Login/Register
How to overcome root domain CNAME restrictions?
Asked Answered
Solved networkingdnsrfccname
P

10

128

We are hosting many web applications for our customers. As is obvious they want to use their own domains to refer to those applications, usually they want that any user that either type http://www.customer1.example or http://customer1.example goes to their web application.

The situation we are facing is that we need to have the flexibility to change IP addresses in the near future. And we don't want to rely on the customer doing the A record change on their domains. So we thought that using CNAME records will work, but as we find out CNAME records will not work for the root domain.

Basically:

customer1.example IN CNAME customer1.mycompanydomain.example //this is invalid as the RFC
www.customer1.example IN CNAME customer1.mycompanydomain.example //this is valid and will work

We want to be able to change the IP address of customer1.mycompanydomain.example or the A record and our customers will follow this record which we have control over.

in our DNS it will look like:

customer1.mycompanydomain.example IN A 192.0.2.1

Any ideas?

Pander answered 17/3, 2009 at 21:5 Comment(8)
I do not understand why "customer1.com IN CNAME customer1.mycompanydomain.com" is invalid. I believe it should work. Could you explain where the problem with that solution was? – Gaillardia
Yes, please read the following question and answer. It is invalid as per the DNS RFC. #655735 – Pander
and this is yet another reason why (IMHO) it is wrong to expect a domain name without the 'www.' prefix to work... – Gallo
I do not understand the title of the question. Where is the "root" (.) involved? – Recount
he means the root of a zone, not "the root" – Gallo
Well, it is not usual DNS vocabulary, then. Isn't "apex" the proper word? Or "top-level" for Lisp programmers? :-) – Recount
dupe of #655735 ? – Paraclete
something to add to this: I did this for a site I admin while I was at uni, the university network's DNS refused to resolve the domain as it violated the spec. I would avoid trying to do this as you may cut off some of your users :) – Sewell
P
-9

Thanks to both sipwiz and MrEvil. We developed a PHP script that will parse the URL that the user enters and paste www to the top of it. (e.g. if the customer enters kiragiannis.com, then it will redirect to www.kiragiannis.com). So our customer point their root (e.g. customer1.com to A record where our web redirector is) and then www CNAME to the real A record managed by us.

Below the code in case you are interested for future us.

<?php
$url = strtolower($_SERVER["HTTP_HOST"]);

if(strpos($url, "//") !== false) { // remove http://
  $url = substr($url, strpos($url, "//") + 2);
}

$urlPagePath = "";
if(strpos($url, "/") !== false) { // store post-domain page path to append later
  $urlPagePath = substr($url, strpos($url, "/"));
  $url = substr($url, 0, strpos($url,"/"));
}


$urlLast = substr($url, strrpos($url, "."));
$url = substr($url, 0, strrpos($url, "."));


if(strpos($url, ".") !== false) { // get rid of subdomain(s)
  $url = substr($url, strrpos($url, ".") + 1);
}


$url = "http://www." . $url . $urlLast . $urlPagePath;

header( "Location:{$url}");
?>
Pander answered 17/3, 2009 at 21:5 Comment(4)
This does not actually answer the question that 69k+ people have come to this thread looking for. The question is more about DNS and has nothing to do with PHP. – Vercelli
The question was about DNS. Not about PHP coding. – Baby
HTTP_HOST is the hostname, like its name implies, not an URL. Hence there won't be any http:// to remove, nor / ($urlPagePath will always be empty). Cf httpd.apache.org/docs/2.4/expr.html. Due to the way the code tries to get rid of subdomain, it will also not work for things like www.example.co.uk where co.uk has to be considered as a whole. It also does not handle HTTPS. And finally using PHP just do a an HTTP redirection where any webserver can do it in configuration, is overcomplicated. So in short this certainly should not be the validated answer for this question. – Manisa
If this rule should apply to all hosts then it should be done as a apache config – Bensky
A
69

The reason this question still often arises is because, as you mentioned, somewhere somehow someone presumed as important wrote that the RFC states domain names without subdomain in front of them are not valid. If you read the RFC carefully, however, you'll find that this is not exactly what it says. In fact, RFC 1912 states:

Don't go overboard with CNAMEs. Use them when renaming hosts, but plan to get rid of them (and inform your users).

Some DNS hosts provide a way to get CNAME-like functionality at the zone apex (the root domain level, for the naked domain name) using a custom record type. Such records include, for example:

  • ALIAS at DNSimple
  • ANAME at DNS Made Easy
  • ANAME at easyDNS
  • CNAME at CloudFlare

For each provider, the setup is similar: point the ALIAS or ANAME entry for your apex domain to example.domain.com, just as you would with a CNAME record. Depending on the DNS provider, an empty or @ Name value identifies the zone apex.

ALIAS or ANAME or @ example.domain.com.

If your DNS provider does not support such a record-type, and you are unable to switch to one that does, you will need to use subdomain redirection, which is not that hard, depending on the protocol or server software that needs to do it.

