Is it allowed to have an NS record be a CNAME? E.g.:

subdomain.example.com.       IN NS  ns1.example.com.
ns1.example.com.             CNAME  foo.example.com.
foo.example.com.             IN A

This doesn't seem to work in bind though this (of course) does:

subdomain.example.com.       IN NS  foo.example.com.
foo.example.com.             IN A

Any pointers to RFCs prohibiting this setup would be appreciated.


The actual RFC that defines the NS RR (RFC1035) just says that it's a domain-name without specifying the RR type of the target (though it does make it clear that it can't be an IP). It does get specific mention in RFC1912 though, section 2.4:

Having NS records pointing to a CNAME is bad and may conflict badly with current BIND servers. In fact, current BIND implementations will ignore such records, possibly leading to a lame delegation. There is a certain amount of security checking done in BIND to prevent spoofing DNS NS records. Also, older BIND servers reportedly will get caught in an infinite query loop trying to figure out the address for the aliased nameserver, causing a continuous stream of DNS requests to be sent.

Not quite a MUST NOT, but it certainly fits the behavior you're seeing

  • 5
    And RFC1034 says, "Domain names in RRs which point at another name should always point at the primary name and not the alias. This avoids extra indirections in accessing information....Of course, by the robustness principle, domain software should not fail when presented with CNAME chains or loops; CNAME chains should be followed and CNAME loops signalled as an error." – larsks Jan 14 '11 at 19:57
  • 11
    I found that RFC 2181 10.3 clearly says that it is invalid but your answer was good enough. – Mark Wagner Jan 14 '11 at 21:01
  • 1
    For added clarity: MUST NOT verbiage doesn't matter here because RFC 1912 is Informational and does not define a standard. Mark is correct that RFC 2181 is the correct reference. (RFC 1034 was written before the language standards solidified, hence the vagueness) – Andrew B May 16 '16 at 21:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.