When you create a new ASP.NET Core project in Visual Studio, there's a checkbox that's easy to click past: "Use the .dev.localhost TLD in the application URL." I always want to understand what a checkbox actually does before I tick it, so let's dig into this one.
The problem it solves
When you're working on more than one local web project, they all end up living at the same address: localhost. Only the port number tells them apart. Open your browser's address bar with three projects running and you'll see localhost:5001, localhost:5215, localhost:7099 — and you have no idea which is which until you actually look at the page.
There's a second, less visible issue: because everything shares the localhost name, cookies and other domain-scoped browser storage are also shared across all your local apps. That's not something you usually want when you're testing.
What .dev.localhost actually is
.localhost is a reserved top-level domain, defined in RFC2606 and RFC6761 specifically for local testing. Modern browsers already resolve anything ending in .localhost straight to the loopback address (127.0.0.1/::1), so myapp.localhost behaves exactly like localhost without any hosts file editing or DNS setup.
Starting with .NET 10, ASP.NET Core builds on this and adds first-class support for a .dev.localhost subdomain. The project templates for ASP.NET Core Empty and Blazor Web App can combine your project name with that suffix, so instead of:
https://localhost:7099
you get:
https://myapp.dev.localhost:7099
That's the checkbox. It's also available from the CLI if you're not going through the Visual Studio wizard:
dotnet new web -n MyApp --localhost-tld
Remark: Kestrel is aware of .localhost addresses specifically. When your launch profile or ASPNETCORE_URLS points to a .dev.localhost name, Kestrel binds to the loopback address only (127.0.0.1/::1), not to all interfaces. It also logs both the .localhost and plain localhost addresses on startup, so you know both still work.
Why enable it
- You can actually tell your apps apart. The project name is right there in the address bar instead of a port number you have to memorize.
- Cookies and storage stop colliding. Because each app gets its own subdomain, browser storage that's scoped to the domain no longer bleeds between your local projects.
- HTTPS still works out of the box. The ASP.NET Core dev certificate already lists
*.dev.localhostas a Subject Alternative Name. You don't need to generate anything extra —dotnet dev-certs httpsalready covers it. A wildcard cert for*.localhostitself isn't valid for a top-level domain, which is exactly why the.devsubdomain exists. - Nothing breaks. Kestrel keeps listening on plain
localhostat the same time, so tools or scripts that still calllocalhost:7099keep working.
The one gotcha: Safari
Safari on macOS doesn't resolve *.localhost names automatically. If you're testing in Safari, fall back to the plain localhost address — it's still there, side by side with the .dev.localhost one.
The same applies to non-browser clients. Some HTTP clients and tools resolve .localhost names through the normal DNS stack instead of special-casing them, and if your DNS doesn't know what to do with them, the request just fails. For those cases, keep using regular localhost.
That's it! A small checkbox, but now you know exactly why it's there — and when to leave it unchecked.