I strongly disagree with the statement that it's done only by "amateur admins" or such ideas. It's a simple "What does the name and its service need to do?" deal, and then to adapt your DNS config to serve those wishes; If your main services are web and e-mail, I don' t see any VALID reason why dropping the CNAMEs for-good would be problematic. After all, who would prefer @subdomain.domain.org over @domain.org ? Who needs "www" if you're already set with the protocol itself? It's illogical to assume that use of a root-domainname would be invalid.

Adamec answered 26/3, 2014 at 11:41 Comment(3)
This particular answer was very helpful to me since I wanted to point a root level domain at a CDN. Most CDNs are by necessity an FQDN, since it could resolve to different IPs at different locations or times. I use DNS Made Easy and was able to use the ANAME record type. – Deemster
I couldn't agree more. Wanting to host a site from the 'naked' domain name is a common and logical thing to do. It uses less characters, it looks better etc. The url's own protocol identifier (www) is a vestigial part of the url if was even necessary in the first place (it wasn't). – Bialystok
ANAME's are nice, or you can just 301 all non-www to www. via free 301 redirection service 198.251.86.133 – Chemisorb
T
57

CNAME'ing a root record is technically not against RFC, but does have limitations meaning it is a practice that is not recommended.

Normally your root record will have multiple entries. Say, 3 for your name servers and then one for an IP address.

Per RFC:

If a CNAME RR is present at a node, no other data should be present;

And Per IETF 'Common DNS Operational and Configuration Errors' Document:

This is often attempted by inexperienced administrators as an obvious way to allow your domain name to also be a host. However, DNS servers like BIND will see the CNAME and refuse to add any other resources for that name. Since no other records are allowed to coexist with a CNAME, the NS entries are ignored. Therefore all the hosts in the podunk.xx domain are ignored as well!

References:

Tolyl answered 16/4, 2009 at 20:43 Comment(5)
But WHY are there no other record allowed to coexist with a CNAME. Is this just a limitation added by the author of the RFC or is there a technical reason for it? If there is no technical reason for it, then one could easily come up with an extension RFC. – Schutz
So, if it works for me (use CNAME for the root record, other subdomains for that domain still working), that means I'm just lucky and my providers DNS implementation doesn't ignore that additional records altought it could? And it also means I don't need to fear any issues on client side, as long as the DNS server handles it like this? – Kristlekristo
This is an attempt to answer another question, "why are CNAMEs not allowed at apex", whereas the actual question is "how to overcome this limitation". -1. – Ulric
For the why see serverfault.com/questions/613829/… – Audre
CNAME'ing a root record is technically not against RFC you will need to explain how it is not against RFC1034 section 3.6.2: If a CNAME RR is present at a node, no other data should be present; this ensures that the data for a canonical name and its aliases cannot be different.. Of course the "root" (that is the apex precisely in this context) has already NS and SOA records and hence can not have CNAME records. – Manisa
V
4

I don't know how they are getting away with it, or what negative side effects their may be, but I'm using Hover.com to host some of my domains, and recently setup the apex of my domain as a CNAME there. Their DNS editing tool did not complain at all, and my domain happily resolves via the CNAME assigned.

Here is what Dig shows me for this domain (actual domain obfuscated as mydomain.com):

; <<>> DiG 9.8.3-P1 <<>> mydomain.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2056
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;mydomain.com.          IN  A

;; ANSWER SECTION:
mydomain.com.       394 IN  CNAME   myapp.parseapp.com.
myapp.parseapp.com. 300 IN  CNAME   parseapp.com.
parseapp.com.       60  IN  A   54.243.93.102
Vanderhoek answered 13/2, 2014 at 8:25 Comment(1)
Obfuscation, if really needed (the DNS is public....), should use RFC2606 guidance. And RFC5737 or 3849 for IP addresses – Manisa
S
3

My company does the same thing for a number of customers where we host a web site for them although in our case it's xyz.company.com rather than www.company.com. We do get them to set the A record on xyz.company.com to point to an IP address we allocate them.

As to how you could cope with a change in IP address I don't think there is a perfect solution. Some ideas are:

  • Use a NAT or IP load balancer and give your customers an IP address belonging to it. If the IP address of the web server needs to change you could make an update on the NAT or load balancer,

  • Offer a DNS hosting service as well and get your customers to host their domain with you so that you'd be in a position to update the A records,

  • Get your customers to set their A record up to one main web server and use a HTTP redirect for each customer's web requests.

Supramolecular answered 18/3, 2009 at 3:27 Comment(0)
B
3

Sipwiz is correct the only way to do this properly is the HTTP and DNS hybrid approach. My registrar is a re-seller for Tucows and they offer root domain forwarding as a free value added service.

