ANAME record support

[bab5470]

• Program: Authoritative
• Issue type: Feature request

Short description

Right now PowerDNS supports ALIAS records which is fantastic. However, we need to replicate with a secondary provider that doesn't support ALIAS records but instead supports ANAME records (which as best as I can tell are the same thing just with a different name). For reference here's the provider: https://support.dnsmadeeasy.com/support/solutions/articles/47001001412-aname-records

We did find this which is a workaround but it defeats the entire purpose of ALIAS records because then the secondary is just creating A records on their side: https://doc.powerdns.com/authoritative/settings.html#setting-outgoing-axfr-expand-alias

Usecase

We want to be able to use ALIAS records to point the root/apex domain to another DNS name. The issue seems to be competing or potentially different standards. PowerDNS uses the ALIAS record type and a third party provider uses ANAME.

Description

I'd like PowerDNS to support the ANAME record type in addition to the ALIAS record type and their behavior should be the same.

Alternatively a flag to convert ALIAS record types to ANAME record types via the config would also work.

[phonedph1]

The link you have is to their managed hosting documents, are you sure they support this as their secondary zone hosting offering? The name just maps to a type, so if you find out the type they are using to specify ANAME you can add a generic typed entry to see if it works...

[bab5470]

This is the response I got from DNS Made Easy support:

Hello there, DNS Made Easy does support an "ALIAS record type". Within DNS Made Easy it would be called our "ANAME record". To clarify, ANAME / Alias records are both RFC compliant but are proprietary to each provider.

With this being said, during an AXFR transfer we would not be able to replicate the record type within DNS Made Easy. To clarify, there would not be a work-around for this issue within DNS Made Easy.

In the future we may implement a feature that is able convert an alias record to an ANAME record, but as of now we do not.

So my understanding is that they don't support ALIAS for their secondary DNS offering either - which makes sense. I assume they're using the same software for primary DNS as secondary DNS. Weather its their own software or a third party software.

The name just maps to a type, so if you find out the type they are using to specify ANAME you can add a generic typed entry to see if it works...

I am not sure I follow this. Can you clarify this a bit more?

What would I need to ask them?

And what is a generic typed entry? Do you mean a manually created record? If so how do we create that? Something like this?

pdnsutil add-record somedomain.com @ ANAME 3600 www.somedomain.com

Assuming I created that wouldn't that pose an issue because PowerDNS wouldn't know to expand an ANAME record?

We're using PowerDNS for primary and DNS Made Easy for secondary so both sides need to be able to parse/understand the record types. Or one side has to translate the record type for the other (I think). Unless there's some trick I'm not understanding.

[Habbie]

Alternatively a flag to convert ALIAS record types to ANAME record types via the config would also work.

you can do this with https://doc.powerdns.com/authoritative/modes-of-operation.html?highlight=axfrfilter#modifying-a-slave-zone-using-a-script

[bab5470]

I'm trying to set this up and I have the following in my lua script:

function axfrfilter(remoteip, zone, record)

   -- Replace each ALIAS records with this ANAME
   if record:qtype() == pdns.ALIAS then
      resp = {}
      resp[1] = {
        qname   = record:qname():toString(),
        qtype   = pdns.ANAME,
        ttl     = 3600,
        content = record:content():toString()
     }
      return 0, resp
   end

   resp = {}
   return -1, resp
end

function string.starts(s, start)
   return s.sub(s, 1, s.len(start)) == start
end

I am not sure of two things:

1. How can I test this to be sure its returning the correct output? I believe the docs indicate if there's a problem with the script the AFXR will fail but surely there's got to be another way to test besides triggering AFXR and check the logs for a failure?

2. For the qtype should this be pdns.ANAME? Or what value belongs in that for ANAME records?

Thanks!
Brad

[phonedph1]

dig @server axfr <zone> should be enough to see if it's working. I believe dig will happily print unknown-to-it records still.

There is no pdns.ANAME because it didn't become a standard, you have to ask your provider what # they use for it and put that integer value instead.

[bab5470]

Thank you that helps. I've gotten what I hope is a qtype from DNS Made Easy although they seemed a bit uncertain.

That being said when I do a dig instead of seeing the record content I am seeing this:

staging1.xtramagazine.com. 300	IN	TYPE65401 \# 32 1473746167696E6731787472616D6167617A696E6505622D63646E03 6E657400

That record data looks wrong to me. Is this syntactically valid?

content = record:content():toString()

I also tried:

content = record:content()

I don't see an example of this in the documentation.

[bab5470]

I'm seeing other examples online of record:content() working but my record content should be staging1xtramagazine.b-cdn.net. but instead its coming out as \# 32 1473746167696E6731787472616D6167617A696E6505622D63646E03 6E657400

Is this some ASCII representation or why does it look like this?

[Habbie]

>>> '1473746167696E6731787472616D6167617A696E6505622D63646E03 6E657400'.replace(' ','').decode('hex')
'\x14staging1xtramagazine\x05b-cdn\x03net\x00'

the syntax is from https://datatracker.ietf.org/doc/html/rfc3597, and it is what DNS software uses to represent things they don't know about.

Interestingly, 65401 is the number PowerDNS uses for ALIAS, and the content format matches too. I wonder if you need that Lua script at all!

[bab5470]

I was told to try qtype 255 then if that didn't work to try qtype 252.

The reason for doing this is that DNS Made Easy isn't accepting these ALIAS records. So I'm pretty sure some translation is necessary. Although exactly what qtype to use isn't super clear.

[phonedph1]

They are definitely leading you astray with 255/252, see https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4 for what these are.

[Habbie]

Oh, let's clarify a thing. Are you getting zone transfers from them? Or are they getting zone transfers from you?

[bab5470]

They are the secondary, we (PowerDNS) are the primary. They're doing a zone transfer FROM us.

[Habbie]

I am not sure this is what I need though. Don't I need to know the numeric qtype for the ANAME record?

If ANAME records were a thing, yes. But:

since our ANAME records follow the RFC compliant process for CNAME flattening

There is no RFC for that.

Perhaps you can ask them explicitly what they expect in the AXFRed zone to get ANAME, or CNAME flattening, or whatever the process is.

[bab5470]

I'm not getting anywhere with DNS Made Easy. They referenced this:

AXFR Zone transfers
When a zone containing ALIAS records is transferred over AXFR, the outgoing-axfr-expand-alias setting controls the behaviour of ALIAS records.

When set to ‘no’ (the default), ALIAS records are sent as-is (RRType 65401 and a DNSName in the RDATA) in the AXFR.

When set to ‘yes’, PowerDNS will look up the A and AAAA records of the name in the ALIAS-record and send the results in the AXFR. This is useful when your secondary servers do not understand ALIAS, or should not look up the addresses themselves. Note that secondaries will not automatically follow changes in those A/AAAA records unless you AXFR regularly.

Is there any way to send a NOTIFY to DNS Made easy any time PowerDNS detects the resulting name to IP resolution changes?

[Habbie]

no, sorry. PowerDNS does not really keep track of the ALIAS result like that. A hacky workaround is to set SOA-EDIT to EPOCH and trigger a notify (via the REST API or pdns_control) periodically, say, every few minutes.

[bab5470]

According to DNS ME they are running bind9 on the backend. So is there a way to see what qtype ANAME records are in bind9?

[Habbie]

BIND9 does not have ANAME or anything like it