Thanks everyone for the wonderful answers! The thoughts in my head were not aligned with reality ;-) I had a thought similar to what Bill describes, that everywhere there's a dot (.) there's a subdomain. I also had the thought/assumption that the data to the left of the leftmost dot (.) was essentially the hostname. It's been a while since I've regularly been into DNS but I thought I remembered it that way. But then seeing some of the OSINT data, that seemed to throw that idea out the window as they appear to use the publicsuffix.org site to divine suffix and domain and then consider everything to the left of that as a subdomain. I've now updated my understanding. Cheers, Harry On Mon, Feb 24, 2025 at 9:47 PM William Herrin <bill@herrin.us> wrote:

...

In working with several OSINT sources for domain processing it seems

On Mon, Feb 24, 2025 at 5:58 PM Harry Hoffman via NANOG <nanog@nanog.org> wrote: like the way domains and subdomains are processed essentially equates subdomains with FQDNs.

Hi Harry,

I don't understand what you mean. Do you mean how do local resolvers expand local names (e.g. "server") in FQDNs ("server.examplecompany.com")?

...

Has this become common practice? Is there a definitive way to determine subdomains? I seem to recall that "older" dns server software wouldn't allow this but it could be that my memory is faulty.

Subdomain is kinda a fuzzy question. Everywhere there's a dot there's a "subdomain," but the only technical meanings those dots have is that:

1. There *might* be a DNS delegation there. 2. The resolver's primitive internal compression algorithm can break the name in parts there when composing the query or response packet.

There's another similar question you might be trying to ask: how do you determine whether a DNS name has been delegated from one zone file at one server to another zone file at another server? That has a more precise answer with technical meaning: If a NS and SOA records exist at the "dot" boundary then there's a delegation. If not, then there isn't.

For example, I have a host named "cat.p.dirtside.com." "dirtside.com" is a delegation of "com" because there's an NS record for "dirtside.com." However, "p.dirtside.com" is NOT a delegation of "dirtside.com" because there's no NS record. "cat.p" is simply a name within the "dirtside.com" zone file.

Regards, Bill Herrin

-- William Herrin bill@herrin.us https://bill.herrin.us/

On Fri, Feb 28, 2025 at 10:05 AM Stephane Bortzmeyer via NANOG <nanog@nanog.org> wrote:

On Tue, Feb 25, 2025 at 07:36:16AM -0500,

Yes. I believe the confusion is that some documentation, APIs, or software incorrectly obfuscate the concept of a domain and take that the domain is only the part registered with a domain registrar. E.g. "EXAMPLE.COM" would be a domain, and in "B.C.EXAMPLE.COM" the C.EXAMPLE.COM would be disregarded and considered part of Example.com leading to the strange claims that you have a "B.C" subdomain of example.com or that B.c.example.com is a subdomain of example.com But that would be completely non-standard. Every subdomain is in fact a domain name. And every domain under the root is a subdomain of the label directly above it and ONLY the one specific DNS label directly above that particular subdomain. And the management or registration structure of the DNS; the zone boundaries users refer to, have nothing to do with which names are actually a domain or subdomain. A subdomain is exclusively the direct descendent of another domain which is observed solely by the addition of one dot and label on the lefthand side. Take for example: A.B.EXAMPLE.COM. Assume that FQDN exists. Given that exists you are guaranteed that A.B.EXAMPLE.COM. is a domain, B.EXAMPLE.COM. is a domain, EXAMPLE.COM. is a domain, COM. is a domain, and . is a domain. A.B.EXAMPLE.COM. is a subdomain, but it should never be referred to as a subdomain of EXAMPLE.COM. It is only a subdomain of B.EXAMPLE.COM. -- -J

On Fri, Feb 28, 2025 at 12:18 PM Harry Hoffman via NANOG <nanog@nanog.org> wrote:

This is exactly the logic that I was operating under: A.B.EXAMPLE.COM <http://a.b.example.com/>. is a subdomain, but it should never be referred to as a subdomain of EXAMPLE.COM <http://example.com/>. It is only a subdomain of B.EXAMPLE.COM <http://b.example.com/>.

Hey Harry, long time no see :) No, actually your statement is not correct. All of those are subdomains example.com. To quote the DNS Terminology RFC ( https://datatracker.ietf.org/doc/html/rfc9499 ): Subdomain: "A domain is a subdomain of another domain if it is contained within that domain. This relationship can be tested by seeing if the subdomain's name ends with the containing domain's name." (Quoted from [RFC1034], Section 3.1) For example, in the host name "nnn.mmm.example.com", both "mmm.example.com" and "nnn.mmm.example.com" are subdomains of "example.com". Note that the comparisons here are done on whole labels; that is, "ooo.example.com" is not a subdomain of "oo.example.com". Shumon.

On Fri, Feb 28, 2025 at 9:11 AM Jay <mysidia@gmail.com> wrote:

Every subdomain is in fact a domain name.

