59

Never you mind the comments section below, and never you mind the previous answers in the edit history. After about an hour of some conversation with friends (thank you @joeQwerty, @Iain, and @JourneymanGeek), and some jovial hacking around we got to the bottom of both your question and the situation on the whole. Sorry for brusqueness and misunderstanding ...


38

The certificate name must match what the user entered in the browser, not the 'final' DNS record. If the user enters docs.tenantcompany.com then your SSL certificate has to cover that. If docs.tenantcompany.com is a CNAME to foo.example.com, the certificate does not need to cover foo.example.com, just docs.tenantcompany.com.


32

In addition to Wesley's excellent answer, I'd like to add that there is already a solution to prevent this. It's called DNSSEC. The basics are this: You register your domain (I'll go with the eminent name wesleyisaderp.com here, just because.) You register your name servers with your registrar, usually via a web interface that you authenticate to with a ...


24

Jason's answer is correct. But just to clarify terms a bit here, "DNS redirect" is a bit of a misnomer. DNS has CNAME records (a.k.a. aliases) which is a name pointing to another name. But it's not a redirect. The translation from name to name to IP all happens in the background and your browser only cares about the initial name. The only thing that does ...


21

Let's break it down a little. The NS records in the TLD zone (for example, example.com NS ... in com) are delegation records. The A and AAAA records in the TLD zone (for example, ns1.example.com A ... in com) are glue records. The NS records in the zone itself (that is, example.com NS ... in example.com) are authority records. The A and AAAA records in ...


16

DNS records are a hierarchy. Anything at the same level (v1.example.com, v2.example.com, etc) will all be resolved by the NS records set for that level (example.com) You can have different nameservers for different levels / subdomains if you are so inclined, for example (example.com at godaddy, subdomain1.example.com network solutions, subdomain2.example....


15

Traditionally name servers don't send a short response to a query but an RFC 1034-1035 compliant full response which includes the authority section that contains Resource Records that point toward the authoritative name server(s). The why is probably because with the distributed and delegated nature of DNS it seemed a good idea at the time to include the "...


14

In today's world, I do not recommend creating new zones with arbitrary top level domains, as these might make it into "official dns" at any point in time. I personally would favor the subdomain delegation scenario, as it seems to be fitting what you try to do. (Consolidate but give control to engineering) Maybe you can even find a web-front-end for MS DNS ...


14

First and foremost, make sure you own the domain.tld you plan on using (mit.edu). Even if this never connects to the internet, that's not the point. There are huge benefits to having a hierarchy of dns that at least somewhat matches the org. I've only seen this done when there is someone/people to manage that department in terms of IT support. This is in ...


14

For general HTTP purposes (web browsing, etc.), DNS cannot be used to direct a browser to use a specific port. Browsers are hard-codes to assume 80 for HTTP and 443 for HTTPS. You "could" host another web site on that sub domain that just does a redirect to the target site and port.


12

Unless I'm misunderstanding the question, I do this regularly with BIND, and it seems to be fine as long as each zone is absolutely identical. On my primary nameserver, I have named.conf entries that point to the generic zonefile, eg zone "example.com" { type master; file "primary/example.GENERIC"; }; zone "example.co.uk" { type ...


12

You'll be happy to know that most (if not all) DNS server software has protection against this scenario. For example: Microsoft DNS server has a MaxCacheTTL setting, which defaults to 86400. So regardless of any TTL setting in DNS RRs, if this is not adjusted, the DNS server will not cache anything longer than a day. BIND also has a similar setting max-...


12

As mentioned in the comments, you will need to use A records instead of CNAME records. CNAME records will not be able to point at an IP Address. The key to making each of the sites to work is to specify ServerName correctly for each virtual server in your Apache config.


12

The term you're looking for is CNAME, and the answer to your question is both yes and no. First, here's an example of how a CNAME works in a zone file. example.se IN SOA ns1.example.se. hostmaster.example.se. ( [....] ) server1 A 10.1.2.3 www CNAME server1 Now you just need to update the server1 record in ...


12

There will be potentially be an extra delay as creating a separate zone for the world.example.com subdomain typically also implies delegation to different authoritative name servers. If the same authoritative nameservers are used for both the example.com and the world.example.com zones there is no performance difference. DNS resolvers need to follow the ...


