19

I bought a .dev domain today @ domains.google. I also set up a dedicated nginx web server to which the .dev domain points (A records).

Very strangely, I can't access my nginx welcome page using my example.dev domain, because for some weird reason I'm redirected to https://example.dev which then fails (no connection to my http web server can be established). However, any other domain pointing to this new server works correctly. Like example.com just works. I didn't configure ANYTHING about nginx, just installed it (the demo config does the job). Obviously enough, this has something to do with Google as the registrar. OK - so I shall contact the Google support, right? Yes. I did that, however, they told me this was something I needed to handle on my side and always referring to 'contact your web host' (which isn't too much of an advice since I'm the host).

I tried everything in the Google console, but I can't get it to work. The Google support was very, very disappointing and I'm now hoping to see some resolutions on this problem.

43

.dev domains are HTTPS only. It isn't a redirect. It is HSTS preload.

HSTS is a technology that lets domains declare that they are HTTPS only. It is meant to mitigate against protocol downgrade attacks. The first time you visit a site that wants to use HSTS, you get a header that prevents you from ever visiting that domain on HTTP.

The HSTS preload list is built into web browsers so that the browser knows a site is HTTPS only, even before the first visit. If a site is on the HSTS preload list, it will never be able to be accessed via HTTP in that browser, only via HTTPS.

Google has put the entire .dev top level domain on the HSTS preload list. That means that no .dev domain will ever be able run as an HTTP site.

When you registered your .dev domain, the Google registry told you this on the front page under the "Security benifits" section:

Get built in security

Your security is our priority. The .dev top-level domain is included on the HSTS preload list, making HTTPS required on all connections to .dev websites and pages without needing individual HSTS registration or configuration. Security is built in.

Currently only Firefox and Chrome support this HSTS preload. If you want to be able to test your site before you have HTTPS set up, you could use a different browser. You also might be able to modify your browser settings to disable HSTS.

Because of the HSTS preload, you will need to run your .dev domain on an HTTPS server so that users can access it.

  • 2
    That's it. I must have missed this piece of info, and the support team wouldn't remind me of this fact again (even though I think it's pretty obvious I was missing exactly this info). – Johnny Apr 19 at 10:52
  • 8
    Yes, support should have been able to tell you this. – Stephen Ostermiller Apr 19 at 10:54
  • 4
    @Johnny btw, you might be interested in Let's Encrypt: letsencrypt.org – Ave Apr 20 at 1:32
  • 1
    Another Google-created TLD, .app, is also an HTTPS-only namespace. Beware. – Alex Jone Apr 20 at 16:55
  • 4
    For dev domains, the two that are reserved are *.test and *.localhost. They are fully reserved, so will never be taken over as real TLDs. *.localhost is actually really nice if you're doing localhost testing, as you can use multiple services like you would with other TLDs, and it still maps to 127.0.0.1. *.test is meant for any dns related stuff, so if you need to map to virtual machine IPs or something, that's your go-to. Lately I've been a big fan of *.localhost with docker containers, since I map the reverse proxy to 127.0.0.1 anyway. Requires no local dns or /etc/hosts shenanigans. – superlinkx Apr 20 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.