Re: [DNSOP] abandoning ANAME and standardizing CNAME at apex

Tony Finch <> Mon, 25 June 2018 16:08 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id F0B94130DCE for <>; Mon, 25 Jun 2018 09:08:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.2
X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id IDI_AfrQ0hOS for <>; Mon, 25 Jun 2018 09:08:54 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id C362C130E06 for <>; Mon, 25 Jun 2018 09:08:54 -0700 (PDT)
X-Cam-AntiVirus: no malware found
Received: from ([]:41266) by ( []:25) with esmtps (TLSv1:ECDHE-RSA-AES256-SHA:256) id 1fXU2u-000Zzh-eB (Exim 4.91) (return-path <>); Mon, 25 Jun 2018 17:08:52 +0100
Date: Mon, 25 Jun 2018 17:08:52 +0100
From: Tony Finch <>
To: Paul Vixie <>
cc:, Paul Wouters <>, Ray Bellis <>
In-Reply-To: <>
Message-ID: <>
References: <> <20180619190213.B76962846E19@ary.qy> <> <> <> <> <> <>
User-Agent: Alpine 2.11 (DEB 23 2013-08-11)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Archived-At: <>
Subject: Re: [DNSOP] abandoning ANAME and standardizing CNAME at apex
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 25 Jun 2018 16:08:57 -0000

Paul Vixie <> wrote:
> what do you expect non-dynamic servers to do in the presence of ANAME? i
> assume you'll recommend that they also host real A and AAAA RRsets at the same
> name-node, which only a dynamic authoritative would ignore?


> if so, there's a third work flow available, which is to use RFC 2136 dynamic
> update to periodically update those "last resort" or "static" A and AAAA
> RRsets, for a non-dynamic server.


> and if so, why aren't we just specifying that, and avoiding the creation of a
> new kind of authority server ("dynamic")?

A dynamic auth is (from the point of view of the trad DNS model) a kind of
master server: it has the signing keys (which secondaries don't), it
determines the contents of the zone according to its own rules (whereas
secondaries passively receive contents from elsewhere). Services like
Route53 and Dyn are effectively multi-master setups.

Dynamic auth servers exist. I would be pleased if ANAME makes it easier
for zone owners to move between providers with fewer portability problems
due to proprietary DNS extensions. Dunno how plausible that is, but
there's clearly demand, e.g. my favourite example (because they're using
one of my tools):

f.anthony.n.finch  <>
South Utsire: Northwesterly 5 to 7. Moderate, occasionally rough in south.
Fair. Good.