News for hackers. Stuff that matters.
Re:Why ALIAS-type DNS Records Break The Internet by colmmacc on Wednesday January 08, 2014 @12:47PM (#7025052)
CNAMEs are name-level aliases. So if for example I make the following query;

  name=www.example.com type=A
and get a response of the form;

  www.example.com 3600 IN CNAME www.example.org 
a resolver will then recurse and lookup name=www.example.org, type=A. The CNAME indirection is cacheable for all queries to www.example.com though, of any type. So if I make a query for;

   name=www.example.com type=AAAA
the resolver can skip any query to the nameservers for www.example.com and go straight to a query for name=www.example.org, type=AAAA. So in effect a CNAME "masks" all records of any type, for a given name.

At zone-apexes this becomes a problem. Zone apexes are required to have SOA and NS record sets which play important roles in record-not-present responses and nameserver discovery respectively. Another problem is masking MX records, but you could always copy the MX records at the target name to work around that.

There are no comments on this comment yet.