Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I've got a domain registered with Dreamhost, which apparently does not do recursive lookups, and an app on Heroku. Heroku apps are always configured to use a CNAME record to


Authoritative DNS: (for

CNAME record: ->

Resolves to:        Set of A records for EC2 IPs

I've been told by some folks trying to connect to the app from behind a Windows Server 2003 DNS Server that it handles SERVFAIL differently and cannot resolve the DNS. I'm trying to understand if this is truly a configuration issue on my side or theirs, notably, per the title:

Must the authoritative DNS server for a domain be recursive to allow CNAME records pointing to other domains?

share|improve this question
up vote 5 down vote accepted

No you don't need to have recursion on for authoritative DNS servers. Depending on who you ask it's even considered good practice that (if possible) your authoritative server not be recursive as it's a line of defence against some DoS attacks. (Cisco's document is here for example)

A sample from my domain is below (Server is running Bind 9 and is non-recursive).

; <<>> DiG 9.5.1-P3 <<>> mail.<snip> @<my authoritative master>
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1216
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 4

;mail.<snip>.       IN  A

mail.<snip>.        86400   IN  CNAME     158151  IN  CNAME   33    IN  A

;; AUTHORITY SECTION:     153556  IN  NS     153556  IN  NS     153556  IN  NS     153556  IN  NS

;; ADDITIONAL SECTION:     169823  IN  A     169823  IN  A     169823  IN  A     169823  IN  A

It sounds more like a DNS misconfiguration at the Windows 2003 DNS than anything else.

share|improve this answer
To emphasize the'll be hard pressed to find anyone who knows anything about DNS who will suggest recursion on authoritative servers is a good idea. Most of the nasty DNS-related bugs require recursion to be enabled and whenever possible, you should separate those roles. – icky3000 Feb 10 '10 at 7:26

Dreamhost uses powerdns (ugh), just as bad .. but Windows recursive resolvers do indeed suck.

The question is , why are the Windows dns boxes at your client sites getting SERVFAIL? They shouldnt be.

And, the above poster is correct - if you're authoritative to a domain, you can have it cname, A, fail, you name it, to any domain/ip (you don't have to know the glue to the other domain).

Perhaps that's it - that the DNS resolvers that asked for your A record (and got a cname) stuck thinking it would also know the glue for .

You could analyse the listed nameservers for the original query to see what's happening , but in a 'worse case' scenario you could just serve out 'A' records .. it'd just be a P-I-T-A.

If you want to post a realworld fail-domain that's cool; you could also PM or AIM nerdNG :p (I love finding root-cause probs with dns. Go fig)

share|improve this answer
Here's what I get searching for my own mail domain (not the real example, but also on Dreamhost): nslookup I get a SERVFAIL, however, if I just do a dig / nslookup / whatever without specifying the nameserver, everything is spiffy. – scotchi Feb 10 '10 at 8:02

Authoritative servers should NOT be configured to offer recursive service. Not even to work around a potential Microsoft bug.

I can't quote chapter and verse at the moment (if I find it I'll update). However this is very much the accepted "best common practise" for operation of DNS servers.

If some resolver in your lookup chain is returning SERVFAIL then that simply indicates a misconfiguration somewhere or that you're asking the wrong question (or the right question with the wrong flags).

In your case, the servers return SERVFAIL if you ask for a recursive answer (which happens to be what nslookup does by default). They're perfectly entitled to do that, they're authoritative servers, not recursive.

On my system, if I use dig instead and specifically disable recursion I get:

% dig +norecurse

; <<>> DiG 9.6.0-APPLE-P2 <<>> +norec
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54426
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 13

;  IN A

share|improve this answer
Just to be clear here, so nslookup should not return SERVFAIL, is that correct? – scotchi Feb 10 '10 at 10:03
it does if you ask the question the wrong way - see edits to my answer – Alnitak Feb 10 '10 at 10:37

I've been looking for "similar" questions to my own here and there seems to be quite a few similar points (e.g. Windows2003 DNS servers and SERVFAIL response)

If anyone has any link to the "potential Microsoft bug" above, would they mind posting details.

Much appreciated.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.