Why ALIAS-type DNS Records Break The Internet

Re:Why ALIAS-type DNS Records Break The Internet by kalleboo on Wednesday January 08, 2014 @12:29PM (#7024919)

Can someone explain the rational in the standard disallowing CNAMEs on apex domains?

Before I learned about this restriction I actually had my site configured like that (my DNS provider had poor validation...) and it seemed like it worked for at least 2/3 users (who apparently had lenient DNS servers)

[ Parent | on HN ]

Re:Why ALIAS-type DNS Records Break The Internet by colmmacc on Wednesday January 08, 2014 @12:47PM (#7025052)

CNAMEs are name-level aliases. So if for example I make the following query;

  name=www.example.com type=A

and get a response of the form;

  www.example.com 3600 IN CNAME www.example.org

a resolver will then recurse and lookup name=www.example.org, type=A. The CNAME indirection is cacheable for all queries to www.example.com though, of any type. So if I make a query for;

   name=www.example.com type=AAAA

the resolver can skip any query to the nameservers for www.example.com and go straight to a query for name=www.example.org, type=AAAA. So in effect a CNAME "masks" all records of any type, for a given name.

At zone-apexes this becomes a problem. Zone apexes are required to have SOA and NS record sets which play important roles in record-not-present responses and nameserver discovery respectively. Another problem is masking MX records, but you could always copy the MX records at the target name to work around that.

[ Parent | on HN ]