Re: Naked domain resolution with DNSSEC

Hi Jim
I agree on CNAME behaviour. My concern here is what option does the customer have in case he needs contoso.com and www.contoso.com both to be redirected to say contoso.dnsprovider.com

Recapturing this from my previous mail
" One more scenario where naked domain issue becomes evident is when the authoritative servers try to point a few of their records at some third party DNS hosting services

Contoso.com
{
www 	CNAME 	contoso.dnsprovider.com (owned by a third party)
internal A		1.1.1.1
}

How does it set out to achieve the naked domain resolution. It cannot add CNAME at the apex. Also it cannot add DNAME to the loadbalancer.net at the zone apex as then it can't host internal records and also resolution for www will point to www.dnsprovider.com

How will such a customer ensure that both www.contoso.com and contoso.com get pointed to contoso.provider.com."

Thanks
Ashu

-----Original Message-----
From: Jim Reid [mailto:[email protected]] 
Sent: Wednesday, October 23, 2013 11:35 PM
To: Kumar Ashutosh
Cc: Dave Lawrence; Thirunadha Reddy; [email protected] Group; Sourav Sain
Subject: Re: [dnsext] Naked domain resolution with DNSSEC


On 23 Oct 2013, at 18:39, Kumar Ashutosh <[email protected]> wrote:

> The Microsoft authoritative DNS servers prevent adding CNAMEs at the zone apex. But there may be other DNS servers which may be allowing this and the validating resolvers are returning Serv_fail, As Andrew suggested.

This is how it should be. If a name exists as a CNAME, it cannot exist as any other RRtype. Except of course for any RRSIGs and NSEC or NSEC3's if the zone is signed. Adding a CNAME at the zone apex fails because that name must at by definition already have at least a SOA and some NS records.

_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext