Re: Naked domain resolution with DNSSEC

Subject: Re: [dnsext] Naked domain resolution with DNSSEC Date: Wed, Oct 23, 2013 at 06:29:26PM +0000 Quoting Kumar Ashutosh ([email protected]):
> Hi Jim
> I agree on CNAME behaviour. My concern here is what option does the customer have in case he needs contoso.com and www.contoso.com both to be redirected to say contoso.dnsprovider.com

Done out of band is probably the only viable solution; traverse the
DNS to find which IP address is pointed to by "contoso.dnsprovider.com"
and add AAAA and/or A records to suit at the zone apex.

(The following code is ugly and untested but should give an idea. 
 Please copy and use it if you're brave but don't blame me if it 
 eats your homework.)

dig www.contoso.com CNAME +short | while read canon ; do 
	dig $canon A +short
	done | awk '
	{ printf "update add contoso.com. 84600 IN A %s\n\n", 
		$1; 
	}' | nsupdate -k verysecretkey.txt

On a related[0]¸ note, when we've got people from Microsoft here, why for
crying out loud does AD require a number of A records at the AD zone
apex pointing to the DC's for the AD? Wouldn't it be better to do that
with a SRV record pointing to the host names of the DC's?

-- 
Måns Nilsson     primary/secondary/besserwisser/machina
MN-1334-RIPE                             +46 705 989668
HELLO, everybody, I'm a HUMAN!!

[0] "related" as in dealing with apex A records in a Microsoft context..

_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlJoOZwACgkQ02/pMZDM1cUlyACdFEVILafCiWVX6/7d0jJod7V1
hVgAn2jgtRl+VloywZJpyapDOU+TZz71
=C1O8
-----END PGP SIGNATURE-----