FR: Support CNAME responses from global nameservers that refer to magic-DNS names
### What are you trying to do? We want to create cname records in our public dns, like so: `servitor.mycompany.com. CNAME servitor.foo-bar.ts.net.` This allows a simpler management of DNS than having to duplicate IP values into the global DNS. On linux and windows, this does not work. The reason, as far as I can determine is this (from using `nslookup` in debug mode) 1. magic dns recieves the `.mycompany.com.` request. It isn't a `foo-bar.ts.net.` request, so it forwards it to the global name server 2. global nameserver finds the cname records, but nothing else and returns it to the magic dns server 3. magic dns considers the request fully tried and returns the cname response from global server to the client, but no A record. 4. the client gives up, because it expects the name servers to resolve the CNAME records for it. ### How should we solve this? My suggestion is a slight change in algorithm for magic dns, something like this. 1. If the domain isn't recognised as a magic domain, forward it on to other nameservers. 2. If the response is fully resolved, (i.e. a A request returns an address, return it. 3. Otherwise, consider if the "canonical name" response mathches the magic dns domain, i.e. "foo-bar.ts.net". 4. If so, perform a a magic dns lookup and return it to the client. ### What is the impact of not solving this? The workaround is to to place tailnet IP numbers directly into the global DNS, but this is error prone. ### Anything else? On MacOS, apparently
Posted by kristjanvalur on Mar 22, 2023, 9:59 AM
Tags
Related issues
- That Reddit post is feeding more conspiracy thinking than helping.
- Support BYOK/Custom Models for Inline Code Completions
- DNS-PERSIST-01 challenge support (planned for late Q1 2026)
- Yeah I can't really blame people for not realising they have shitty mics and shitty internet because it's really hard for them to tell!
- Onboarding guide for FluentAssertions
- Add WebTransport support
Raise real-world problems, find people facing the same issue, and discuss solutions.2,500 issues0 comments
support (Network)
That Reddit post is feeding more conspiracy thinking than helping.
Support BYOK/Custom Models for Inline Code Completions
DNS-PERSIST-01 challenge support (planned for late Q1 2026)
Yeah I can't really blame people for not realising they have shitty mics and shitty internet because it's really hard for them to tell!
Onboarding guide for FluentAssertions
Add WebTransport support
> solar electricity is already cheaper than natural gas Does that include transmission?
Support for WireGuard only peers
FR: Support CNAME responses from global nameservers that refer to magic-DNS names
### What are you trying to do? We want to create cname records in our public dns, like so: `servitor.mycompany.com. CNAME servitor.foo-bar.ts.net.` This allows a simpler management of DNS than having to duplicate IP values into the global DNS. On linux and windows, this does not work. The reason, as far as I can determine is this (from using `nslookup` in debug mode) 1. magic dns recieves the `.mycompany.com.` request. It isn't a `foo-bar.ts.net.` request, so it forwards it to the global name server 2. global nameserver finds the cname records, but nothing else and returns it to the magic dns server 3. magic dns considers the request fully tried and returns the cname response from global server to the client, but no A record. 4. the client gives up, because it expects the name servers to resolve the CNAME records for it. ### How should we solve this? My suggestion is a slight change in algorithm for magic dns, something like this. 1. If the domain isn't recognised as a magic domain, forward it on to other nameservers. 2. If the response is fully resolved, (i.e. a A request returns an address, return it. 3. Otherwise, consider if the "canonical name" response mathches the magic dns domain, i.e. "foo-bar.ts.net". 4. If so, perform a a magic dns lookup and return it to the client. ### What is the impact of not solving this? The workaround is to to place tailnet IP numbers directly into the global DNS, but this is error prone. ### Anything else? On MacOS, apparently
Comments (0)
No comments yet. Start the discussion.