The .alt Special-Use Top-Level Domain
Extracted elements (20)
.alt was chosen as the special-use label instead of 'alt.arpa' so that systems using the name do not risk having a parent label resolved if the name leaks to the Internet — reserving .alt fulfills the use case of names entirely outside the DNS.
Groups wishing to create new alternative namespaces should place them under a label beneath .alt (e.g., example.alt) to provide a designated, conflict-free space that will not collide with the regular DNS context.
This document deliberately defines neither a registry nor a governance model for the .alt namespace, as it is not managed by the IETF or IANA, and collision mitigation under .alt is outside the IETF's remit.
Caching resolvers performing aggressive use of DNSSEC-validated caches (RFC 8198) may mitigate .alt leakage by synthesizing negative answers from cached NSEC records for names under .alt.
Caching resolvers using QNAME minimization (RFC 9156) will cause less .alt traffic to reach root servers because negative responses will cover all names under .alt.
DNS resolvers serving both DNS and non-DNS protocols simultaneously might treat .alt similarly to an entry in the Transport-Independent Locally-Served DNS Zone Registry, though this document does not request adding .alt to those registries.
Names in the .alt pseudo-TLD will inevitably leak outside their intended context and appear at recursive resolvers and root servers for the global DNS, based on decades of experience with similar pseudo-TLDs.
Authoritative DNS servers SHOULD NOT recognize names in the .alt pseudo-TLD as special and SHOULD NOT perform any special handling with them.
Caching DNS servers SHOULD NOT recognize names in the .alt pseudo-TLD as special and SHOULD NOT perform any special handling with them.
Currently deployed projects and protocols using pseudo-TLDs are RECOMMENDED to move under the .alt pseudo-TLD, but this is not a hard requirement.
DNS registries/registrars cannot register DNS names in the .alt pseudo-TLD because .alt will not exist in the global DNS root.
The top-level label 'alt' is reserved as a special-use domain name to signify that a name is not rooted in the global DNS and should not be resolved using the DNS protocol.
To maximize compatibility with existing applications, it is suggested but not required that non-DNS protocols using names ending in .alt follow DNS name syntax.
If a name ending in .alt is sufficiently unique, long-lasting, and frequently leaks into the global DNS, it can function as a tracking identifier analogous to a web cookie, enabling identification or re-identification of users.
Queries for .alt names will leak into the global DNS despite the intent that they remain in alternative namespaces; this is a general problem with all alternative namespaces, not specific to .alt.
The .alt label functions as an unmanaged pseudo-TLD that may appear in any domain name to indicate membership in an alternative (non-DNS) namespace. It carries no significance in the regular DNS context.
IANA has added the .alt name to the 'Special-Use Domain Name' registry (RFC 6761) with a reference to this RFC.
Because names in the .alt pseudo-TLD are explicitly outside the DNS context, no DNS-related security properties (DNSSEC, etc.) can be relied upon; security must come entirely from the non-DNS resolution system being used.
Sending queries for .alt names to root servers elicits only NXDOMAIN responses and wastes resources on both resolvers and root servers; operators and implementers should be aware of this leakage cost.
The .alt pseudo-TLD corresponds to a 0x03616c7400 suffix in DNS wire format. The on-the-wire formats for non-DNS protocols using .alt names may differ.