Subject: wildcards & cnames revisited

From: bert hubert <[email-masked]>
Date: Wed, 19 Jun 2002 14:50:57 +0200

Mark Andrews recently stated in the wildcards & cnames discussion:

	There is atleast one implementation where the match is not
	made so this is not a academic issue.  The same zone produces
	different results in different implementations.

Well, we are that implementation. Wildcard CNAMEs do not work in PowerDNS.
The main reason we haven't bothered is this earlier statement by Mark in
comp.protocols.dns.bind <[email-masked]>:

	By *strict* interpretation you can have caching servers return
	*different* answers depending upon whether there was or was not
	a previous query for a CNAME record that matched the wildcard
	record.

	This is *bad* and really requires protocol work to clarify the
	situation.

Adding support for wildcard CNAMEs entails an additional (possibly database)
lookup, which combined with the doubts voiced above have led us to not
support wildcard CNAMEs so far.

We're interested in the thoughts here on the actual risks of using wildcard
CNAMEs - would anybody ever notice? If the risk, unlike the current
non-portability of wildcard CNAMEs, is academic, then we will fall in line,
but make a 'no-wildcard-cnames' switch for performance sensitive customers.

Regards,

bert hubert
PowerDNS

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://www.tk                              the dot in .tk
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Thu, 20 Jun 2002 15:36:53 +1000

> but make a 'no-wildcard-cnames' switch for performance sensitive customers.

	The risk is in *not* matching against the wildcard CNAME.

	Take:
		*.example.com. CNAME foo.example.net.
		foo.example.net A 10.0.0.1

	No Match:
	Cache1 asks for lll.example.com/CNAME then lll.example.com/A

		lll.example.com	CNAME foo.example.net
		foo.example.net A 10.0.0.1

	Cache2 asks for just lll.example.com/A

		NODATA lll.example.com/A

	Different answers dependent on the query history.  This bad.
	
	Match:
	Cache3 asks for just lll.example.com/A 
	
		lll.example.com CNAME foo.example.net
		foo.example.net A 10.0.0.1

	Mark

--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]