- Program: Authoritative
- Issue type: Feature request
Short description
Support the combination of ALIAS records and DNSSEC in normal authoritative operation.
PowerDNS supports both ALIAS records and DNSSEC signing individually. However, an A/AAAA response synthesized from an ALIAS is not signed by normal DNSSEC live signing. In this configuration, DNSSEC-validating resolvers return SERVFAIL.
Usecase
I am using a hosting provider running PowerDNS Authoritative Server.
I want to use an ALIAS at the zone apex so that the apex can follow a hostname whose IP address may change, while keeping DNSSEC enabled for the zone.
For example:
example.com ALIAS host.example.net
This works correctly with DNSSEC disabled.
With DNSSEC enabled, the ALIAS is resolved correctly and the resulting A record is returned, but without an RRSIG A. Public validating resolvers such as Google Public DNS and Cloudflare then return SERVFAIL.
As a test, replacing the ALIAS with a normal static A record for exactly the same IP address immediately results in an A record with a valid RRSIG, and DNSSEC validation succeeds.
The hosting provider confirmed that this is caused by the way ALIAS processing and DNSSEC signing currently interact in their PowerDNS environment.
The practical use case is therefore simple: allow an apex domain to follow another hostname while retaining DNSSEC protection, without requiring the hosting provider to maintain the IP address manually.
Description
I understand from the PowerDNS documentation that DNSSEC "washing" of ALIAS records is supported during AXFR, but not with live signing.
It would be useful if PowerDNS Authoritative Server could support ALIAS together with normal DNSSEC signing without requiring a separate AXFR-based architecture or an external synchronization mechanism.
From an administrator's perspective this is particularly relevant because ALIAS and DNSSEC are both supported PowerDNS features individually, while using them together in normal authoritative operation can result in SERVFAIL for validating resolvers.
One possible implementation might be to materialize the result of an ALIAS lookup into A/AAAA RRsets which can then use the existing DNSSEC signing mechanism:
ALIAS → resolve target → materialize A/AAAA → DNSSEC sign → serve A/AAAA + RRSIG
The ALIAS target could be periodically refreshed, with the materialized A/AAAA RRsets only being changed when the target changes. A temporary failure resolving the target should preferably retain the last known valid records.
This is only a possible implementation approach; there may be a solution that fits the PowerDNS architecture better.
The main request is to make it possible to use ALIAS and DNSSEC together in normal authoritative operation, without requiring hosting providers to build and maintain their own ALIAS-to-A/AAAA synchronization system.
Short description
Support the combination of
ALIASrecords and DNSSEC in normal authoritative operation.PowerDNS supports both ALIAS records and DNSSEC signing individually. However, an A/AAAA response synthesized from an ALIAS is not signed by normal DNSSEC live signing. In this configuration, DNSSEC-validating resolvers return
SERVFAIL.Usecase
I am using a hosting provider running PowerDNS Authoritative Server.
I want to use an ALIAS at the zone apex so that the apex can follow a hostname whose IP address may change, while keeping DNSSEC enabled for the zone.
For example:
example.com ALIAS host.example.netThis works correctly with DNSSEC disabled.
With DNSSEC enabled, the ALIAS is resolved correctly and the resulting A record is returned, but without an
RRSIG A. Public validating resolvers such as Google Public DNS and Cloudflare then returnSERVFAIL.As a test, replacing the ALIAS with a normal static A record for exactly the same IP address immediately results in an A record with a valid RRSIG, and DNSSEC validation succeeds.
The hosting provider confirmed that this is caused by the way ALIAS processing and DNSSEC signing currently interact in their PowerDNS environment.
The practical use case is therefore simple: allow an apex domain to follow another hostname while retaining DNSSEC protection, without requiring the hosting provider to maintain the IP address manually.
Description
I understand from the PowerDNS documentation that DNSSEC "washing" of ALIAS records is supported during AXFR, but not with live signing.
It would be useful if PowerDNS Authoritative Server could support ALIAS together with normal DNSSEC signing without requiring a separate AXFR-based architecture or an external synchronization mechanism.
From an administrator's perspective this is particularly relevant because ALIAS and DNSSEC are both supported PowerDNS features individually, while using them together in normal authoritative operation can result in
SERVFAILfor validating resolvers.One possible implementation might be to materialize the result of an ALIAS lookup into A/AAAA RRsets which can then use the existing DNSSEC signing mechanism:
ALIAS → resolve target → materialize A/AAAA → DNSSEC sign → serve A/AAAA + RRSIGThe ALIAS target could be periodically refreshed, with the materialized A/AAAA RRsets only being changed when the target changes. A temporary failure resolving the target should preferably retain the last known valid records.
This is only a possible implementation approach; there may be a solution that fits the PowerDNS architecture better.
The main request is to make it possible to use ALIAS and DNSSEC together in normal authoritative operation, without requiring hosting providers to build and maintain their own ALIAS-to-A/AAAA synchronization system.