ALIAS record not working

[bab5470]

For some reason, ALIAS records seem not to be working on my PowerDNS server.

I have the following setup:

$pdnsutil list-zone pinktriangle.ca | grep -e "CNAME|ALIAS"
pinktriangle.ca 300 IN ALIAS www.pinktrianglepress.com
www.pinktriangle.ca 300 IN CNAME www.pinktrianglepress.com.

Yet I run dig:

[Wed Nov 08 15:01:34 DNS1]
$dig +short www.pinktriangle.ca
www.pinktrianglepress.com.
158.106.84.48.

So my CNAME record works as expected. But then I query for the ALIAS record:

[Wed Nov 08 15:01:49 DNS1]
$dig +short pinktriangle.ca.

[Wed Nov 08 15:01:58 DNS1]
$dig +short pinktriangle.ca. ANY

[Wed Nov 08 15:02:03 @DNS1]
$dig +short pinktriangle.ca. ALIAS

What am I missing here?

Thanks,
Brad

[klaus-nicat]

You should use dig without +short:

$ dig www.pinktrianglepress.ca
...
;; ANSWER SECTION:
www.pinktrianglepress.ca. 300   IN      CNAME   www.pinktrianglepress.com.
www.pinktrianglepress.com. 261  IN      CNAME   158.106.84.48.

The last ressource record is wrong, it should be an A record instead of CNAME

[bab5470]

Thanks for the response! The issue isn't with the CNAME record though but with the ALIAS record. (so the one without www)

[bab5470]

I don't get an answer for that:

dig pinktriangele.ca

; <<>> DiG 9.16.44 <<>> pinktriangele.ca
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 28054
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1024
;; QUESTION SECTION:
;pinktriangele.ca.		IN	A

;; AUTHORITY SECTION:
ca.			1984	IN	SOA	prd-czp-05.corp.cira.ca. admin-dns.cira.ca. 2311082000 2100 900 3456000 3600

;; Query time: 16 msec
;; SERVER: 104.152.211.99#53(104.152.211.99)
;; WHEN: Wed Nov 08 15:39:29 EST 2023
;; MSG SIZE  rcvd: 112

[klaus-nicat]

Have you enabled https://doc.powerdns.com/authoritative/settings.html#expand-alias and https://doc.powerdns.com/authoritative/settings.html#setting-resolver?

And fix the CNAME as written before.

[bab5470]

CNAME fixed (switched to A record).

Expand-Alias is enabled.
Resolver is set to 127.0.0.1

[klaus-nicat]

Is there a resolver (unbound, bind ...) listening on localhost port 53?

Do you see the DNS query from PowerDNS to that local resolver? (tcpdump -i any host 127.0.0.1 and port 53)

[bab5470]

Does the Rocky Linux resolv service count? Do we need to use bind, unbound or powerdns Recursor?

When I run a tcpdump I do see some traffic for www.pinktrianglepress.com. For example:

16:43:22.047073 lo    In  IP localhost.26819 > localhost.domain: 57710+ A? www.pinktrianglepress.com. (43)
16:43:22.047160 lo    In  IP localhost.domain > localhost.26819: 57710*- 1/0/0 A 158.106.84.48 (59)

[klaus-nicat]

Ar far as I see it works now. The problem was the missing A entry. If you query for "A pinktrianglepress.ca", then the ALIAS will trigger an A lookup for www.pinktrianglepress.com. And this A for www.pinktrianglepress.com was missing in first place - which you have fixed.

[bab5470]

I think I understand the problem now.

When I point an ALIAS record to a CNAME it doesn't resolve properly.
When I point an ALIAS record to an A record it DOES resolve properly.

See the following:

Scenario1 - ALIAS -> CNAME

$> pdnsutil list-zone pinktrianglepress.com
$ORIGIN .
pinktrianglepress.com   300     IN      ALIAS   www.pinktrianglepress.com
www.pinktrianglepress.com       300     IN      CNAME   www.pinktrianglepress.com.cdn.cloudflare.net.

$> curl -v -k https://pinktrianglepress.com/
* Could not resolve host: pinktrianglepress.com
* Closing connection 0
curl: (6) Could not resolve host: pinktrianglepress.com

$> curl -v -k https://www.pinktrianglepress.com/
*   Trying 104.18.11.183:443...
* Connected to www.pinktrianglepress.com (104.18.11.183) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, handshake failure (552):
* OpenSSL/1.1.1l-fips: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
* Closing connection 0
curl: (35) OpenSSL/1.1.1l-fips: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure

The SSL handshake error for https://www.pinktrianglepress.com/ is expected but the Could not resolve host for https://pinktrianglepress.com/ is NOT expected. The Alias pointing to the CNAME should get resolved properly.

