LukasJul 18, 2025

Mildly cursed factoid about UNC paths:

- UNC Paths can contain IP addresses such as \\192.168.1.1\share
- IPv6 addresses are supported as well
- IPv6 addresses contain colons
- can't have colons in Windows paths since colons are reserved for drive letters

So Microsoft came up with the the ipv6-literal.net domain that's special-cased by Windows so you can to write IPv6 addresses in UNC paths as 2a0e-3c0--21.ipv6-literal.net without it hitting any resolvers.

Show threadChristian Berger DECT 2763Jul 18, 2025
@karotte Does this work outside of UNC paths?
Show threadLukasJul 18, 2025

@casandro Turns out, yes:

> ping 2a0e-3c0--21.ipv6-literal.net

Pinging 2a0e:3c0::21 with 32 bytes of data:

Also works in browsers: http://2a0e-3c0--21.ipv6-literal.net/

Show threadChristian Berger DECT 2763
@karotte Faszinating, it's not a real domain, yet it feels like this could lead to a whole range of security issues.
Jul 18, 2025 at 6:00pmWeb
Show threadWladimir PalantJul 18, 2025
@casandro @karotte Luckily no issues that wouldn’t exist without this. Anybody is free to create a real domain name that maps subdomains to arbitrary IP addresses. In fact, a number of such domain names exist.
Show threadChristian Berger DECT 2763Jul 18, 2025
@WPalant @karotte Well I can't think of anything yet, but it does create different views on something. A Windows system would think that a certain domain exists when it doesn't.
Show threadWladimir PalantJul 18, 2025
@casandro @karotte The only issue that I can see would be access to the actual ipv6-literal.net domain. If some subdomains of ipv6-literal.net hit the DNS instead of being resolved internally (no idea whether they do) and if something important were happening on ipv6-literal.net (currently it doesn’t – the domain is parked), there could be some issues because anybody can effectively have their own ipv6-literal.net subdomain without consent of the domain owner (who isn’t Microsoft it seems).
Show threadKlaus FrankJul 18, 2025

@WPalant @casandro @karotte

Well imagine a bad actor getting control over that domain and generating AAAA-RRs for all of the subdomains pointing to something else on public servers.

I don't even want to know how many firewalls and other devices you could confuse with this.
Like what happens when you send an E-Mail from an IP that has a PTR-RR pointing towards one of these?

Questions over questions...

Show threadShadSterlingJul 22, 2025
@agowa338 @WPalant @casandro @karotte now I’m expecting someone to buy the domain and set it up to go to pages that will offer to restore the old resolution per-subdomain for an exorbitant fee