Are there any standards for mapping ICANN domains-world websites to .onion addresses?

I’m interested in any machine-readable methods that can be used to discover a .com’s .onion domain.

E.g. is there a standard method to announce that https://www.bbc.com/ is also available at https://www.bbcnewsv2vjtpsuy.onion/? Given the .com, how would I auto-discover (and ideally verify) the .onion? (This is obviously only applicable for real-world websites that offer a Tor hidden service mirror.)

The only resource I’ve found is the short manually curated list in the Real-World Onion Websites project.

I’ve dreamed up a /.well-known/mirrors.txt URI auto-discovery mechanism. That file would list all mirrors of a website. You could include your .onion address and your .com in that file. If the file is accessible from both location and contain each other than you’ve got a verified domain match between an .onion and an ICANN domain.

RFC 8164 proposes something similar for auto-discovering HTTPS-support. The Dat protocol uses something similar too.

  • 1
    I think the reason no one has responded is because it is more of a webserver question than merely a Tor question. My suggestion would be to contact Alec Muffett. You linked to his "Real-World Onion Websites project" and see if he can provide some illumination. He literally runs the onion service for Facebook.
    – JSEvans
    Dec 13 '19 at 20:13

The header you're looking for is Alt-Svc; the most accessible write-up I've found is Jonah Aragon's "Securing Services with Tor and alt-svc", but there are other guides and articles out there about it. It works much the same as your /.well-known/mirrors.txt idea.

  • Cloudflare uses this but the addresses it assigns to customers are short-lived/unstable.
    – Daniel
    Dec 24 '19 at 10:40

Tor has introduced a new HTTP response header for this purpose: Onion-Location.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.