[GH-ISSUE #179] Clarification on NS records for sub-domains #75

New issue

Closed

opened 2026-03-13 15:40:48 +03:00 by kerem · 2 comments

kerem commented

2026-03-13 15:40:48 +03:00

Owner

Originally created by @icelava on GitHub (Sep 3, 2019).
Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/179

From the originating article by EFF, we learnt of this light-weight ACME-DNS software
https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation

I have successfully tested this using my personal domain icelava.net by delegating a sub-domain to my home test Linux server running ACME-DNS. As of now, I define my sub-domain with the current IP address assigned to my home (which really is dynamic). I have a knowledge gap as to whether this sub-domain delegation can be more dynamic?

For example, right now
NS sub sub.icelava.net.
A sub 111.222.333.444

I would like to instead set it as

NS sub sub.icelava.net.
CNAME sub what.ever.dynamic.dns.

Does regular DNS delegation allow such configuration? All the articles I've read so far on the topic define a hard A record for the sub-domain name.

Originally created by @icelava on GitHub (Sep 3, 2019). Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/179 From the originating article by EFF, we learnt of this light-weight ACME-DNS software https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation I have successfully tested this using my personal domain icelava.net by delegating a sub-domain to my home test Linux server running ACME-DNS. As of now, I define my sub-domain with the current IP address assigned to my home (which really is dynamic). I have a knowledge gap as to whether this sub-domain delegation can be more dynamic? For example, right now NS sub sub.icelava.net. A sub 111.222.333.444 I would like to instead set it as NS sub sub.icelava.net. CNAME sub what.ever.dynamic.dns. Does regular DNS delegation allow such configuration? All the articles I've read so far on the topic define a hard A record for the sub-domain name.

kerem

2026-03-13 15:40:48 +03:00

closed this issue
added the
question
label

kerem commented

2026-03-13 15:41:04 +03:00

Author

Owner

@joohoi commented on GitHub (Sep 3, 2019):

I haven't tested that scenario myself, and while it's suboptimal setup at best it just might work. I don't think the DNS RFCs forbid this use case though but the support by different implementations may vary.

@joohoi commented on GitHub (Sep 3, 2019): I haven't tested that scenario myself, and while it's suboptimal setup at best it just might work. I don't think the DNS RFCs forbid this use case though but the support by different implementations may vary.

kerem commented

2026-03-13 15:41:09 +03:00

Author

Owner

@icelava commented on GitHub (Sep 6, 2019):

I previously took a look at RFC 1035 and its definition of the NS RR wasn't clear on the use of CNAME aliases. I've been testing this out with my own domain, with additional declaration for a separate CNAME host (e.g. subns) to act as the NS for sub; the major fallout I see is that it gets a little messed up with SOA answers because it will follow the alias chain back to the actual dynamic DNS hostname (e.g. icelava.dyndns.org) and therefore I lose authority for my sub-domain.

Looking around some more it appears the CNAME aliases must not be use for NS and MX records. Especially indicated so in RFC 2181 10.3. So back to A records then.

@icelava commented on GitHub (Sep 6, 2019): I previously took a look at RFC 1035 and its definition of the NS RR wasn't clear on the use of CNAME aliases. I've been testing this out with my own domain, with additional declaration for a separate CNAME host (e.g. subns) to act as the NS for sub; the major fallout I see is that it gets a little messed up with SOA answers because it will follow the alias chain back to the actual dynamic DNS hostname (e.g. icelava.dyndns.org) and therefore I lose authority for my sub-domain. Looking around some more it appears the CNAME aliases must not be use for NS and MX records. Especially indicated so in RFC 2181 10.3. So back to A records then.

kerem referenced this issue

2026-03-13 16:15:13 +03:00

[PR #75] [MERGED] Revert "Disable golint until golang/go#25048 is resolved." #278