Hi Jay, Not necessarily. Remember my example cat.p.dirtside.com? P.dirtside.com is a subdomain of dirtside.com. It's an administrative grouping of domain names that have a particular characteristic. However, p.dirtside.com is NOT a domain name. It has no DNS records of its own. Only subsidiaries like cat.p.dirtside.com exist and have DNS records. "Subdomain" has some funky contradictions to it, some of which can only be resolved with administrative knowledge about the DNS zone they're a part of. That's what makes them a less than useful concept for an outside observer trying to categorize a set of fully qualified domain names (FQDNs). Regards, Bill Herrin -- William Herrin bill@herrin.us https://bill.herrin.us/

On Fri, Feb 28, 2025 at 12:50 PM David Conrad <drc@virtualized.org> wrote:

On Feb 28, 2025, at 12:18 PM, William Herrin <bill@herrin.us> wrote:

...

Remember my example cat.p.dirtside.com? P.dirtside.com is a subdomain of dirtside.com. It's an administrative grouping of domain names that have a particular characteristic. However, p.dirtside.com is NOT a domain name. It has no DNS records of its own. Only subsidiaries like cat.p.dirtside.com exist and have DNS records.

Hmm.

I would definitely have said “p.dirtside.com" is a subdomain.

Hi Dave, I agree that "p.dirtside.com" is a subdomain. Recheck what I said. It's not a domain name, no more so than "sdkflkdfgfsgdfg". That's the contradiction. It gets worse. Is "cat.p.dirtside.com" a subdomain? It's definitely a domain name. You can know it's a subdomain if you find another domain name like abc.cat.p.dirtside.com. But if you don't find another name, how can you as an external observer know that cat.p.dirtside.com is NOT a subdomain? Regards, Bill Herrin -- William Herrin bill@herrin.us https://bill.herrin.us/

Bill, On Feb 28, 2025, at 1:17 PM, William Herrin <bill@herrin.us> wrote:

...

I would definitely have said “p.dirtside.com" is a subdomain.

Err, sorry. I meant ‘domain’.

I agree that "p.dirtside.com" is a subdomain. Recheck what I said. It's not a domain name, no more so than "sdkflkdfgfsgdfg". That's the contradiction.

What differentiation are you making between the label “sdkflkdfgfsgdfg” and (say) the label “com”?

It gets worse. Is "cat.p.dirtside.com" a subdomain? It's definitely a domain name. You can know it's a subdomain if you find another domain name like abc.cat.p.dirtside.com. But if you don't find another name, how can you as an external observer know that cat.p.dirtside.com is NOT a subdomain?

I’m unsure what an external observer has to do with this. For me: cat is a sub-domain of p.dirtside.com p and cat.p are sub-domains of dirtside.com dirtside, p, and cat.p are sub-domains of com com, p, cat.p, and cat.p.dirtside are sub-domains of the root. And all are domains. Regards, -drc

On Fri, Feb 28, 2025 at 9:11 AM Jay <mysidia@gmail.com> wrote:

...

Every subdomain is in fact a domain name.

Hi Jay,

Not necessarily.

Yes, necessarily!

Remember my example cat.p.dirtside.com? P.dirtside.com is a subdomain of dirtside.com. It's an administrative grouping of domain names that have a particular characteristic. However, p.dirtside.com is NOT a domain name.

I think you have a different semantic definition to "being a domain name" compared to what the rest of us use.

It has no DNS records of its own. Only subsidiaries like cat.p.dirtside.com exist and have DNS records.

However, that does not make p.dirtinside.com not being a domain name. It would however be what in DNS technical terminology is called "an empty non-terminal" -- a domain name which only exists because it has other domain names "below" it. You would notice that if you used "dig" and queried for the IP address ("A" record type) of p.dirtinside.com, you would get a "NOERROR" status code in the response, but will not get any records in the answer section, because there are none to be returned. This is what is also called a "nodata" response. The same would happen for all other record types. Note that this is different from the response you would get when queriying for a nonexistent domain name, such as q.dirtinside.com (assuming neither it nor any "children" names exist), when you would get a query response status of "NXDOMAIN" ("the queried-for domain name does not exist"). However, that doesn't make the queried-for domain name not be a domain name (or a subdomain for that matter).

"Subdomain" has some funky contradictions to it, some of which can only be resolved with administrative knowledge about the DNS zone they're a part of. That's what makes them a less than useful concept for an outside observer trying to categorize a set of fully qualified domain names (FQDNs).

Again, I suspect you attach different semantics to "subdomain" compared to what most others do. Refer back to Mark Andrews' response. Being a subdomain is not the same as being the name of a zone. Every domain name except the root is a subdomain (of some domain). Being a subdomain is usually referring to another domain, so that one can answer "yes" or "no" to whether "a" is a subdomain of "b", and is answerable purely by the name structure. I would perhaps also point to the latest "DNS Terminology" RFC, ref.: https://datatracker.ietf.org/doc/rfc9499/ As Rubens Kuhl responded, security tools and browsers included use the data from https://publicsuffix.org/ to e.g. determine if HTTP cookies can be shared between different http origins below a given domain name. It tries to delineate the places in the DNS where you find administrative and/or organizational boundaries, which is different from both "being a subdomain (of <a>)" and "being a zone". However, there is nothing *technological* in the DNS which says that you can't start a new public registry and hand out domain names to different organizations under a given DNS domain name (whether it would be successful is another matter). Regards, - Håvard