MX for domainz.net.nz points to a CNAME (illegal)
Hello, Just out of interest -- has anybody noticed any problems sending mail to Domainz, due to the fact that the MX for domainz.net.nz points to mail2.actrix.gen.nz, which is itself a CNAME for mercury.actrix.gen.nz? It's not the best MX for the zone, and hence might never get used anyway. [MX to a CNAME is illegal, in case I'm not making myself obvious] Just interested in whether this has had any operational impact. Whilst simultaneously poking fun at Domainz and Actrix for their trivial DNS misconfiguration, obviously :) jabley(a)tardis[129]$ dig mx domainz.net.nz ; <<>> DiG 2.2 <<>> mx domainz.net.nz ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56161 ;; flags: qr rd ra; Ques: 1, Ans: 2, Auth: 3, Addit: 3 ;; QUESTIONS: ;; domainz.net.nz, type = MX, class = IN ;; ANSWERS: domainz.net.nz. 4835 MX 20 mail2.actrix.gen.nz. domainz.net.nz. 4835 MX 10 mail.actrix.gen.nz. ;; AUTHORITY RECORDS: domainz.net.nz. 86400 NS ns1.actrix.gen.nz. domainz.net.nz. 86400 NS ns2.actrix.gen.nz. domainz.net.nz. 86400 NS ns1.waikato.ac.nz. ;; ADDITIONAL RECORDS: ns1.actrix.gen.nz. 86400 A 203.96.16.35 ns2.actrix.gen.nz. 86400 A 203.96.16.36 ns1.waikato.ac.nz. 86400 A 140.200.128.13 ;; Total query time: 47 msec ;; FROM: tardis to SERVER: default -- 203.97.2.226 ;; WHEN: Sun Apr 30 15:55:37 2000 ;; MSG SIZE sent: 32 rcvd: 201 jabley(a)tardis[130]$ dig a mail.actrix.gen.nz ; <<>> DiG 2.2 <<>> a mail.actrix.gen.nz ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58816 ;; flags: qr aa rd ra; Ques: 1, Ans: 2, Auth: 2, Addit: 2 ;; QUESTIONS: ;; mail.actrix.gen.nz, type = A, class = IN ;; ANSWERS: mail.actrix.gen.nz. 60 A 203.96.16.107 mail.actrix.gen.nz. 60 A 203.96.16.108 ;; AUTHORITY RECORDS: actrix.gen.nz. 43200 NS ns1.actrix.gen.nz. actrix.gen.nz. 43200 NS ns2.actrix.gen.nz. ;; ADDITIONAL RECORDS: ns1.actrix.gen.nz. 43200 A 203.96.16.35 ns2.actrix.gen.nz. 43200 A 203.96.16.36 ;; Total query time: 77 msec ;; FROM: tardis to SERVER: default -- 203.97.2.226 ;; WHEN: Sun Apr 30 15:55:57 2000 ;; MSG SIZE sent: 36 rcvd: 149 jabley(a)tardis[131]$ dig a mail2.actrix.gen.nz ; <<>> DiG 2.2 <<>> a mail2.actrix.gen.nz ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62610 ;; flags: qr aa rd ra; Ques: 1, Ans: 2, Auth: 2, Addit: 2 ;; QUESTIONS: ;; mail2.actrix.gen.nz, type = A, class = IN ;; ANSWERS: mail2.actrix.gen.nz. 43200 CNAME mercury.actrix.gen.nz. mercury.actrix.gen.nz. 43200 A 203.96.16.37 ;; AUTHORITY RECORDS: actrix.gen.nz. 43200 NS ns1.actrix.gen.nz. actrix.gen.nz. 43200 NS ns2.actrix.gen.nz. ;; ADDITIONAL RECORDS: ns1.actrix.gen.nz. 43200 A 203.96.16.35 ns2.actrix.gen.nz. 43200 A 203.96.16.36 ;; Total query time: 51 msec ;; FROM: tardis to SERVER: default -- 203.97.2.226 ;; WHEN: Sun Apr 30 15:56:09 2000 ;; MSG SIZE sent: 37 rcvd: 156 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog
On Sun, Apr 30, 2000 at 03:59:17PM +1200, Joe Abley wrote: Just interested in whether this has had any operational impact. I doubt it. It's a very common error, bind 8+ even has a logging category for it. Most MTAs have 'workarounds' for this. That's not to justify the error and lessen it's score on the buffoon scale. --cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog
Chris Wedgwood
I doubt it. It's a very common error, bind 8+ even has a logging category for it. Most MTAs have 'workarounds' for this.
More to the point, most resolvers process CNAMEs transparently, and those that don't tend to be in places that don't have to relay mail, so the MTA doesn't have to worry about it. <mutters dark things about certain braindead resolvers not handling CNAMEs for reverse map entries> BTW: I put together a little DNS checker a while ago; a few folks will have seen it already. Have a play with: http://www.daedalus.co.nz/~don/checkdomain.cgi -- don --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog
BTW: I put together a little DNS checker a while ago; a few folks will have seen it already. Have a play with:
I notice it picks up the config errors in the domainz.net.nz zone. As a matter of interest, are you personally overseeing the changeover from UoW to the glazier system or is there some other clueful person hiding behind the scenes? Regards Peter Mott Chief Enthusiast 2day.com -/- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog
On Sun, Apr 30, 2000 at 06:10:12PM +1200, Don Stokes wrote: More to the point, most resolvers process CNAMEs transparently gethostbyname does (sort of) -- but the resolver code in most MTAs I know of (postfix, sendmail and qmail) has explicit code to deal with CNAME bogosity. -cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog
Chris Wedgwood
On Sun, Apr 30, 2000 at 06:10:12PM +1200, Don Stokes wrote:
More to the point, most resolvers process CNAMEs transparently
gethostbyname does (sort of) -- but the resolver code in most MTAs I know of (postfix, sendmail and qmail) has explicit code to deal with CNAME bogosity.
Hmmm. CNAMES are usually returned in the answer section of a reply along with the actual data, so if you have foo IN CNAME bar bar IN A 1.2.3.4 you get both records. So a CNAME as the target of an MX will still work if the name resolution stuff in the client is coded to ignore the CNAME and just process the data parts of the answers section. The alternative is that it can be defensive and actually check that the key of each returned RR matches the key queried for, in which case on stumbling over a CNAME in the answers it needs to change the key it's looking for to the CNAME target. BIND it seems (at least if forwarding is enabled) actually retrieves the targets of CNAMEs, so if you ask for A records, you get any reachable A records, even if the name server being queried only has the CNAME in its local database. -- don --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog
participants (4)
-
Chris Wedgwood -
Don Stokes -
Joe Abley -
Peter Mott