11

Use A record to point to the sub domains myurl.com. A 300 123.123.123.123 api.myurl.com. A 300 123.123.123.123 app.myurl.com. A 300 123.123.123.123 preview.myurl.com. A 300 123.123.123.123 www.myurl.com. CNAME 300 myurl.com.


10

The error messages and the referenced RFC2181 5.4.1 pretty much already tells what's wrong: you are having conflicting NS records in your zone and in the parent zone as "glue" records. "Glue" above includes any record in a zone file that is not properly part of that zone, including nameserver records of delegated sub- zones (NS records), address ...


10

When overlapping zones are defined on an authoritative nameserver, the most specific zone is used to provide the answer. A query of example.com. IN A? hits the example.com zone. A query of foo.example.com. IN A? hits the foo.example.com zone. If foo.example.com is defined in the example.com zone, it will be ignored. A query of sub.foo.example.com. IN A? ...


9

If you split your common zones into a separate configuration file, then you can use the 'include' directive to include that file in each of your views. All your non-split zones go in /etc/named/common-zones.conf: zone "example.com" IN { type master; file "zones/example.com.db"; }; Then include that file in /etc/named.conf: view "dmz" { ...


9

I wanted to understand if I my tenant company has a wildcard SSL certificate, will it work with this setup or a new SSL certificate has to be purchased for docs.tenantcompany.com? Short answer: No. If your tenant company has a wildcard in the name *.tenantcompany.com, that is sufficient to install on your server to cover accesses via that name. Whether you ...


8

In BIND's zone file as well as in named.conf, IN is a class. You can omit it in any of the files or in both, in any case if class is not explicitly specified, the default "IN" is used. Regarding the meaning of "IN" - RFC 1035 section 3.2.4: The following CLASS mnemonics and values are defined: IN 1 the Internet ...


8

You need at least one character of whitespace or a tab (credit: @mdpc's edit for the tab reminder) at the start of every line that begins with the "IN". Some administrators are not partial to tabs: in such cases you should try to keep all of these entries aligned with equal whitespace where possible to do so. This is because you are technically leaving out ...


8

There is in fact a SOA record, it's just not where you're expecting it. Let's take a look at the AUTHORITY section...keep in mind that ns1.nservers.co.uk. is not in any way affiliated with the nic.uk. nameservers, which are authoritative for co.uk.. $ dig @ns1.nservers.co.uk. +norecurse +noall +authority vancemillerkitchensuk.co.uk SOA co.uk. ...


8

It works as expected. The incorrect assumption here is that all names should have NS records. Instead, the set of nameservers is defined on a per zone basis, with NS records at the zone apex only. Eg, if you have example.com and have not delegated any subdomains elsewhere, then there are no further NS records anywhere under example.com. If you delegate foo....


8

Technically, as I understand DNS, only the hello part is considered the host name, the rest is the domain name. As such, it resolves the same way, in your case the DNS zone includes both the example.com and the subdomain world.example.com, it's just a matter of preference how you annotate it. However, the only time I've ever seen records like that are for ...


7

The allow-query directive is limited to only the trusted acl containing only localhost. This is why you get a response only from localhost. You need to change this to any. Also note the listen-on and listen-on-v6 stanzas need to have IP addresses other than localhost in them - otherwise outside clients will never be able to connect to your nameserver.


7

From RFC 1033 one of the core DNS RFC's (the DNS Wikipedia page has a nice list) SOA (Start Of Authority) <name> [<ttl>] [<class>] SOA <origin> <person> ( <serial> <refresh> <retry> &...


7

As sysadmin for an environment with dozens of DNS servers and thousands of domains, I feel (well, felt) your pain. We solved it with puppet and templates. All our domains and servers also have entries in our infrastructure database (even the zones get generated from there, but that's irrelevant for now). So we do roughly the following: Master nameservers: ...


7

Your first record ("blank"/apex/root) can, but probably shouldn't, be a cname; see How to overcome root domain CNAME restrictions? on Stack Overflow: This is often attempted by inexperienced administrators as an obvious way to allow your domain name to also be a host. However, DNS servers like BIND will see the CNAME and refuse to add any other resources ...


7

You can't (reliably). You can escape the dot (using a \) in the mailbox name, but this isn't always an option. Escaping the dot isn't officially standardized anywhere that I am aware of and although it is widely supported these days there isn't any guarantee that it will be properly parsed by any consumer of that information. See the following resources: ...


Only top voted, non community-wiki answers of a minimum length are eligible