Re: [dnsext] CNAME/DNAME and NXDOMAIN

[Nicholas Weaver <[e-mail]>]

On Nov 14, 2011, at 11:06 AM, Evan Hunt wrote:

>>> We (ISC) have looked at not following CNAME records when generating
>>> such replies.  We already discard the rest of the response and
>>> requery for the target of the CNAME.
>> 
>> So you would query the same machine, despite that server is giving you a
>> chain?
> 
> A server may claim, through misconfiguration or malice, to
> be authoritative for the target of a CNAME when it isn't.
> For example, suppose 'cname.example.com' points to
> 'target.example.com', but 'target.example.com' is actually a
> zone cut and is delegated to some other server entirely.  The
> only way to find out is to with a followup query.

There's three main themes we've seen with netalyzr:

a)  Requery regardless


b)  Accept when the name is internal or equal (eg, the system is authoritative for foo.com, and the cname refers to anything.{optional}.foo.com)


c)  Accept when the server has already been identified as the authority for the target domain (eg, the system is authoritative for foo.com AND bar.com, the resolver knows this by previous queries, and the CNAME is in the form example.foo.com CNAME example.bar.com, example.bar.com A 1.2.3.4).

Notably Google Public DNS does C.