How not to set up your DNS (part 16)

July 9, 2007

Sort of presented in the traditional illustrated format:

; sdig ns
; dig cname
;; flags: qr aa; QUERY: 1, ANSWER: 1, [...]
             hostmaster.localdomain. [....]

(The TTL has been omitted and the line wrapped for clarity.)

This is not how you are supposed to say 'I do not have a CNAME record'. What should be doing is returning a reply with nothing in the 'answer' section and their SOA record in the 'additional authority' section.

The net result of this issue is that a number of resolving nameservers will return SERVFAIL when asked to see if is a CNAME, which has various interesting downstream consequences.

(Technically the zone says that has two other nameservers, however a) disagrees, since the extras are not in the NS records that the first two return and b) the extra two are non-authoritative anyways.)

Written on 09 July 2007.
« A suggestion for HMAC signature construction
How many bits of information are in a password? »

Page tools: View Source, Add Comment.
Login: Password:
Atom Syndication: Recent Comments.

Last modified: Mon Jul 9 15:56:42 2007
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.