Re: [squid-users] dstdomain issue

howard chen wrote:
> Hello,
>
> I notice some of our client is typing an additional dot at the end of
> the domain, which make the squid ACL failed, e.g.
>
> acl dstdomain_index dstdomain .example.com
>
>
> So if client is using, e.g. http://www.example.com./, then ACL blocked
> the client from accessing.
>
> But in real sites this should be allowed? e.g. www.facebook.com./
>

Yes. The trailing . is a placeholder that instructs DNS lookup mechanisms to terminate there and not try to lookup the phrase as a host or subdomain.

For example, where I work I can just type www into my browser to get our main page because it has nla.gov.au configured as a search domain.

Which, IIRC, means that the lookup of www fails, so it then does a lookup on www.nla.gov.au, then www.gov.au, then www.au, then and only then it reports back to the OS that it was unable to resolve the host. At least, I think that's how it works.

Sometimes these are essential where the search domains are implicit, like DNS records. If I forget the . then I end up with errors in the logs referring to

hostname.nla.gov.au.nla.gov.au.nla.gov.au.nla.gov.au.nla.gov.au... etc

Basically then the trailing dot is acceptable for a FQDN. Your link to facebook worked fine for me, and I would assume that you get these attempts because people are using to ending a type phrase with a full stop <ENTER> sequence.

>
>
> Howard

-- 
Daniel Rose
National Library of Australia