Deleting "localhost" entries from the DNS zone

2017-09-01 - News - Tony Finch

Between the 4th and 8th September we will delete all the localhost entries from the DNS zone. This change should have no effect, except to avoid certain obscure web security risks.

RFC 1537, "Common DNS Data File Configuration Errors", says "all domains that contain hosts should have a localhost A record in them." and the zone has followed this advice since the early 1990s (albeit not entirely consistently).

It has belatedly come to our attention that this advice is no longer considered safe, because localhost can be used to subvert web browser security policies in some obscure situations.

Deleting our localhost DNS records should have no effect other than fixing this security bug and cleaning up the inconsistency. End-user systems handle queries for localhost using their hosts file, without making DNS queries, and without using their domain search list to construct queries for names like We verified this by analysing query traffic on one of the central DNS resolvers, and the number of unwanted queries was negligible, less than one every 15 minutes, out of about 1000 queries per second.