1

We are administering the DNS zone for our customer, and they are in the process of making some change to.. whatever, doesn't matter. The consultant company doing the change for our client sent a request to us to add a bunch of CNAME records (and a SPF change, I think these are for DKIM) to the DNS zone of the client, all those CNAME record aliases are some external domain not in our DNS. Let's call it hostx.externaldomain.com.

But for three of the CNAME records to be added, there is already an existing record in our DNS:

  • host1.example.com A (IP address)
  • host2.example.com NS (load balancer)
  • host3.example.com NS (load balancer)

So the first one is an actual web page behind that IP-address, and the other two are delegated to our load balancer which in turn has A-records for them etc. Our DNS refuses to add these three CNAME records because of the existing A and NS records for the same names, which is expected I guess.

However, now it seems to be unclear to everyone how to proceed from here. If I just remove the host1 A-record and add the CNAME-record (alias pointing to an external hostname not in our DNS), won't the https://host1.example.com web site stop answering right there?

In basic level I understand how CNAME and A would work if the alias was also in our DNS, like instead of:

  • example.com A (IP address)
  • www.example.com A (the same IP address as above)

I can remove the www A-record and replace it with:

which then means www.example.com will just use the same IP-address whatever is set for example.com (with an A-record).

So does this all mean that whoever is administering the DNS for that external hostname that the CNAME alias is pointing to (hostx.externaldomain.com), should first add an A-record to his DNS (hostx.externaldomain.com A (IP address)), where the IP-address is the same our host1 IP address is pointing to), and only after that I can remove our A-record and replace it with the CNAME record?

Then again I am unsure how that would work either as hostx.externaldomain.com already has some IP address set (just checked with ping) and I don't see how they could change that by setting an A-record point to host1 IP address... And also, all those other CNAME records that we are supposed to set use that same alias.

2
  • 1
    The question is: Why are they wanting to replace the existing records with a CNAME to something else? Are they taking over the corresponding services? Feb 27, 2021 at 14:30
  • In this case we are only administering the DNS for the client. Our client is changing their "newsletter service", whatever they may be using, to some other, and apparently a bunch of DKIM-related CNAME additions and one SPF change is needed in order to do that. But now there is a clash with those three new CNAMEs and existing (A) records... I was just thinking if this is some common case where there is some easy solution I am just overlooking, but I guess I need to ask the consultation company who originally asked for these changes, what exactly their changes are supposed to do.
    – timppu
    Mar 1, 2021 at 6:49

1 Answer 1

2

CNAME record must exist only on its own. You can not have a zone data like:

name A xx.xx.xx.xx
name CNAME othername

Some special records may coexist with CNAME, to attest it is authentic. DNSSEC specification mandates a use of RRSIG and NSEC for the purpose of authentication, which can coexist with CNAME, see RFC 4034 section 3 and RFC 4034 section 4. There are older specifications, RFC 2181, section 10.1, RFC 2535 section 2.3.5, which say the same for SIG, NXT and KEY records.

All end application data must be attached to the RR which is the CNAME target; see RFC1034 section 3.6.2 (the original DNS specification).

some.name.tld CNAME rec.othername.tld
rec.othername.tld A xx.xx.xx.xx
rec.othername.tld TXT text-rr-data

Also note, that CNAME label inherits not only A (address), but many other features of target label, notably TXT.

This (older) RFC also contains the harder version of above restriction which was lifted for DNSSEC:

If a CNAME RR is present at a node, no other data should be present; this ensures that the data for a canonical name and its aliases cannot be different.

Without DNSSEC, this harder restriction effectively still applies.

3
  • 3
    I agree with the overall answer but RRSIG would be a more relevant example, those other records are not really around at this point. Feb 27, 2021 at 10:58
  • 1
    I updated the answer to reflect this. Thank you. Feb 27, 2021 at 19:41
  • Thanks, I accepted this as the answer. So the consultant finally replied, and suggested to the client that we use alternative names for those three conflicting names, e.g. insteadl of host1.domain.com CNAME hostx.externaldomain.com we use host1-newsletter.domain.com CNAME hostx.externaldomain.com So, yeah, I guess that solves the problem. Just don't use CNAME for already taken hostnames (at least in this case). :)
    – timppu
    Mar 1, 2021 at 10:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.