How to overcome root domain CNAME restrictions?

Question

We are hosting many web applications for our customers. As is obvious they want to use their own domains to refer to those applications, usually they want that any user that either type http://www.customer1.example or http://customer1.example goes to their web application.

The situation we are facing is that we need to have the flexibility to change IP addresses in the near future. And we don't want to rely on the customer doing the A record change on their domains. So we thought that using CNAME records will work, but as we find out CNAME records will not work for the root domain.

Basically:

customer1.example IN CNAME customer1.mycompanydomain.example //this is invalid as the RFC
www.customer1.example IN CNAME customer1.mycompanydomain.example //this is valid and will work

We want to be able to change the IP address of customer1.mycompanydomain.example or the A record and our customers will follow this record which we have control over.

in our DNS it will look like:

customer1.mycompanydomain.example IN A 192.0.2.1

Any ideas?

I do not understand why "customer1.com IN CNAME customer1.mycompanydomain.com" is invalid. I believe it should work. Could you explain where the problem with that solution was? — sleske, Mar 17 '09 at 21:34
Yes, please read the following question and answer. It is invalid as per the DNS RFC. http://stackoverflow.com/questions/655235/is-root-domain-cname-to-other-domain-allowed-by-dns-rfc — Geo, Mar 17 '09 at 21:53
and this is yet another reason why (IMHO) it is wrong to expect a domain name without the 'www.' prefix to work... — Alnitak, Mar 17 '09 at 22:46
I do not understand the title of the question. Where is the "root" (.) involved? — bortzmeyer, Mar 18 '09 at 07:50
Well, it is not usual DNS vocabulary, then. Isn't "apex" the proper word? Or "top-level" for Lisp programmers? :-) — bortzmeyer, Mar 19 '09 at 13:56
dupe of http://stackoverflow.com/questions/655235/is-root-domain-cname-to-other-domain-allowed-by-dns-rfc ? — Ryan Fernandes, Aug 07 '09 at 08:11
something to add to this: I did this for a site I admin while I was at uni, the university network's DNS refused to resolve the domain as it violated the spec. I would avoid trying to do this as you may cut off some of your users :) — wjdp, Oct 11 '14 at 19:34

score 66 · Answer 1 · edited Dec 19 '18 at 20:12

The reason this question still often arises is because, as you mentioned, somewhere somehow someone presumed as important wrote that the RFC states domain names without subdomain in front of them are not valid. If you read the RFC carefully, however, you'll find that this is not exactly what it says. In fact, RFC 1912 states:

Don't go overboard with CNAMEs. Use them when renaming hosts, but plan to get rid of them (and inform your users).

Some DNS hosts provide a way to get CNAME-like functionality at the zone apex (the root domain level, for the naked domain name) using a custom record type. Such records include, for example:

ALIAS at DNSimple
ANAME at DNS Made Easy
ANAME at easyDNS
CNAME at CloudFlare

For each provider, the setup is similar: point the ALIAS or ANAME entry for your apex domain to example.domain.com, just as you would with a CNAME record. Depending on the DNS provider, an empty or @ Name value identifies the zone apex.

ALIAS or ANAME or @ example.domain.com.

If your DNS provider does not support such a record-type, and you are unable to switch to one that does, you will need to use subdomain redirection, which is not that hard, depending on the protocol or server software that needs to do it.

I strongly disagree with the statement that it's done only by "amateur admins" or such ideas. It's a simple "What does the name and its service need to do?" deal, and then to adapt your DNS config to serve those wishes; If your main services are web and e-mail, I don' t see any VALID reason why dropping the CNAMEs for-good would be problematic. After all, who would prefer @subdomain.domain.org over @domain.org ? Who needs "www" if you're already set with the protocol itself? It's illogical to assume that use of a root-domainname would be invalid.

This particular answer was very helpful to me since I wanted to point a root level domain at a CDN. Most CDNs are by necessity an FQDN, since it could resolve to different IPs at different locations or times. I use DNS Made Easy and was able to use the ANAME record type. — Rubix, Oct 01 '15 at 06:26
I couldn't agree more. Wanting to host a site from the 'naked' domain name is a common and logical thing to do. It uses less characters, it looks better etc. The url's own protocol identifier (www) is a vestigial part of the url if was even necessary in the first place (it wasn't). — Ed Bishop, May 19 '16 at 06:57
ANAME's are nice, or you can just 301 all non-www to www. via free 301 redirection service http://198.251.86.133 — Jacob Evans, Sep 22 '16 at 14:10

score 57 · Answer 2 · edited Oct 07 '21 at 05:46

57

CNAME'ing a root record is technically not against RFC, but does have limitations meaning it is a practice that is not recommended.

Normally your root record will have multiple entries. Say, 3 for your name servers and then one for an IP address.

