5 ms·
I would be interested to know why the RFC 1035 forbids using IP addresses in MX records. What was the original concern with doing this?
by cadence- 6y ago
I would be interested to know why the RFC 1035 forbids using IP addresses in MX records. What was the original concern with doing this?
- geocrasher 6y agoDNS standards tend to favor using aliases rather than IP's. My observation is that the overall goal is to have the IP listed as few times as possible. Otherwise there'd be no need for CNAME's in general, and everything would be an A record or an IP. But, MX records are supposed to refer to an A record not an IP. The author is correct- if somebody is doing this, they're simply doing it wrong. Standards exist so that we can say "This configuration is wrong" instead of "Lets complicate software to allow people to use any configuration they want."
- mlyle 6y ago> But, MX records are supposed to refer to a CNAME not an IP. To be clear, MX records are supposed to point to an A record. Pointing to a CNAME record is not legal.
- DaiPlusPlus 6y agoWhat if it's an AAAA record?
- stonesweep 6y agoIn my travels there's a significant portion of the internet which is not IPv6 capable; for example the World Community Grid failed for me when trying to use pure IPv6, and they send emails about things. I'd currently not risk using an IPv6 record for my MX, I suspect a high failure rate delivering email from every service on the planet will follow.
- deleted 6y ago[deleted]
- s800 6y ago> set qu=mx > gmail.com. Server: 10.1.1.1 Address: 10.1.1.1#53 Non-authoritative answer: gmail.com mail exchanger = 20 alt2.gmail-smtp-in.l.google.com. gmail.com mail exchanger = 5 gmail-smtp-in.l.google.com. gmail.com mail exchanger = 40 alt4.gmail-smtp-in.l.google.com. gmail.com mail exchanger = 10 alt1.gmail-smtp-in.l.google.com. gmail.com mail exchanger = 30 alt3.gmail-smtp-in.l.google.com. Authoritative answers can be found from: > set qu=aaaa > gmail-smtp-in.l.google.com. Server: 10.1.1.1 Address: 10.1.1.1#53 Non-authoritative answer: gmail-smtp-in.l.google.com has AAAA address 2607:f8b0:4001:c05::1a
- mlyle 6y agoSure, but it has A records too.
- stonesweep 6y agoI wake up and see the HackerNews downvote train has hit myself and you, when what you said is 100% correct; gmail-smtp-in.l.google.com is both IPv4 and IPv6. The network I'm on right now (VPN to work) cannot service IPv6 and I cannot connect to the IPv6 IP for that MX host, but I can easily connect to the IPv4 endpoint.
- jeffbee 6y agoRFC 5321 is ambivalent of A vs. AAAA. When discussing the matter, 5321 says "A or AAAA RR". It later says about IPv6 that "The appropriate actions to be taken either will depend on local circumstances." When I re-wrote Gmail's DNS libraries about 6 years ago, I wrote it to start with AAAA and fall back to A. So if you have an MX and AAAA records for those names, you should notice all your inbound from Google comes via IPv6.
- gog 6y agoI've noticed that! I believe Postfix also delivers to IPv6 if possible.
- geocrasher 6y agoI fixed it, that was a brain fart.
- quotemstr 6y agoPointing to a CNAME isn't legal, but it should be. This particular limitation never made any sense to me and it should be lifted.
- vetinari 6y agoThat would require updating too much software in the field. Meanwhile you can use ALIAS record and get the same result, without others noticing.
- fred256 6y agoSorry to be pedantic, but there is no such thing as an ALIAS record. It's just the DNS server doing the indirection for you.
- teddyh 6y agoThere is no such thing as an ALIAS record. That’s something your DNS provider made up and shows to you in the interface, but behind the scenes they are providing the same old AAAA and A records as always, along with some sort of auto-updating feature which they will run to detect changes in the address of the name in the “ALIAS record”. How often this will update is anyone’s guess as it’s up to the DNS provider. See: https://en.wikipedia.org/wiki/CNAME_record#ANAME_record https://en.wikipedia.org/wiki/CNAME_record#ANAME_record
- MayeulC 6y agoIt might not be legal, but works quite well for me. Having a dynamic IPv4 address with multiple domains on it, updating every record would take more time. Admittedly, I could also have a copy of the IP per domain, but the CNAME was easier to setup.
- jcims 6y agoI can see the value in pointing at a name so TLS can validate correctly, but I don't see any value in limiting it to an A record.
- deleted 6y ago[deleted]
- chrismorgan 6y agoIf it’s an IP address, you’re restricting it to IPv4 or IPv6. If it’s a name, then it can work on both IPv4 and IPv6. You want pretty much everything but A and AAAA records to use domain names for pointing, so that they’re not tied to a particular version of IP. Keep the IP resolution to the last step only, and let everything else use domain names.
- jpalomaki 6y agoLooks like this goes back to the days when Internet with TCP/IP was not yet the only option and when there was also other networks available (Chaosnet). [1] For the A records you can different classes of addresses. Nowadays we are using the "IN", but the spec also supports others like "CH" (Chaos) and "HS" (Hesiod).[2] MX record points to mail.example.org (A-record). mail.example.org could then point to two different addresses in the different networks, using the different classes. Depending on what network the client is connected to, it can request specify the class in the query and get address on the correct network. I guess they could have baked this in to the MX records as well, but that would have made it more complicated. Disclaimer: Just googled this up. [1] https://serverfault.com/questions/663112/why-cant-mx-records-point-to-an-ip-address https://serverfault.com/questions/663112/why-cant-mx-records... [2] https://serverfault.com/questions/220775/what-does-the-in-mean-in-a-zone-file/220787 https://serverfault.com/questions/220775/what-does-the-in-me...
- Natsu 6y agoI guess nowadays that should still be useful to give both an IPv4 and IPv6 address for the mail server?
- deleted 6y ago[deleted]
- aussiegeek 6y agoYep, just have A and AAAA records for the hostname the MX points to
- herpderperator 6y agoWhy? You can just make mail.example.com resolve to two IPs: an IPv4 and IPv6 address. Nothing wrong with that.
- remram 6y agoIsn't that what Natsu said?
- gorgoiler 6y agoSo you can have multiple address for the same MX, eg IN A 10.77.0.1 and IN AAAA fd77::1.
- teddyh 6y agoThe RFC doesn’t “forbid” using IP addresses in MX records – it’s physically impossible to have them. The fact that the IPv4 address syntax is also parseable as a domain name is unrelated; what is physically stored inside the MX record is a textual domain name.
- wiml 6y agoThe RFC is pretty readable, but the tldr is that DNS is more strongly typed than that. It's not just a string-lookup service. There's a wire format for names, which some records carry; there are wire formats for v4 and v6 addresses, which other records carry, but in no situation do the strings "foo.example.com" or "10.1.0.1" actually go over the network when doing a DNS resolution.
- teddyh 6y agoNitpick: Statically typed, not strongly typed.