Mastodawn

https://blog.gslin.org/archives/2026/02/04/12876/cloudflare-%e7%9a%84-1-1-1-1-%e6%8a%8a-a-%e6%94%be%e5%9c%a8-cname-%e5%89%8d%e9%9d%a2%e6%90%9e%e7%88%86-glibc-%e7%9a%84-dns-resolver/

Cloudflare 的 1.1.1.1 把 A 放在 CNAME 前面搞爆 glibc 的 DNS resolver

#cloudflare #cname #dns #glib #linux #public #record #resolver #rfc #rr

Cloudflare 的 1.1.1.1 把 A 放在 CNAME 前面搞爆 glibc 的 DNS resolver

有陣子了，上個月的時候 Cloudflare 的 1.1.1.1 因為在改善記憶體用量，導致 A record 有可能在 CNAME record 前面，結果把 glibc 的 DNS resolver 炸了：「What came first: the CNAME or the A record?」，在 Hacker News 上也有些有趣的討論：「What came first:...

Gea-Suan Lin's BLOG

Show thread

Pontiff Fractal Tiam 6d ago

Still the Internet seems to be working despite Let's Encrypt putting IP addresses in certificate common name.

I. Am. Not. Surprised.

#pki #cname #letsencrypt

Hacker News Jan 19

What came first: the CNAME or the A record?

https://blog.cloudflare.com/cname-a-record-order-dns-standards/

#HackerNews #CNAME #ARecord #DNS #DNSStandards #Cloudflare

What came first- the CNAME or the A record

A recent change to 1.1.1.1 accidentally altered the order of CNAME records in DNS responses, breaking resolution for some clients. This post explores the technical root cause, examines the source code of affected resolvers, and dives into the inherent ambiguities of the DNS RFCs.

The Cloudflare Blog

Some Bits: Nelson's Linkblog Jan 15

CNAME vs A record: Cloudflare outage report talks about a subtle wrinkle in DNS, where the order of the records matters when it probably shouldn't
https://blog.cloudflare.com/cname-a-record-order-dns-standards/
#postmortem #cloudflare #outage #cname #dns #+

What came first- the CNAME or the A record

The Cloudflare Blog

Show thread

Pontiff Fractal Tiam Nov 19

It's been over half a year and the Internet still seems to be working.

Here's your regular reminder that #cname in #x509 is almost always irrelevant for the validation. If someone is using it, they are doing it wrong.

Henning Uhle Oct 31

Wieder zurück ausm Urlaub. Aber mal was anderes:

Hier gibt es doch viele, die bei #Hetzner hosten, ja? Und da nutzen doch auch viele #WordPress ja? Und vielleicht ist da auch wer mit #MailPoet darunter und könnte mir weiterhelfen.

Ich soll zwei #CNAME-Einträge für MailPoet anlegen. Und bei Hetzner in der DNS-Konsole hab ich das richtig angelegt. Mit "dkim1.sendingservice.net" als Wert. Bei MailPoet kommt das an mit meiner Domain dahinter, also "dkim1.sendingservice.net.henning-uhle.eu". Wieso passiert das? Und wie stelle ich das ab?

Vielen Dank schonmal. Und gern #boost und so.

Vito Sartori (ヴィト) 🦊Oct 10

So something really weird happened today. I received an abuse report for a dormant domain I have.

The report pointed to a CNAME subdomain pointing to [org].github.io. The org is still there, the repository that was serving that subdomain is still there, but accessing it led to a phishing page.

Anyone has seen anything like that? No activity on the github organisation, nothing on audit logs of the affected domain. Nothing makes sense.

#github #infosec #dns #cname #phishing

Jun Wong Sep 23

New post: How to Set Up Free SSL For Your Websites (Cloudflare!) Why is SSL important for websites?

You’ve probably notice https://junsungwong.com/2025/08/27/how-to-set-up-free-ssl-for-your-websites-cloudflare/ #ARecord #BeginnerFriendly #Cloudflare #CNAME

Show thread

Pontiff Fractal Tiam Sep 18

I was told that I'm too dumb to understand the threat of putting IP addresses in #x509 #cname, and after two months, the Internet seems to be working just fine.

liuzhen932 @ ens18 Aug 7

在 #DNS 体系中，注册商处填写的 NS 记录与权威服务器上返回的 #NS 记录扮演着不同但关联的角色：

注册商设置的 NS 记录构成了域名的委托链，它是全球递归解析器寻找权威服务器的起点，决定了谁被信任来回答这个域名的查询；而权威服务器自身在响应时返回的 NS 记录，则属于该区域的区域数据，通常用于通知下游服务器该域的权威来源，常见于区域传输或缓存更新。

尽管 RFC 建议两者保持一致以确保清晰和可维护，但技术上并不要求强制同步 —— 只要权威服务器能正常响应查询，即使其返回的 NS 记录指向一个未注册或看似荒诞的域名，递归解析器仍会接受其提供的 A、#CNAME 等答案。因此，你可以在注册商处安全使用真实、可达的 NS 名称，同时在自己的 zone 文件中保留个性化的 NS「签名」，作为一种无害而有趣的极客彩蛋。