Add CNAME record to DNS when A-record exists?

Question

We are administering the DNS zone for our customer, and they are in the process of making some change to.. whatever, doesn't matter. The consultant company doing the change for our client sent a request to us to add a bunch of CNAME records (and a SPF change, I think these are for DKIM) to the DNS zone of the client, all those CNAME record aliases are some external domain not in our DNS. Let's call it hostx.externaldomain.com.

But for three of the CNAME records to be added, there is already an existing record in our DNS:

• host1.example.com A (IP address)
• host2.example.com NS (load balancer)
• host3.example.com NS (load balancer)

So the first one is an actual web page behind that IP-address, and the other two are delegated to our load balancer which in turn has A-records for them etc. Our DNS refuses to add these three CNAME records because of the existing A and NS records for the same names, which is expected I guess.

However, now it seems to be unclear to everyone how to proceed from here. If I just remove the host1 A-record and add the CNAME-record (alias pointing to an external hostname not in our DNS), won't the https://host1.example.com web site stop answering right there?

In basic level I understand how CNAME and A would work if the alias was also in our DNS, like instead of:

• example.com A (IP address)
• www.example.com A (the same IP address as above)

I can remove the www A-record and replace it with:

• www.example.com CNAME example.com

which then means www.example.com will just use the same IP-address whatever is set for example.com (with an A-record).

So does this all mean that whoever is administering the DNS for that external hostname that the CNAME alias is pointing to (hostx.externaldomain.com), should first add an A-record to his DNS (hostx.externaldomain.com A (IP address)), where the IP-address is the same our host1 IP address is pointing to), and only after that I can remove our A-record and replace it with the CNAME record?

Then again I am unsure how that would work either as hostx.externaldomain.com already has some IP address set (just checked with ping) and I don't see how they could change that by setting an A-record point to host1 IP address... And also, all those other CNAME records that we are supposed to set use that same alias.

Answer 1

CNAME record must exist only on its own. You can not have a zone data like:

name A xx.xx.xx.xx
name CNAME othername

Some special records may coexist with CNAME, to attest it is authentic. DNSSEC specification mandates a use of RRSIG and NSEC for the purpose of authentication, which can coexist with CNAME, see RFC 4034 section 3 and RFC 4034 section 4. There are older specifications, RFC 2181, section 10.1, RFC 2535 section 2.3.5, which say the same for SIG, NXT and KEY records.

All end application data must be attached to the RR which is the CNAME target; see RFC1034 section 3.6.2 (the original DNS specification).

some.name.tld CNAME rec.othername.tld
rec.othername.tld A xx.xx.xx.xx
rec.othername.tld TXT text-rr-data

Also note, that CNAME label inherits not only A (address), but many other features of target label, notably TXT.

This (older) RFC also contains the harder version of above restriction which was lifted for DNSSEC:

If a CNAME RR is present at a node, no other data should be present; this ensures that the data for a canonical name and its aliases cannot be different.

Without DNSSEC, this harder restriction effectively still applies.