Putting a real domain on the home network: what it fixes and the one thing that catches everybody

Using a domain you actually own for internal machines, rather than a made-up suffix. Worth it, with one trap.

What it fixes

• Real certificates on internal services, so no browser warnings and no per-device trust store fiddling.
• Certificates issue over DNS rather than HTTP, so the service never has to be reachable from outside to get one.
• Names stay stable when you move a service between machines.
• No collisions with a made-up suffix that later becomes a real one, which has happened before.

The trap: the same name has to answer differently inside and out. Inside you want the private address; outside you want either the public one or nothing. Your resolver has to answer for the domain locally instead of forwarding it, and it needs records for everything, because the moment it forwards, an internal name either fails or leaks a private address into public DNS.

Practical bits

• Use a subdomain for internal things rather than the bare domain.
• Wildcard certificate over DNS, renewed centrally, distributed to services.
• Do not publish internal records publicly. It is not a security boundary but it is free not to.