Google .dev domain strangely redirects to https

Question

I bought a .dev domain today @ domains.google. I also set up a dedicated nginx web server to which the .dev domain points (A records).

Very strangely, I can't access my nginx welcome page using my example.dev domain, because for some weird reason I'm redirected to https://example.dev which then fails (no connection to my http web server can be established). However, any other domain pointing to this new server works correctly. Like example.com just works. I didn't configure ANYTHING about nginx, just installed it (the demo config does the job). Obviously enough, this has something to do with Google as the registrar. OK - so I shall contact the Google support, right? Yes. I did that, however, they told me this was something I needed to handle on my side and always referring to 'contact your web host' (which isn't too much of an advice since I'm the host).

I tried everything in the Google console, but I can't get it to work. The Google support was very, very disappointing and I'm now hoping to see some resolutions on this problem.

Answer 1

.dev domains are HTTPS only. It isn't a redirect. It is HSTS preload.

HSTS is a technology that lets domains declare that they are HTTPS only. It is meant to mitigate against protocol downgrade attacks. The first time you visit a site that wants to use HSTS, you get a header that prevents you from ever visiting that domain on HTTP.

The HSTS preload list is built into web browsers so that the browser knows a site is HTTPS only, even before the first visit. If a site is on the HSTS preload list, it will never be able to be accessed via HTTP in that browser, only via HTTPS.

Google has put the entire .dev top level domain on the HSTS preload list. That means that no .dev domain will ever be able run as an HTTP site.

When you registered your .dev domain, the Google registry told you this on the front page under the "Security benifits" section:

Get built in security

Your security is our priority. The .dev top-level domain is included on the HSTS preload list, making HTTPS required on all connections to .dev websites and pages without needing individual HSTS registration or configuration. Security is built in.

Currently only Firefox and Chrome support this HSTS preload. If you want to be able to test your site before you have HTTPS set up, you could use a different browser. You also might be able to modify your browser settings to disable HSTS.

Because of the HSTS preload, you will need to run your .dev domain on an HTTPS server so that users can access it.