Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was told by our DNS administrator that the use of CNAME records was not "best Practice" and was a security vulnerability. is this true? I have always used CNAME records to reduce the management overhead of DNS records.

share|improve this question
3  
sounds like FUD to me. I don't see how a CNAME could be less secure than an A record, but I'll let someone with more knowledge chime in with an actual answer. –  Jim Deville Nov 5 '09 at 17:15
    
thats my thought. DNS is inherently insecure as it provides ip information and hosts. which could be an information exposure risk if the hosts aren't properly secure. security by obscurity. –  Jason Horner Nov 5 '09 at 17:39
add comment

5 Answers

up vote 4 down vote accepted
% dig www.google.com a

; <<>> DiG 9.6.1-P1-RedHat-9.6.1-6.P1.fc11 <<>> www.google.com a
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8426
;; flags: qr rd ra; QUERY: 1, ANSWER: 7, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION:
;www.google.com.                        IN      A

;; ANSWER SECTION:
www.google.com.         532778  IN      CNAME   www.l.google.com.

etc....

If it's good enough for Google, it's good enough for anybody.

Sure, if the target of the CNAME is out of your zone then it's information you don't control. But if both the left side and the right side are in your own domain then it's no risk at all!

share|improve this answer
add comment

I would say that is isn't true, unless pointed to good information proving otherwise.

There is a potential problem if you have CNAMEs referring to zones that are not controlled by yourself, as they could change the final result unexpectedly, but that is a perfectly normal "do you trust the 3rd party?" issue rather than a DNS specific one.

If I were you I would ask your DNS administrator if he has any info you can read on the issue he is concerned about - just make sure that the request sounds like you are trying to learn something rather than trying to prove him wrong. If he does give you a good answer, please post it here so we can be educated too!

share|improve this answer
    
This is great advice. It addresses the non technical aspect of the situation as well. –  Jason Horner Nov 6 '09 at 3:16
add comment

This is FUD. As already mentioned, the only way a CNAME is less secure than an A record is if it points to a third party domain you don't control. If it refers to another record in the same domain, then it's completely fine.

He may be confused, because certain types of records (like MX entries!) are not allowed to point to CNAMEs, they must point to A records as per the RFCs. This isn't a security issue per-se though, more of a "you may not receive e-mail being sent by RFC strict MTAs" issue.

share|improve this answer
add comment

Google uses tables to markup their pages. That's not because it is good for anybody, that's because they want to support every other browser out there.

CNAMEs are mostly used wrong way. But that's not a security issue, of course. CNAME to some other domain is not a security issue either. It's like to say that 302 redirect for OpenID authentication is a security issue. If you put something into DNS record value, then you are responsible for what you did. Maybe you really meant to put another domain there. No security problems.

It's a semantic (religion if you want) issue. CNAME record is meant to be a "canonical name" for a set of other names. See http://tools.ietf.org/html/rfc1034 page 14. I.e. you have www.dom.tld, www1.dom.tld, etc. All of these names have A records, aliases to IPv4 addresses. Now you add a www CNAME www1 record and it means that of two aliases, the www one is canonical, primary. This mechanism could be used to tell, i.e. search engine crawlers which of your names are aliases to another and which is primary. But, instead they use 301 redirects from www.dom.tld to just dom.tld or vice versa depending on their customs.

I'm not telling one must not use CNAMEs as aliases. It works, why not. It worked this way for many years, maybe it is the new truth, like systems must evolve with time, etc.

share|improve this answer
add comment

For address records which are not referred to by records which prohibit this, such as NS or MX records, they are fine. However, I would be careful if they cross a zone (even one you control) as it will then require additional DNS queries to resolve the target of the name.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.