[lamps] DNS DNAME pain.

[Phillip Hallam-Baker <[e-mail]>]

I am trying to work out whether the restrictions in RFC6672 make use
of prefix records impossible.

Specifically, a DNAME is not allowed to have any records below it and
worse, section 2.4 states:

   "A server MAY refuse to load a zone that has data at a
   subdomain of a domain name owning a DNAME RR.  If the server does
   load the zone, those names below the DNAME RR will be occluded as
   described in RFC 2136 [RFC2136], Section 7.18."

This is called making things hard.

DNAME was originally developed to help manage reverse DNS during IP
address space renumbering, a problem we solved by abandoning the
reverse DNS. It is really not suited for the task it is used for (as
we have discovered when trying to use it for forward DNS,


What this means is that we can't have RRs like the following:

example.net DNAME example.com
_prefix.example.net CAA foo

It is not clear to me how the following is required to be interpreted:

example.net DNAME example.com
example.net CAA foo


The situation is of course very different depending on what forms of
DNS zone validation are performed in deployed systems and indeed
whether the restrictions on DNAME mean that it is either not used at
all or if the existing uses already violate parts of RFC6672.

It might well be that the way to solve the DNAME problem is to specify
a new zone mapping record that does the job in a way that meets DNS
admins needs. That is currently a possibility because use of DNSSEC is
mostly limited to signing. The only folk verifying are folk who either
really know what they are doing or whose systems are always breaking
anyway. That window is likely to close at some point.