3 ms·

Not this again. Why does this get dug up repeatedly? I've seen this show up off and on every year for the past 10 years. It doesn't work everywhere, it's not e

by smosher 15y ago

Not this again. Why does this get dug up repeatedly? I've seen this show up off and on every year for the past 10 years. It doesn't work everywhere, it's not expected to work robustly anywhere, even if your server supports it not all clients will and there's just no need to do it. No matter how many out of date RFCs you quote. This hasn't changed in the past 10 years!

rwg 15y ago
Specifically, it doesn't work with Comcast's DNSSEC-enabled recursive nameservers, which Comcast will eventually move all of its customers to: % dig +noall +comments +stats pzxc.com. ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 14316 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; Query time: 161 msec ;; SERVER: 75.75.75.75#53(75.75.75.75) ;; WHEN: Sat May 28 02:38:43 2011 ;; MSG SIZE rcvd: 26 joyeur.com, Joyent's blog, has the same problem: % dig +noall +comments +stats joyeur.com. ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 57255 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; Query time: 133 msec ;; SERVER: 75.75.75.75#53(75.75.75.75) ;; WHEN: Sat May 28 02:40:38 2011 ;; MSG SIZE rcvd: 28 Both pzxc.com and joyeur.com have CNAME records. So, yeah, using CNAMEs on your domains works great, except for all those times it doesn't work at all, like with the largest residential ISP in the United States.