Hacker News Reader

Comment by gtirloni | Hacker News Reader

> In order for this to work, 2 DNS records need to be created: >CNAME for the domain to prose

I don't think RFC 1034 even allows that (zone apex must be A record).

https://serverfault.com/questions/613829/why-cant-a-cname-re...

Yep you’re right! My example was done with a CNAME on a subdomain (replaced the domain for privacy), and most providers provide flattening so I didn’t even think about it! I’ll update the copy to mention that.

Even for a subdomain, having CNAME and TXT records on the same name isn't supposed to be okay; normally you'd work around it by reading the TXT record off an other unlikely-to-be-used subdomain of the name you're putting a CNAME on.

Now that's one I never knew about. I'll have to take a look, should be easy enough to update prose to handle that though.

edit: Updated prose to handle this

i think SRV records might be more appropriate for this use case.

This also has the advantage that it doesn't boat the TXT response for the domain. Putting it at some thing like _prose.sub.domain allows just getting the relevant record.

CNAME flattening works just fine and is supported by a variety of DNS providers at this point, but yes — there’s an RFC otherwise.

more precisely a CNAME must be the only record type for a given label as it would be otherwise ambiguous to revolvers. that doesn't hold true for DNSSEC secured zones where the records for signatures are to be allowed, but also arent creating any ambiguity on how to resolve queries. the apex must have NS and SOA records for a minimum to work so that rules out any CNAME in addition to that. an apex without any other record but SOA and NS would work fine though. so saying it needs to be an A record implies the wrong thing.

It's strange they even put an example but it would never work. You could use cloudflare DNS to approximate a CNAME? Or prose has an A record that you could use? Not sure how this slipped by.

If you use Cloudflare, it will do "CNAME Flattening" for you

It is not allowed but I have never seen a situation where it doesn't work.

Reply on news.ycombinator.com