Per RFC:

If a CNAME RR is present at a node, no other data should be present;

And Per IETF 'Common DNS Operational and Configuration Errors' Document:

This is often attempted by inexperienced administrators as an obvious way to allow your domain name to also be a host. However, DNS servers like BIND will see the CNAME and refuse to add any other resources for that name. Since no other records are allowed to coexist with a CNAME, the NS entries are ignored. Therefore all the hosts in the podunk.xx domain are ignored as well!

References:

https://www.rfc-editor.org/rfc/rfc1912 section '2.4 CNAME Records'
http://www.faqs.org/rfcs/rfc1034.html section '3.6.2. Aliases and canonical names'

edited Oct 07 '21 at 05:46

Community

1
1

answered Apr 16 '09 at 20:43

19

But WHY are there no other record allowed to coexist with a CNAME. Is this just a limitation added by the author of the RFC or is there a technical reason for it? If there is no technical reason for it, then one could easily come up with an extension RFC. – Sven Aug 23 '13 at 01:17
So, if it works for me (use CNAME for the root record, other subdomains for that domain still working), that means I'm just lucky and my providers DNS implementation doesn't ignore that additional records altought it could? And it also means I don't need to fear any issues on client side, as long as the DNS server handles it like this? – didi_X8 Mar 04 '14 at 14:49
This is an attempt to answer another question, "why are CNAMEs not allowed at apex", whereas the actual question is "how to overcome this limitation". -1. – rustyx Dec 03 '16 at 13:53
1

For the why see https://serverfault.com/questions/613829/why-cant-a-cname-record-be-used-at-the-apex-aka-root-of-a-domain#613830 – rhand Jul 03 '18 at 07:26
*CNAME'ing a root record is technically not against RFC* you will need to explain how it is not against RFC1034 section 3.6.2: *If a CNAME RR is present at a node, no other data should be present; this ensures that the data for a canonical name and its aliases cannot be different.*. Of course the "root" (that is the apex precisely in this context) has already `NS` and `SOA` records and hence can not have `CNAME` records. – Patrick Mevzek Aug 02 '18 at 23:18

score 4 · Answer 3 · answered Feb 13 '14 at 08:25

I don't know how they are getting away with it, or what negative side effects their may be, but I'm using Hover.com to host some of my domains, and recently setup the apex of my domain as a CNAME there. Their DNS editing tool did not complain at all, and my domain happily resolves via the CNAME assigned.

Here is what Dig shows me for this domain (actual domain obfuscated as mydomain.com):

; <<>> DiG 9.8.3-P1 <<>> mydomain.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2056
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;mydomain.com.          IN  A

;; ANSWER SECTION:
mydomain.com.       394 IN  CNAME   myapp.parseapp.com.
myapp.parseapp.com. 300 IN  CNAME   parseapp.com.
parseapp.com.       60  IN  A   54.243.93.102

Obfuscation, if really needed (the DNS is public....), should use RFC2606 guidance. And RFC5737 or 3849 for IP addresses — Patrick Mevzek, Aug 02 '18 at 23:33

score 3 · Answer 4 · answered Feb 23 '14 at 17:30

3

You have to put a period at the end of the external domain so it doesn't think you mean customer1.mycompanydomain.com.localdomain;

So just change:

customer1.com IN CNAME customer1.mycompanydomain.com

To

customer1.com IN CNAME customer1.mycompanydomain.com.

answered Feb 23 '14 at 17:30

Gwerks

47
1

For me (BIND 9.8.2), if the records are for domain `customer1.com`, this works...but is interpreted as specifying CNAMe for a subdomain `customer1.com.customer1.com`. If I add a point to the first item, the record will be interpreted correctly, but it does not work anymore. I see no solution here. – Jussi Hirvi Nov 20 '19 at 10:10

score 3 · Answer 5 · answered Mar 18 '09 at 03:27

My company does the same thing for a number of customers where we host a web site for them although in our case it's xyz.company.com rather than www.company.com. We do get them to set the A record on xyz.company.com to point to an IP address we allocate them.

As to how you could cope with a change in IP address I don't think there is a perfect solution. Some ideas are:

Use a NAT or IP load balancer and give your customers an IP address belonging to it. If the IP address of the web server needs to change you could make an update on the NAT or load balancer,
Offer a DNS hosting service as well and get your customers to host their domain with you so that you'd be in a position to update the A records,
Get your customers to set their A record up to one main web server and use a HTTP redirect for each customer's web requests.

score 3 · Answer 6 · answered Mar 18 '09 at 04:43

Sipwiz is correct the only way to do this properly is the HTTP and DNS hybrid approach. My registrar is a re-seller for Tucows and they offer root domain forwarding as a free value added service.

If your domain is blah.com they will ask you where you would like the domain forwarded to, and you type in www.blah.com. They assign the A record to their apache server and automaticly add blah.com as a DNS vhost. The vhost responds with an HTTP 302 error redirecting them to the proper URL. It's simple to script/setup and can be handled by low end would otherwise be scrapped hardware.

Run the following command for an example: curl -v eclecticengineers.com

score 1 · Answer 7 · answered Dec 31 '21 at 06:24

One solution is to create CNAME for www subdomain, then forward the root domain to your www subdomain. First step is done in DNS setting, and the second step is done in Forward Domain section.

Reference: https://www.tachyonstemplates.com/2018/google-domains-forward-root/.

score 0 · Answer 8 · answered Oct 14 '22 at 01:31

If your domain register supports ANAME, then you can redirect your root domain using ANAME record.
if NO, but it supports forwarding DNS, such as Google Domain, then you can

add a CNAME record to redirect http://www.customer1.example to the domain name you want.
in forward DNS setting, set http://customer1.example to url: http://www.customer1.example,

Then it's done. Usually you may need to wait for a few minutes for it take effect

score -2 · Answer 9 · edited Feb 06 '13 at 14:19

I see readytocloud.com is hosted on Apache 2.2.

There is a much simpler and more efficient way to redirect the non-www site to the www site in Apache.

Add the following rewrite rules to the Apache configs (either inside the virtual host or outside. It doesn't matter):

RewriteCond %{HTTP_HOST} ^readytocloud.com [NC]
RewriteRule ^/$ http://www.readytocloud.com/ [R=301,L]

Or, the following rewrite rules if you want a 1-to-1 mapping of URLs from the non-www site to the www site:

RewriteCond %{HTTP_HOST} ^readytocloud.com [NC]
RewriteRule (.*) http://www.readytocloud.com$1 [R=301,L]

Note, the mod_rewrite module needs to be loaded for this to work. Luckily readytocloud.com is runing on a CentOS box, which by default loads mod_rewrite.

We have a client server running Apache 2.2 with just under 3,000 domains and nearly 4,000 redirects, however, the load on the server hover around 0.10 - 0.20.

The question was about DNS. Not about Apache web-server. – SamTzu Apr 20 '18 at 08:29 — SamTzu, Apr 20 '18 at 08:29

score -8 · Accepted Answer · edited Feb 06 '13 at 14:18

-8

Thanks to both sipwiz and MrEvil. We developed a PHP script that will parse the URL that the user enters and paste www to the top of it. (e.g. if the customer enters kiragiannis.com, then it will redirect to www.kiragiannis.com). So our customer point their root (e.g. customer1.com to A record where our web redirector is) and then www CNAME to the real A record managed by us.

Below the code in case you are interested for future us.

<?php
$url = strtolower($_SERVER["HTTP_HOST"]);

if(strpos($url, "//") !== false) { // remove http://
  $url = substr($url, strpos($url, "//") + 2);
}

$urlPagePath = "";
if(strpos($url, "/") !== false) { // store post-domain page path to append later
  $urlPagePath = substr($url, strpos($url, "/"));
  $url = substr($url, 0, strpos($url,"/"));
}


$urlLast = substr($url, strrpos($url, "."));
$url = substr($url, 0, strrpos($url, "."));


if(strpos($url, ".") !== false) { // get rid of subdomain(s)
  $url = substr($url, strrpos($url, ".") + 1);
}


$url = "http://www." . $url . $urlLast . $urlPagePath;

header( "Location:{$url}");
?>

edited Feb 06 '13 at 14:18

Owen Blacker

4,117
2
33
70

answered Mar 20 '09 at 20:04

Geo

8,663
13
63
93

10

This does not actually answer the question that 69k+ people have come to this thread looking for. The question is more about DNS and has nothing to do with PHP. – Matt Clark Apr 20 '16 at 21:36
1

The question was about DNS. Not about PHP coding. – SamTzu Apr 20 '18 at 08:30
1

HTTP_HOST is the hostname, like its name implies, not an URL. Hence there won't be any `http://` to remove, nor `/` (`$urlPagePath` will always be empty). Cf https://httpd.apache.org/docs/2.4/expr.html. Due to the way the code tries to get rid of subdomain, it will also not work for things like `www.example.co.uk` where `co.uk` has to be considered as a whole. It also does not handle HTTPS. And finally using PHP just do a an HTTP redirection where any webserver can do it in configuration, is overcomplicated. So in short this certainly should not be the validated answer for this question. – Patrick Mevzek Aug 02 '18 at 23:41
If this rule should apply to all hosts then it should be done as a apache config – Svetoslav Marinov Aug 28 '18 at 06:09

How to overcome root domain CNAME restrictions?

10 Answers10

Linked