Request for guidance for safe local domains

[fardarter]

Hi Fillipo. Long time listener, first time caller.

I was looking into what a safe domain is for local HTTPS development, and came across this: https://letsencrypt.org/docs/certificates-for-localhost/

It sounds like they consider localhost and 127.0.0.1 safe, but not localhost with a public tld like localhost.net.

I was wondering what setups you'd consider safe beyond these (or if you disagree with these) at all, and if you'd be willing to put a section in your readme with some guidance. Thanks for considering!

[tigran-sargsyan-w]

For local-only HTTPS development, I would distinguish between names that are explicitly reserved and ordinary public DNS names.

The safest defaults are:

localhost
*.localhost
127.0.0.1
::1

.localhost is a special-use namespace, so names such as:

api.localhost
app.localhost

are appropriate for local development.

Another good option is .test:

app.test
api.test

.test is permanently reserved for testing, so it cannot later become somebody else's public TLD. The difference is that .test does not automatically mean loopback — you still need /etc/hosts or a local DNS server to resolve it to your development machine.

I would avoid names such as:

localhost.net
myapp.dev
random-internal-name.com

unless you actually control the domain. Those are public DNS namespaces and can resolve somewhere completely different now or in the future.

For a larger homelab, another good solution is to use a subdomain of a domain you own:

service.home.example.com

and resolve it only through split/local DNS.

mkcert solves the certificate trust problem, but it does not make an arbitrary DNS name safe. DNS naming and certificate trust are two separate concerns.