The danger of the trailing dot in the domain name

There is a such thing as fully qualified domain names, so each domain name in fact has a dot at the end. Maybe you are even not aware that your website is also accessible on domain name with the dot at the end (for example www.likebtn.com and www.likebtn.com.) as browsers allow to use both ways.

Possible issues

If you do not consider the fact that the user can accidentally enter the domain name with a dot at the end, or follow a link received from some "well-wisher" and get on your domain name with the dot at the end, as the result it may lead to unexpected consequences:

1) If the website uses HTTPS, when navigating to the domain name with the dot at the end, the browser will display the warning on untrusted connection.

2) Authentication may be broken, as cookies are usually set for the domain name without a dot at the end. User in this case will be quite surprised why he can’t log in. It is noteworthy, that if you set a cookie for a domain name with a dot at the end, this cookie will not be passed to the domain name without the dot at the end and vice versa.

3) JavaScript on the page may be broken.

4) There may be problems with the caching of website pages (for example, https://www.cloudflare.com/ does not clear the pages cache if domain name has a dot at the end considering it an invalid domain name).

5) If in conditions in the web server configuration you rely on the particular domain name ($http_host in Nginx, %{HTTP_HOST} in Apache) without the dot at the end, you may face a variety of unexpected situations: unexpected redirects, basic-authorization problems, etc.

6) If the web server is not configured to accept requests on the domain name with the trailing dot, any user who accidentally typed a domain name with the trailing dot will see something like Bad Request - Invalid Hostname.

7) It is possible that search engines may find that your resource has a duplicate content, if someone accidentally or intentionally post links to your web pages with a dot at the end of the domain name.

Workaround

Redirect to the domain name without a dot would allow to avoid some of the described problems:

Apache (.htaccess)
RewriteCond %{HTTP_HOST} !^domain\.zone$
RewriteRule ^(.*)$ http://domain.zone/$1 [L,R=301]

Nginx (nginx.conf)
if ($http_host != 'domain.zone') {
    return 301 http://domain.zone$request_uri;
}

IIS (web.config)
<httpRuntime relaxedUrlToFileSystemMapping="true"/>
<rule name="point" stopProcessing="true"> <match url="^(.*)\.$" />
    <action type="Redirect" url="{R:1}" redirectType="Temporary" /> 
</rule>

Reconnaissance

Facebook
https://www.facebook.com.
Redirects to https://www.facebook.com (after bypassing a warning on untrusted connection.)

Megaupload
https://mega.co.nz./#login
Authentication works, but after navigating to https://mega.co.nz user is not authenticated anymore.

Stack Overflow
http://stackoverflow.com.
Bad Request - Invalid Hostname
HTTP Error 400. The request hostname is invalid.

GitHub
https://github.com./login

Authentication does not work.

Twitter
https://twitter.com.

404 - Page not found

Yahoo
https://login.yahoo.com.
Authentication does not work.

Wikipedia
http://en.wikipedia.org./w/index.php?title=Special:UserLogin
Authentication does not work.

MSN
http://msn.com.
Bad Request - Invalid Hostname
HTTP Error 400. The request hostname is invalid.

Microsoft
http://microsoft.com.
Bad Request - Invalid Hostname
HTTP Error 400. The request hostname is invalid.

eBay
https://signin.ebay.com./ws/eBayISAPI.dll?SellItem
Authentication works.

Tumblr
http://www.tumblr.com.

Not found.

Flickr
http://www.flickr.com.
We're sorry, Flickr doesn't allow embedding within frames.

Dropbox
https://www.dropbox.com./login 

Error (403) It seems you tried to do something we can't verify. Did you log into a different Dropbox account in a different window?

VK
http://vk.com.

Authentication does not work.
JavaScript error: "NS_ERROR_DOM_BAD_DOCUMENT_DOMAIN: Illegal document.domain value"

Alexa
https://www.alexa.com.
Redirects to https://www.alexa.com

UPD

1) In Nginx you can't specify a virtual server using the Fully Qualified Domain Name:

server {
     server_name domain.zone. ;
    ...
}