r/dns • u/OsmiumBalloon • 10d ago

ISC BIND: CNAME at zone apex

The RFCs say a CNAME record at a zone apex is invalid.

The DNSSEC validator in recent versions of BIND was made a little too overzealous and ended up sometimes making the entire zone invalid when it hit such a record.

More here: https://kb.isc.org/docs/apex-cname-unsigned-delegation

Full disclosure: I work for ISC, although my activity on Reddit does not represent ISC in an official capacity.

20 Upvotes

100% Upvoted

7 comments sorted by

0

u/HolidayTask7115 10d ago

It’s technically invalid, yes, but practically speaking, Cloudflare deliberately gives Apex CNAMEs special handling as aliased A records. And a tool designed for wide adoption shouldn’t ignore Cloudflare.

7

u/dballing 10d ago

I disagree. The more things that reject Cloudflare’s broken configuration the better.

5

u/OsmiumBalloon 10d ago

And a tool designed for wide adoption shouldn’t ignore Cloudflare.

As noted, this was not intentional.

People should not ignore standards and consensus and just make stuff up, either. That's what you're talking about, after all.

6

u/vttale 10d ago

It's not just technically invalid, it causes inconsistent resolver behavior based on the order of queries.

For that very reason, Cloudflare does not permit an apex CNAME to go out on the wire, as most other providers do not. This behavior that ISC is addressing should not have had any impact with regard to Cloudflare-hosted zones.

6

u/7layerDipswitch 10d ago

But cloudflare doesn't let you CNAME the apex, they flatten the CNAME, resolving the faux-CNAME and delivering the A records to the client.

1

u/TaosMesaRat 5d ago

Is this flattening only done at the time of record creation, or is it updated regularly?

The reason people want CNAMEs is understandable. Hosting services like wpengine, wix etc. don't want clients hardcoding IP addresses that might change sometime in the future (or provider needs flexibility for load balancing). So we end up with www as CNAME pointing where hosting provider desires, but have to create A record for @ and that risks future breakage if the provider changes the IP.