I switched to comodo DNS and I get a .local domain prompt

Question

I switched to Comodo DNS today because Norton DNS seems to be completely shut off and the website has not been accessible in days.

Comodo DNS works fine but every time I log into my computer it says avahi will be disabled due to using a .local domain. I just want to understand what this means, I did some research but nothing pops out.

When I switch to OpenDNS that prompt goes away. Anyone have an idea why this happens?

Answer 1

The problem is that the .local domain is not supposed to exist in DNS – it's reserved for local-only mDNS – but Comodo's DNS servers pretend that it does.

Why Comodo DNS is broken

Comodo DNS isn't completely clean – when you look up any nonexistent name, instead of replying with "this domain doesn't exist", Comodo's servers pretend that all such names point to their own website (also known as DNS hijacking or "NXDOMAIN hijacking").

For example, if you try to access an address like http://this.goes.nowhere, Comodo's catch-all website just says "The domain name is not valid", along with Comodo's logo and some text advertisements.

It's important to understand that this is not the same as replying "domain doesn't exist" to the DNS lookup. Comodo's DNS servers say that the domains do exist and point to Comodo-owned IP addresses. The difference is very noticeable when you encounter this in programs other than web browsers; for example, if you try to connect to another computer using ssh but mistype its name, you might not even notice that you're connecting to Comodo's server. Wikipedia will list you even more things that break with such DNS providers.

...and why OpenDNS is broken too

All of the above is done by OpenDNS too, by the way – the OpenDNS servers do exactly the same thing, redirecting you to an OpenDNS "search" website when you try to access a nonexistent one (although they do let you opt out).

The difference is just in how Comodo and OpenDNS handle the reserved .local TLD.

What is Avahi

OS X and Linux use a protocol called mDNS to let you access other computers in the same LAN by their name like rockos-laptop.local without having to set up an internal DNS server or type IP addresses directly. (On Linux, "Avahi" is the name of the program that talks mDNS.) Standard mDNS setups use the .local domain for all such names, to avoid mixing them with global ones.

However, many corporation networks already have internal DNS servers set up, and while most use .loc or .corp or .lan for their own purposes, it turned out that some use the .local domain too.

So if you tried to access something.local, the OS wouldn't know where to ask first – other computers in the LAN using mDNS, or the company's own DNS servers. Because of that, if the OS sees that the .local domain exists in DNS, it has to turn off local mDNS lookups. That's what the warning is talking about.

Why OpenDNS doesn't cause the warning

While OpenDNS also has a catch-all reply, it actually excludes certain reserved toplevel domains like .test, .local, or .example, returning an actual NXDOMAIN error for them.

Comodo DNS, however, still claims that all names under .local point to the catch-all website. (And just to add confusion, the catch-all website further redirects your browser to http://127.0.0.1 whenever it sees that the domain ends in ".local" – so a browser ends up trying to access your own computer. This redirect is done at HTTP level so non-browser programs would still keep trying to connect to Comodo's servers.)

For example...

$ host superuser.com
superuser.com has address 198.252.206.140

$ host this.does.not.exist
this.does.not.exist has address 92.242.144.50

$ host nonexistent.local
nonexistent.local has address 92.242.144.50

A good DNS server would say:

$ host this.does.not.exist
Host this.does.not.exist not found: 3(NXDOMAIN)

How to fix this

Do not use Comodo DNS.

(I suggest avoid using OpenDNS as well, or at least opt-out from the "typo correction" and other such services at their dashboard.)

Consider using a "clean" public DNS provider like Google Public DNS, or just run a DNS server for yourself by installing Unbound and pointing the DNS settings at 127.0.0.1.

Your ISP's DNS servers would probably work fine too.