Do not turn a naming reservation into a security boundary
05Choosing a reserved example name avoids one kind of confusion. It does not make copied code, services or traffic harmless.
A reserved api.example.org label is correctly classified, but a separate service-policy gate stops unauthorized use in this fictional scenario. The name itself is not the gate.
Source for this drawing: RFC 2606 · Read RFC section 5 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Test or experimental software can escape its testbed; documentation examples can become deployed code. RFC 2606 reserves names to reduce naming conflicts, not to implement a sandbox.
- Test or experimental software can escape its testbed; documentation examples can become deployed code. RFC 2606 reserves names to reduce naming conflicts, not to implement a sandbox.
- Match whole domain labels: api.example.org is inside example.org, while example.org.other is not. A suffix substring match is insufficient.
- Loopback identifies this host, not the identity or trustworthiness of a service. Example-domain resolution is not guaranteed to fail. Apply network, service and authorization controls separately.
The classifier accepts a bounded ASCII hostname subset, not URLs, ports, wildcards, Unicode/IDNA or arbitrary DNS wire labels. Outside-this-guide means only that none of its seven reserved domains matched, not that a name is public, available, routable or safe. No queries, connections, mail, registrations or DNS changes are performed.
Read the RFC section ↗