Re: [dnsext] SRV and wildcard CNAME

[Masataka Ohta <[e-mail]>]

Mark Andrews wrote:

>> However, as the only protocol which may be used by *LAZY* users,
>> other than http, is https, it may share the same port as http,
>> if servers are implemented to distinguish them by the first
>> byte of the request.
> 
> It breaks *all* protocols that use SRV.

When the protocols used at the domain are http and https only,
nothing break.

Otherwise, users can not be very lazy.

> Wildcarding a SRV record is a bad idea.

If you say so, you should also say:

	Wildcarding a CNAME record is a bad idea

to deny *YOUR* example.

>>         *.example.com  CNAME com.example.net
>>
>>         *.example.org  CNAME org.example.net
>>
>> 	com.example.net SRV  0 1 P com.server.example.net
>> 	org.example.net SRV  0 1 P org.server.example.net
>>
>> should work, even though it violates SRV specification requiring
>> "name MUST NOT be an alias".
> 
> The you have a client that tries to use the "foo" protocol which is
> SRV aware.  The client asks for _foo._tcp.bar.example.com SRV and
> sends up being sent to the http server.

If users are less lazy, they can set up:

	_http._tcp.www.example.com SRV 0 1 P com.server.example.net

	_http._tcp.www.example.org SRV 0 1 P org.server.example.net

and a server operator set up:

	com.server.example.net CNAME shared.server.example.net
	org.server.example.net CNAME shared.server.example.net

for name based virtual hosting, which is not more difficult for
users than users set up:

	www.example.com CNAME shared.server.example.net

	www.example.org CNAME shared.server.example.net

						Masataka Ohta