1

I recently came across a zone file for BIND which used only Address records with fully qualified domain names for each IP.

Example snippet:

subdomain1.example.com. IN A 192.168.1.10
subdomain2.example.com. IN A 192.168.1.10
subdomain3.example.com. IN A 192.168.1.10

There are also multiple fully qualified names resolving to the same IP addresses.

Is there a issue with this configuration? (i.e. not using CNAME or ALIAS?)

Can this be done or will it cause issues?

Since I am not an expert I assume some issues include:

  • Reverse lookup. (first response is considered correct?)
  • Certificates (if not first response then cert error?)
4

That is only a forward zone and as @bodgit answered that is perfectly valid for all use cases.

The main potential disadvantage of the above is an administrative one. For a single zone not too much of an issue but with many host names in many different domains much more so: in case of a change of ip-address every A record with that ip-address will need to be updated, where CNAME records will automatically follow the ip-address change of their target FQDN and would not need to be updated.

For a reverse zone, doing something almost similar is AFAIK also technically valid:

10.1.168.192.in-addr.arpa. IN PTR  subdomain1.example.com.
10.1.168.192.in-addr.arpa. IN PTR  subdomain2.example.com.
10.1.168.192.in-addr.arpa. IN PTR  subdomain3.example.com.

but that won't have the effect people usually seem to expect.

subdomain1.example.com. will always point to 192.168.1.10 but the reverse lookup will most of the time NOT point back to subdomain1.example.com.
The above will become a round-robin DNS record where:

  • 1/3 of the responses will return an "incorrect" response of subdomain2.example.com.
  • 1/3 of the responses will return an also "incorrect" response of subdomain3.example.com.
  • only a 33% chance exists that the "correct" response of subdomain1.example.com. will be seen.
  • What do you think is "incorrect" with 2/3 of the responses? Actually, the responses will return all three names. The only specific use case where a match between forward and reverse DNS is mandatory is with mail transport agents; and AFAIR there all tests are that the originla forard name be among the rDNS results ... – Hagen von Eitzen Nov 1 '18 at 1:06
6

It's perfectly valid to have multiple A records pointing to the same IP. Reverse lookup has nothing to do with it; as that would a) be in a separate zone and b) would be using PTR records. Certificates are also irrelevant here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.