Subject: [dnsext] Help me explain CNAMEs

From: John Levine <[email-masked]>
Date: 10 Feb 2010 03:55:28 -0000

I've been having an argument about CNAMEs with a friend who, I would
think, is quite familiar with the operations of the DNS.  But at least
one of us is seriously confused about CNAMEs.

Are the answers to questions like these written down clearly anywhere?

A) With these DNS records:

a.b   CNAME c.d

c.d   A     1.2.3.4
z.c.d A     2.3.4.5

What does an A query for z.a.b return?  I know it's NXDOMAIN, but he
insists it should be 2.3.4.5.  The algorithm in RFC 1034 section 4.3.2
is reasonably clear once you have all your terminology straight, but I
know plenty of people who haven't been able to find it.  (Perhaps he
has CNAME confused with DNAME, but I think it's just not getting what
CNAME does.)

B) With these DNS records:

a.b   CNAME c.d
z.a.b A     3.4.5.6

c.d   A     1.2.3.4
z.c.d A     2.3.4.5

What does an A query for z.a.b return?  My understanding is that the
answer might be 3.4.5.6 or might be nothing, depending on whether a.b
is the apex of a zone and maybe other stuff, so don't do that.  But I
can't find a clear explanation in RFC 1034 or 2181 or anywhere else.

Is there a reference I've missed?  Or is this still poorly documented
folklore?

R's,
John

---

From: "Roy Arends" <[email-masked]>
Date: Tue, 9 Feb 2010 23:34:54 -0500

> Are the answers to questions like these written down clearly anywhere?

Probably.

> insists it should be 2.3.4.5. 

>From what you've written above, a resolver should return NXDOMAIN. It 
should not return 'z.c.d A 2.3.4.5'.

> The algorithm in RFC 1034 section 4.3.2
> is the apex of a zone and maybe other stuff, so don't do that. 

a.b CNAME can't be the apex of a zone, as CNAME can't co-exist with other 
data, like SOA and NS records.

The answer is 'z.a.b A 3.4.5.6', and not 'might be nothing, depending....'

> But I

I think 1034 3.6.2 and 4.3.2 are pretty clear on this. Maybe your friend 
can elaborate how he got to his answers.

Hope this helps,

Roy

---

From: Mark Andrews <[email-masked]>
Date: Wed, 10 Feb 2010 15:47:44 +1100

> insists it should be 2.3.4.5.

He is wrong.  If it was "a.b DNAME c.d" then it would be 2.3.4.5.

> has CNAME confused with DNAME, but I think it's just not getting what

	Assuming the above in is the root then, 2 matches, 3(a)
	doesn't match, 3(b) doesn't match, 3(c) matches and there
	is not "*" label, we have not followed a CNAME though there
	is a CNAME at the node.  so we just return name error
	(NXDOMAIN).
 
> can't find a clear explanation in RFC 1034 or 2181 or anywhere else.

	3.4.5.6

	Work though RFC 1034 section 4.3.2. 

	Lets assume the above is all in the root zone so you have a
	match at 2. 3(a) is a match as z.a.b exist.  There is no
	CNAME at z.a.b so the second paragraph does not apply and
	you apply the third paragraph and add the A record to the
	response and go to set 6.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 10 Feb 2010 08:50:12 -0800

>Are the answers to questions like these written down clearly anywhere?

Unless someone has better answers than Roy and Mark, I would give that a "no". Using "RFC 1034" and "clearly" and "CNAME" in the same sentence has proven to be wrong.

--Paul Hoffman, Director
--VPN Consortium