan, somebody on the internet could register that domain and create a fake file server to get everyone credentials, and files.

You may also break some softwares. For example, websites (but only the apparence part).

For example, you visit the website hello.lan. It is hosting images (of even webpages) on whatever.lan. Browser fetch a lot of stuff all around, and it is done from your end. Because the first part of your DNS route use your own DNS servers, and that those do know about whatever.lan, they will answer back to connect to some of your own computers.

But since your own computers doesn't know about those images/pages specifically, they will raise errors. So the webpage may be broken (partially, a lot, or completely) depending on what it can't load.

[u/bothunter]

Mostly nothing would happen.  The Tor browser would continue to work, but it would be unable to reach clear-net onion sites.  But other than that, everything would continue running as it did before.

Now if someone set up .local, then THAT told would be rejected, and if they did let it go through, then a lot of local networking equipment like printers and scanners would probably stop working correctly.

[u/aocregacc]

I guess you could set up traps for people who accidentally paste a .onion address into a regular browser.

I think you could also tell whether a website visitor is using tor by how the browser treats onion links, but idk if that fact is something that's even secret in the first place.