Scenario2 - ALIAS -> A record

$> pdnsutil list-zone pinktrianglepress.com
$ORIGIN .
pinktrianglepress.com   300     IN      ALIAS   www.pinktrianglepress.com
www.pinktrianglepress.com       300     IN      A       104.18.10.183

$> curl -v -k https://pinktrianglepress.com/
*   Trying 104.18.10.183:443...
* Connected to pinktrianglepress.com (104.18.10.183) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, handshake failure (552):
* OpenSSL/1.1.1l-fips: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
* Closing connection 0
curl: (35) OpenSSL/1.1.1l-fips: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure

$> curl -v -k https://www.pinktrianglepress.com/
*   Trying 104.18.10.183:443...
* Connected to www.pinktrianglepress.com (104.18.10.183) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, handshake failure (552):
* OpenSSL/1.1.1l-fips: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
* Closing connection 0
curl: (35) OpenSSL/1.1.1l-fips: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure

The SSL handshake error for https://www.pinktrianglepress.com/ is expected for both cases.

So is ALIAS -> CNAME supposed to work? If so what could be the issue?

If not that makes ALIAS records pretty limiting. We're using ALIAS and CNAME because we're pointing to a third-party system (Cloudflare) which doesn't guarantee their IPs won't change so we can't use A records with hard coded IP addresses. :-\

Thanks
B

[bab5470]

I also tried this:

$pdnsutil list-zone pinktrianglepress.com
$ORIGIN .
pinktrianglepress.com   300     IN      ALIAS   www.pinktrianglepress.com.cdn.cloudflare.net
www.pinktrianglepress.com       300     IN      CNAME   www.pinktrianglepress.com.cdn.cloudflare.net.

$> curl -v -k https://www.pinktrianglepress.com/
*   Trying 104.18.11.183:443...
* Connected to www.pinktrianglepress.com (104.18.11.183) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, handshake failure (552):
* OpenSSL/1.1.1l-fips: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
* Closing connection 0
curl: (35) OpenSSL/1.1.1l-fips: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure

$> curl -v -k https://pinktrianglepress.com/
* Could not resolve host: pinktrianglepress.com
* Closing connection 0
curl: (6) Could not resolve host: pinktrianglepress.com

Now www.pinktrianglepress.com.cdn.cloudflare.net is an A record hosted outside our powerdns installation:

$> dig www.pinktrianglepress.com.cdn.cloudflare.net

; <<>> DiG 9.16.44 <<>> www.pinktrianglepress.com.cdn.cloudflare.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36257
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1024
;; QUESTION SECTION:
;www.pinktrianglepress.com.cdn.cloudflare.net. IN A

;; ANSWER SECTION:
www.pinktrianglepress.com.cdn.cloudflare.net. 269 IN A 104.18.11.183
www.pinktrianglepress.com.cdn.cloudflare.net. 269 IN A 104.18.10.183

;; Query time: 20 msec
;; SERVER: 104.152.211.99#53(104.152.211.99)
;; WHEN: Thu Nov 09 10:59:38 EST 2023
;; MSG SIZE  rcvd: 105

So ALIAS doesn't seem to work on our server in that scenario either.

The only scenario it works is where I point the ALIAS record at an A record on our server.

Is this an issue with the local resolver? Should I repoint Resolver is set to 8.8.8.8 (Google DNS?) Or should we be running a different local resolver?

[klaus-nicat]

I think it should work also when the ALIAS points to a CNAME.

CLient -> PowerDNS -> Resolver -> resolving .....

PowerDNS ask the resolver for the target. IT should be irrelevant if the resolver has to resolve a CNAME or finds directly an A record.

So first check your local resolver if CNAME resolving works on your local resolver, with "dig @127.0.0.1 ....."

And of course try if using 8.8.8.8 or 1.1.1.1 as resolver changes the result.

[bab5470]

For posterity, the issue was that I needed to point resolver=x.x.x.x where x.x.x.x is the IP address of our internal recursive DNS server. I likely could have also used resolver=8.8.8.8, which would have worked just as well. Thank you @klaus-nicat for figuring this out.