Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it allowed to have an NS record be a CNAME? E.g.:

subdomain.example.com.       IN NS  ns1.example.com.
ns1.example.com.             CNAME  foo.example.com.
foo.example.com.             IN A   10.1.1.1

This doesn't seem to work in bind though this (of course) does:

subdomain.example.com.       IN NS  foo.example.com.
foo.example.com.             IN A   10.1.1.1

Any pointers to RFCs prohibiting this setup would be appreciated.

share|improve this question

1 Answer 1

up vote 11 down vote accepted

The actual RFC that defines the NS RR (RFC1035) just says that it's a domain-name without specifying the RR type of the target (though it does make it clear that it can't be an IP). It does get specific mention in RFC1912 though, section 2.4:

Having NS records pointing to a CNAME is bad and may conflict badly with current BIND servers. In fact, current BIND implementations will ignore such records, possibly leading to a lame delegation. There is a certain amount of security checking done in BIND to prevent spoofing DNS NS records. Also, older BIND servers reportedly will get caught in an infinite query loop trying to figure out the address for the aliased nameserver, causing a continuous stream of DNS requests to be sent.

Not quite a MUST NOT, but it certainly fits the behavior you're seeing

share|improve this answer
2  
And RFC1034 says, "Domain names in RRs which point at another name should always point at the primary name and not the alias. This avoids extra indirections in accessing information....Of course, by the robustness principle, domain software should not fail when presented with CNAME chains or loops; CNAME chains should be followed and CNAME loops signalled as an error." –  larsks Jan 14 '11 at 19:57
3  
I found that RFC 2181 10.3 clearly says that it is invalid but your answer was good enough. –  Mark Wagner Jan 14 '11 at 21:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.