CNAME Rules

2012-06-25 Thread Srinivas Krishnan
The RFC rules on CNAMEs is fairly tight but I am seeing an increasing amount of traffic with misconfigured CNAMEs some of which are accepted by BIND as valid responses. The examples capture three trends, note these are actual responses: 1) Example-1: CNAME in the additional section necessary to

Re: CNAME Rules

2012-06-25 Thread Chuck Swiger
On Jun 25, 2012, at 2:13 PM, Srinivas Krishnan wrote: The RFC rules on CNAMEs is fairly tight but I am seeing an increasing amount of traffic with misconfigured CNAMEs some of which are accepted by BIND as valid responses. The examples capture three trends, note these are actual responses:

Re: CNAME Rules

2012-06-25 Thread Srinivas Krishnan
Chuck, You are using a caching resolver to check the responses and you only see response after its been resolved by Google's DNS server. Try dig @ns1.wordpress.com after12.failblog.org. to see the actual records that you would receive if you were a DNS server performing an authoritative query

Re: CNAME Rules

2012-06-25 Thread Mark Andrews
In message CA+zrinE1sHkojS1fCNdcgZtF-+QQrTkqmRcfXZ1kUiBr=sq...@mail.gmail.com , Srinivas Krishnan writes: The RFC rules on CNAMEs is fairly tight but I am seeing an increasing amount of traffic with misconfigured CNAMEs some of which are accepted by BIND as valid responses. The examples

Re: CNAME Rules

2012-06-25 Thread Chuck Swiger
On Jun 25, 2012, at 2:34 PM, Srinivas Krishnan wrote: You are using a caching resolver to check the responses and you only see response after its been resolved by Google's DNS server. The overwhelming majority of Internet users are using caching resolvers running at their ISP, employer, etc.

Re: CNAME Rules

2012-06-25 Thread Srinivas Krishnan
Mark, Is the first parsing step over both Answer and Additional sections, I was under the impression that Named parses the response into RRSets from the Answer section and if there is a CNAME chain both within the same zone it follows the chain as well. But no additional sections are checked

Re: CNAME Rules

2012-06-25 Thread Srinivas Krishnan
Chuck, I am talking from the point of view of a DNS server not a client resolver. Anyways note that the entire CNAME chain is from the same wordpress zone, so the chain should be followed without requiring an additional query and there is no need for trying to short circuit the process by