topic Re: Is there a workaround to the DNS option 'multiple-cnames'? in Operating System - Linux

Is there a workaround to the DNS option 'multiple-cnames'?

viseth — Thu, 22 Dec 2005 11:29:17 GMT

Hi all,

I've be chasing the internet for a workaround regarding 'multiple-cnames' no more being "supporte" by BIND 9.2x (actually multiple-cnames has never been DNS compliant as stated in the RFC 1034 - but RFC 1034 has been loosen up to meet RFC 2181 for DNSSEC... ).

My customer is using BIND 8.x thus the option 'multiple-cnames' can still be used. But we are migrating towards BIND 9.2.3 which does not support that option any more thus leading to failed zones transferts...

How can I get things working... I can change the CNAME to A RRs but I not quite sure if it is the best solution. Can anyone help me out!

Many thanks and by the way happy Xmas!

Regards,

\Viseth

Re: Is there a workaround to the DNS option 'multiple-cnames'?

Ivan Ferreira — Thu, 22 Dec 2005 13:01:12 GMT

You can safely change CNAME to A records. Anyway, when you use CNAME, the CNAME is resolved to another name, and then the another name to the A record. So, you could even reduce que number of queries by specifying directly an A record instead of CNAME.

Happy Xmas for you also!

Re: Is there a workaround to the DNS option 'multiple-cnames'?

Geoff Wild — Thu, 22 Dec 2005 16:47:37 GMT

I need to understand more what the client wants.

Yes 'multiple-cnames' is no longer an option - but what are they trying to do with cnames?

Are they trying to point say blue to the a records of hosta and hostb?

Are they trying "poor mans" round robin?

You can create an A record for blue twice - pointing to the ip address of hosta and hostb.

Not a good thing to do really:

By being A records - there is no true round robin - only hit and missâ ¦..

Example - if say hosta is downâ ¦and a server does a ping to blue - there is a 50% chance that it will resolve to hosta - and if it does - it will fail - 100% packet loss...

The correct way to do round robin for example email - is to create MX recordsâ ¦

blue.cliendomain.net. 3600 IN MX 10 hosta.cliendomain.net.
smtpcal1.pcacorp.net. 3600 IN MX 10 hostb.cliendomain.net.

Rgds...Geoff

Re: Is there a workaround to the DNS option 'multiple-cnames'?

viseth — Fri, 23 Dec 2005 03:59:24 GMT

Hi Geoff!

First, thanks for your answer. But can you explain how you can do round-robin with your MX example?

I agree with you that it can fail if we set this configuration:

Replace faulty configuration using multiple-cnames:
foo1.bar.baz. 60 IN A 192.168.1.1
foo2.bar.baz. 60 IN A 192.168.1.2
foo3.bar.baz. 60 IN A 192.168.1.3
foo.bar.baz. 60 IN CNAME foo1.bar.baz.
foo.bar.baz. 60 IN CNAME foo2.bar.baz.
foo.bar.baz. 60 IN CNAME foo3.bar.baz.

by that one:

foo1.bar.baz. 60 IN A 192.168.1.1
foo2.bar.baz. 60 IN A 192.168.1.2
foo3.bar.baz. 60 IN A 192.168.1.3
foo.bar.baz. 60 IN A 192.168.1.1
foo.bar.baz. 60 IN A 192.168.1.2
foo.bar.baz. 60 IN A 192.168.1.3

I think true round-robin will occur. Maybe it is better to set the TTL to 0 (no caching)?

Regards,

\Viseth

Re: Is there a workaround to the DNS option 'multiple-cnames'?

Geoff Wild — Fri, 23 Dec 2005 08:57:15 GMT

Sure - by setting the MX value the same on both servers (10 in my case) - when another server wants to send me mail - it looks up the MX record - chooses the lowest route - in this case - both are the same - so it just picks one - and sends the email.

Benefit is - if hosta is busy (or down) then the mail goes directly to hostb.

How to add with nsupdate:

# nsupdate
> update add blue.cliendomain.net. 3600 IN MX 10 hosta.cliendomain.net.
> update add blue.cliendomain.net. 3600 IN MX 10 hostb.cliendomain.net.
>

Even with a TTL of 0 in your last post - you still risk if hosta is down or doesn't respond - it will not go to hostb...

Rgds...Geoff

Re: Is there a workaround to the DNS option 'multiple-cnames'?

Ivan Ferreira — Fri, 23 Dec 2005 09:13:15 GMT

Remember that nsupdate is only for Dynamic DNS.

Now, what do you really want to do? You can get a better load balancing system by using LVS.

Re: Is there a workaround to the DNS option 'multiple-cnames'?

viseth — Mon, 02 Jan 2006 09:01:35 GMT

Hello Everyone!
Happy new year 2006! May the success be round the corner! Hope that everyone has spent a good time at Xmas'eve and new year's eve!

Well, back to work! Does someone kown about a workaround of the DNS option 'multiple-cnames'. My customer is using that option to avoid DNS reply in round-robin fashion. By using multiple CNAMES, the answer sent from the DNS server is the same during the TTL time attached to the CNAME records thus no real round-robin, if you see what I mean.

Many thanks for your reply!

regards,

\Viseth

Re: Is there a workaround to the DNS option 'multiple-cnames'?

Bill Thorsteinson — Wed, 04 Jan 2006 12:28:13 GMT

Bind will rotate the order on each request.
Try querying one of the authorative servers.
Downstream servers may not rotate the IP
address.
Bind9 allows you to sey cyclic or random
ordering.
Non-rotation is likely a problem with one or
more intermediate DNS servers.