Re: [DNSOP] RFC2317 Question: Resolving cname delegation

Hector Santos <> Sat, 26 August 2017 18:23 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 9DD581321F1 for <>; Sat, 26 Aug 2017 11:23:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key) header.b=hDRaPj6B; dkim=pass (1024-bit key) header.b=cOJy9Jyh
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id ZulDeN5WCO4R for <>; Sat, 26 Aug 2017 11:23:08 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id E73FB1329B8 for <>; Sat, 26 Aug 2017 11:23:06 -0700 (PDT)
DKIM-Signature: v=1;; s=tms1; a=rsa-sha1; c=simple/relaxed; l=1443; t=1503771782;; atpsh=sha1; h=Received:Received:Received:Received:Message-ID:Date:From: Organization:To:Subject:List-ID; bh=VCLaJywTm2ROx2mWZJG2H7Q4AzA=; b=hDRaPj6BHCBriEWLZdO0Ke4IV/dvZpa2iAYK95mUWf4N5qOYEZHZiGfpAbAY0Q WbEBJC3icL/ZivGZ3dWRX2AMNITLmFQ4Sfrb2SH+yxCqMosxKSSHJe7nqcVfro8o QH6MVG9hnq079/rE3krKGwRxvDg4PBPmHSslLVjmGCSP0=
Received: by (Wildcat! SMTP Router v7.0.454.6) for; Sat, 26 Aug 2017 14:23:02 -0400
Authentication-Results:; dkim=pass header.s=tms1; adsp=pass policy=all;
Received: from ([]) by (Wildcat! SMTP v7.0.454.6) with ESMTP id 3835628071.75665.1700; Sat, 26 Aug 2017 14:23:01 -0400
DKIM-Signature: v=1;; s=tms1; a=rsa-sha256; c=simple/relaxed; l=1443; t=1503771726; h=Received:Received: Message-ID:Date:From:Organization:To:Subject:List-ID; bh=KBc/CPK HyazLvzsKTof+c6M8qpNr+rSC0Igjs41UjZU=; b=cOJy9Jyh0HPVV+IIENwZE7M QCZCKhCXeuwY/M2lvSf8jGcEGJtw7ao1TYqGkjHCmUXWtGYVrBFVziAYwQ/r7ZYu nuGzwaquCzYVuYnvO5ny3Oi508DkjU89xfzYA78s2HlVctwaThCWTiVRw3zhGnqa xs89lxxun+aX2UcxZ6Kg=
Received: by (Wildcat! SMTP Router v7.0.454.6) for; Sat, 26 Aug 2017 14:22:06 -0400
Received: from [] ([]) by (Wildcat! SMTP v7.0.454.6) with ESMTP id 719606296.9.22788; Sat, 26 Aug 2017 14:22:05 -0400
Message-ID: <>
Date: Sat, 26 Aug 2017 14:23:06 -0400
From: Hector Santos <>
Organization: Santronics Software, Inc.
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.8.1
MIME-Version: 1.0
References: <> <>
In-Reply-To: <>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: <>
Subject: Re: [DNSOP] RFC2317 Question: Resolving cname delegation
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 26 Aug 2017 18:23:11 -0000

On 8/24/2017 1:31 PM, Grant Taylor wrote:

>> Before I release my updates, I wonder if this was the right thing to
>> do.
> I prefer to use a different method to do classless
> delegation.
> Specifically, I ask ISPs to put an NS record for the IP(s) in question
> pointing to my own DNS server.  Then I configure zone(s) that match
> the full name with the PTR in the zone apex.
> You can have a separate zone ( for each IP
> (a.b.c.d) -or- you can have a single parent zone (
> with individual PTR records, much like the ISP normally does.
> If you do the second method (parent zone) I'd
> recommend that you have NS records for the other 224 IPs that point to
> your ISP's name server that is authoritative for the zone.
> In effect, you are actually delegating the IPs an additional level.

This was done, at least the first part of providing the ISP the two NS 
servers required.  They used RFC2317 to setup the cname delegation. 
On my servers, I had done what you suggestion with the second method 
using a parent zone.   It all seems to work, except 
for the unexpected cname+ptr records with non-authoritive results.

Still studying the impact.  I was trying to prevent some consistency 
in the results in the resolver.  In the same way, that its done for 
A->CNAME->A results.