CNAME record resolution

Question

I would like to understand how the process works for CNAME record resolution. Lets say I have a record on the DNS server NS1

proxy.example.com IN CNAME proxy.example1.com

NS1 is not authoritative for example1.com. On the server NS2 I have a record

proxy.example1.com IN A 1.2.3.4

proxy.example1.com is only resolvable from the clients network and not from the network where NS1 is located.

If the client asks for proxy.example.com, will the server NS1 try to resolve the whole chain on behalf of the client or will it return the name proxy.example1.com? And if it tries to resolve the whole chain what happens when it fails because NS2 is not reachable from NS1? What reply will it send to the client?

Thanks.

Answer 1

No, an authoritative-only server would only answer with the data it has.
Instead the resolver server is expected to cobble together the end result in the case of such a cross-zone alias.

The question does not detail any oddities in the DNS setup (other than a strange lack of connectivity, but which is likely not relevant), so I will just describe how things are generally expected to work:

                                                    ____________________
                                                   |                    |
                                            +----->| a.root-servers.net |
                                            |      | zone: .            |
                                            |      |____________________|
                                            |      
                                            |       ____________________
                                            |      |                    |
                                            +----->| a.gtld-servers.net |
 ______________________       __________    |      | zone: com          |
|                      |     |          |   |      |____________________|
| Client/stub resolver |<--->| Resolver |<--+      
|______________________|     |__________|   |       ____________________
                                            |      |                    |
                                            +----->| "NS1"              |
                                            |      | zone: example.com  |
                                            |      |____________________|
                                            |      
                                            |       ____________________
                                            |      |                    |
                                            +----->| "NS2"              |
                                                   | zone: example1.com |
                                                   |____________________|

Your scenario (without any caching, just for simplicity):

1. The client asks the resolver for proxy.example.com. IN A
2. The resolver asks a.root-servers.net for proxy.example.com. IN A
   • it gets a referral response for com (referring to a.gtld-servers.net)
3. The resolver asks a.gtld-servers.net for proxy.example.com. IN A
   • it gets a referral response for example.com (referring to "NS1")
4. The resolver asks "NS1" for proxy.example.com IN A
   • it gets the answer proxy.example.com. IN CNAME proxy.example1.com.
5. The resolver asks a.root-servers.net for proxy.example1.com. IN A
   • it gets a referral response for com (referring to a.gtld-servers.net)
6. The resolver asks a.gtld-servers.net for proxy.example1.com. IN A
   • it gets a referral response for example1.com (referring to "NS2")
7. The resolver asks "NS2" for proxy.example1.com. IN A
   • it gets the answer proxy.example1.com. IN A 1.2.3.4
8. The resolver finally responds to the client
   • it sends an answer that combines the necessary data from the different sources:
     • proxy.example.com. IN CNAME proxy.example1.com.
     • proxy.example1.com. IN A 1.2.3.4
9. The client can see the alias definition as well as the requested record at the canonical name (which is what is actually used).