If your domain is blah.com they will ask you where you would like the domain forwarded to, and you type in www.blah.com. They assign the A record to their apache server and automaticly add blah.com as a DNS vhost. The vhost responds with an HTTP 302 error redirecting them to the proper URL. It's simple to script/setup and can be handled by low end would otherwise be scrapped hardware.

Run the following command for an example: curl -v eclecticengineers.com

Borodin answered 18/3, 2009 at 4:43 Comment(0)
M
3

You have to put a period at the end of the external domain so it doesn't think you mean customer1.mycompanydomain.com.localdomain;

So just change:

customer1.com IN CNAME customer1.mycompanydomain.com

To

customer1.com IN CNAME customer1.mycompanydomain.com.
Methodius answered 23/2, 2014 at 17:30 Comment(1)
For me (BIND 9.8.2), if the records are for domain customer1.com, this works...but is interpreted as specifying CNAMe for a subdomain customer1.com.customer1.com. If I add a point to the first item, the record will be interpreted correctly, but it does not work anymore. I see no solution here. – Magpie
F
1

One solution is to create CNAME for www subdomain, then forward the root domain to your www subdomain. First step is done in DNS setting, and the second step is done in Forward Domain section.

Reference: https://www.tachyonstemplates.com/2018/google-domains-forward-root/.

Favouritism answered 31/12, 2021 at 6:24 Comment(0)
A
0

  • If your domain register supports ANAME, then you can redirect your root domain using ANAME record.

  • if NO, but it supports forwarding DNS, such as Google Domain, then you can

  1. add a CNAME record to redirect http://www.customer1.example to the domain name you want.
  2. in forward DNS setting, set http://customer1.example to url: http://www.customer1.example,

Then it's done. Usually you may need to wait for a few minutes for it take effect

Already answered 14/10, 2022 at 1:31 Comment(0)
C
-2

I see readytocloud.com is hosted on Apache 2.2.

There is a much simpler and more efficient way to redirect the non-www site to the www site in Apache.

Add the following rewrite rules to the Apache configs (either inside the virtual host or outside. It doesn't matter):

RewriteCond %{HTTP_HOST} ^readytocloud.com [NC]
RewriteRule ^/$ http://www.readytocloud.com/ [R=301,L]

Or, the following rewrite rules if you want a 1-to-1 mapping of URLs from the non-www site to the www site:

RewriteCond %{HTTP_HOST} ^readytocloud.com [NC]
RewriteRule (.*) http://www.readytocloud.com$1 [R=301,L]

Note, the mod_rewrite module needs to be loaded for this to work. Luckily readytocloud.com is runing on a CentOS box, which by default loads mod_rewrite.

We have a client server running Apache 2.2 with just under 3,000 domains and nearly 4,000 redirects, however, the load on the server hover around 0.10 - 0.20.

Cachet answered 17/6, 2009 at 21:23 Comment(1)
The question was about DNS. Not about Apache web-server. – Baby
P
-9

Thanks to both sipwiz and MrEvil. We developed a PHP script that will parse the URL that the user enters and paste www to the top of it. (e.g. if the customer enters kiragiannis.com, then it will redirect to www.kiragiannis.com). So our customer point their root (e.g. customer1.com to A record where our web redirector is) and then www CNAME to the real A record managed by us.

Below the code in case you are interested for future us.

<?php
$url = strtolower($_SERVER["HTTP_HOST"]);

if(strpos($url, "//") !== false) { // remove http://
  $url = substr($url, strpos($url, "//") + 2);
}

$urlPagePath = "";
if(strpos($url, "/") !== false) { // store post-domain page path to append later
  $urlPagePath = substr($url, strpos($url, "/"));
  $url = substr($url, 0, strpos($url,"/"));
}


$urlLast = substr($url, strrpos($url, "."));
$url = substr($url, 0, strrpos($url, "."));


if(strpos($url, ".") !== false) { // get rid of subdomain(s)
  $url = substr($url, strrpos($url, ".") + 1);
}


$url = "http://www." . $url . $urlLast . $urlPagePath;

header( "Location:{$url}");
?>
Pander answered 17/3, 2009 at 21:5 Comment(4)
This does not actually answer the question that 69k+ people have come to this thread looking for. The question is more about DNS and has nothing to do with PHP. – Vercelli
The question was about DNS. Not about PHP coding. – Baby
HTTP_HOST is the hostname, like its name implies, not an URL. Hence there won't be any http:// to remove, nor / ($urlPagePath will always be empty). Cf httpd.apache.org/docs/2.4/expr.html. Due to the way the code tries to get rid of subdomain, it will also not work for things like www.example.co.uk where co.uk has to be considered as a whole. It also does not handle HTTPS. And finally using PHP just do a an HTTP redirection where any webserver can do it in configuration, is overcomplicated. So in short this certainly should not be the validated answer for this question. – Manisa
If this rule should apply to all hosts then it should be done as a apache config – Bensky

© 2022 - 2024 — McMap. All rights reserved.