Skip to content

Support ALIAS with DNSSEC live signing #18040

Description

@mdraaijer
  • Program: Authoritative
  • Issue type: Feature request

Short description

Support the combination of ALIAS records and DNSSEC in normal authoritative operation.

PowerDNS supports both ALIAS records and DNSSEC signing individually. However, an A/AAAA response synthesized from an ALIAS is not signed by normal DNSSEC live signing. In this configuration, DNSSEC-validating resolvers return SERVFAIL.

Usecase

I am using a hosting provider running PowerDNS Authoritative Server.

I want to use an ALIAS at the zone apex so that the apex can follow a hostname whose IP address may change, while keeping DNSSEC enabled for the zone.

For example:

example.com ALIAS host.example.net

This works correctly with DNSSEC disabled.

With DNSSEC enabled, the ALIAS is resolved correctly and the resulting A record is returned, but without an RRSIG A. Public validating resolvers such as Google Public DNS and Cloudflare then return SERVFAIL.

As a test, replacing the ALIAS with a normal static A record for exactly the same IP address immediately results in an A record with a valid RRSIG, and DNSSEC validation succeeds.

The hosting provider confirmed that this is caused by the way ALIAS processing and DNSSEC signing currently interact in their PowerDNS environment.

The practical use case is therefore simple: allow an apex domain to follow another hostname while retaining DNSSEC protection, without requiring the hosting provider to maintain the IP address manually.

Description

I understand from the PowerDNS documentation that DNSSEC "washing" of ALIAS records is supported during AXFR, but not with live signing.

It would be useful if PowerDNS Authoritative Server could support ALIAS together with normal DNSSEC signing without requiring a separate AXFR-based architecture or an external synchronization mechanism.

From an administrator's perspective this is particularly relevant because ALIAS and DNSSEC are both supported PowerDNS features individually, while using them together in normal authoritative operation can result in SERVFAIL for validating resolvers.

One possible implementation might be to materialize the result of an ALIAS lookup into A/AAAA RRsets which can then use the existing DNSSEC signing mechanism:

ALIAS → resolve target → materialize A/AAAA → DNSSEC sign → serve A/AAAA + RRSIG

The ALIAS target could be periodically refreshed, with the materialized A/AAAA RRsets only being changed when the target changes. A temporary failure resolving the target should preferably retain the last known valid records.

This is only a possible implementation approach; there may be a solution that fits the PowerDNS architecture better.

The main request is to make it possible to use ALIAS and DNSSEC together in normal authoritative operation, without requiring hosting providers to build and maintain their own ALIAS-to-A/AAAA synchronization system.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions