rsp2k/coredns
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

zones: add explicit CNAME-to-apex for RFC 4592 empty-non-terminals

Browse source 
Wildcards in DNS only synthesize for names that don't already exist
in the zone tree. A `_acme-challenge.<sub>` TXT record makes <sub>
an "empty non-terminal" — exists in the tree (as a parent node) but
has no records of its own. Per RFC 4592 §2.2.3, wildcards skip these,
so RFC-compliant resolvers (HE, BIND) return NODATA for <sub> even
when the zone has `* CNAME @`.

Fix: for each <sub> that's an empty non-terminal in a zone with a
wildcard, add an explicit `<sub> CNAME @` so the resolution outcome
matches what the wildcard would have produced. Zero-knowledge — no
need to identify the specific service IP per name.

30 records added across 14 zones:
  acrazy.org (langfuse.dootie)
  context.bet (studio)
  copper-springs.online (docs.butler.dev)
  demostar.io (cw.cw, doom, meet)
  home-inspector.store (api, dashboard, mailpit)
  inspect.pics (admin)
  log.doctor (app, docs)
  malloys.us (cp, cp-sandbox, mary)
  nielsen-inspections.com (calendar, cw, files, v2-calendar)
  qubeseptic.com (api.dispatch, dispatch, leads, mail.dispatch,
                  rentcache.dispatch)
  ryanmalloy.com (c4ai)
  sidejob.pro (api)
  upc.llc (catalog, minio.or, or, s3)

CoreDNS (lenient) was returning the wildcard CNAME for these names
anyway; HE (strict RFC-compliant) was returning empty. After this
change, both behave identically.
This commit is contained in:
Ryan Malloy 2026-05-18 18:34:51 -06:00
parent c19df5d0a5
commit f8363e5ea7
13 changed files with 69 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

5
zones/acrazy.org.zone
View file

@ -38,4 +38,7 @@ _acme-challenge.l 300 IN TXT "WmE8LR03vR1ua26QK58PxCmfxQ-_369sXIezIr8cNoM"
_acme-challenge.l 300 IN TXT "Ike1gqcB3VI7WwKoH3T8zqbpYSo2qRPrq0iqzB5wmFU"
_acme-challenge.langfuse.dootie 300 IN TXT "1WJ-mHJ2SQuuC5CgxbYY6euwiMZm1dVicfIkeluovTY"
_acme-challenge.dootie.l 300 IN TXT "uW30ozl6AKA_q9FWPlvaxuwbgBJ-TgTsXxA3JFtn0tg"
_acme-challenge.langfuse.dootie.l 300 IN TXT "P6tOVfwB8OBbI6AqnIuHXKQc05FjuABhGihUHwzpMOs"
_acme-challenge.langfuse.dootie.l 300 IN TXT "P6tOVfwB8OBbI6AqnIuHXKQc05FjuABhGihUHwzpMOs"
; Explicit CNAMEs added to fix RFC 4592 empty-non-terminal cases
; (parent name has _acme-challenge children, so wildcard would skip it)
langfuse.dootie 300 IN CNAME acrazy.org