Subject: re: [dnsext] Help me explain CNAMEs

From: Dave CROCKER <[email-masked]>
Date: Wed, 10 Feb 2010 13:02:06 -0800

Folks,

>     * To: [email-masked]
>     * Subject: [dnsext] Help me explain CNAMEs
>     * From: John Levine <[email-masked]>
>     * Date: 10 Feb 2010 03:55:28 -0000
...
> Are the answers to questions like these written down clearly anywhere?
>
> A) With these DNS records:
>
> a.b   CNAME c.d
>
> c.d   A     1.2.3.4
> z.c.d A     2.3.4.5
>
> What does an A query for z.a.b return?

Folks,

John was given a couple of different cases.  One was perhaps in the style that 
he's cited.

However another one was:

a.b    CNAME   c.d
_x.a.b  TXT     foobar

c.d    A       1.2.3.4

The question is whether a CNAME is legal as a terminal RR for a domain name that 
also has a sub-domain?

That is, does CNAME affect the tree walk, for a client-provided string that 
marches down the hierarchy and happens to walk past the name containing the 
CNAME RR.

So, will a query to _x.a.b get foobar returned, or something else?

If the presence of a CNAME renders it illegal to have sub-domain names under the 
name containing the CNAME, where is this documented?

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: John Levine <[email-masked]>
Date: 10 Feb 2010 21:47:13 -0000

>If the presence of a CNAME renders it illegal to have sub-domain
>names under the name containing the CNAME, where is this documented?

I was mistaken, it doesn't, I was confused by the separate problem
of putting CNAMEs at the apex of a zone (which doesn't work either.)

There's a separate administrative issue unrelated to the DNS bits, of
managing the combination of CNAME and the other record.  In this
application the contents of the other record in the sub-domain are
supposed to track a similarly named record in a sub-domain of the
target of the CNAME.  Too bad nobody supports DNAME.

R's,
John

---

From: Mark Andrews <[email-masked]>
Date: Thu, 11 Feb 2010 08:55:40 +1100

> The question is whether a CNAME is legal as a terminal RR for a domain name t

yes.
 
> marches down the hierarchy and happens to walk past the name containing the 

No.
 
> So, will a query to _x.a.b get foobar returned, or something else?

foobar

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Mark Andrews <[email-masked]>
Date: Thu, 11 Feb 2010 10:22:02 +1100

> target of the CNAME.  Too bad nobody supports DNAME.

Firstly the majority of the nameservers (authoritative, recursive
and combined) on the planet support DNAME and have for the last 10
years.  Secondly DNAME is completely backwards compatible with the
existing servers.   The only requirement for using DNAME is that
all the authoritative servers for the zone need to support DNAME.

Every server that supports DNSSEC also supports DNAME.  If they
don't they are not RFC compliant.

Mark