rsp2k/coredns
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

zones: add explicit CNAME-to-apex for RFC 4592 empty-non-terminals

Browse source 
Wildcards in DNS only synthesize for names that don't already exist
in the zone tree. A `_acme-challenge.<sub>` TXT record makes <sub>
an "empty non-terminal" — exists in the tree (as a parent node) but
has no records of its own. Per RFC 4592 §2.2.3, wildcards skip these,
so RFC-compliant resolvers (HE, BIND) return NODATA for <sub> even
when the zone has `* CNAME @`.

Fix: for each <sub> that's an empty non-terminal in a zone with a
wildcard, add an explicit `<sub> CNAME @` so the resolution outcome
matches what the wildcard would have produced. Zero-knowledge — no
need to identify the specific service IP per name.

30 records added across 14 zones:
  acrazy.org (langfuse.dootie)
  context.bet (studio)
  copper-springs.online (docs.butler.dev)
  demostar.io (cw.cw, doom, meet)
  home-inspector.store (api, dashboard, mailpit)
  inspect.pics (admin)
  log.doctor (app, docs)
  malloys.us (cp, cp-sandbox, mary)
  nielsen-inspections.com (calendar, cw, files, v2-calendar)
  qubeseptic.com (api.dispatch, dispatch, leads, mail.dispatch,
                  rentcache.dispatch)
  ryanmalloy.com (c4ai)
  sidejob.pro (api)
  upc.llc (catalog, minio.or, or, s3)

CoreDNS (lenient) was returning the wildcard CNAME for these names
anyway; HE (strict RFC-compliant) was returning empty. After this
change, both behave identically.
This commit is contained in:
Ryan Malloy 2026-05-18 18:34:51 -06:00
parent c19df5d0a5
commit f8363e5ea7
13 changed files with 69 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

9
zones/qubeseptic.com.zone
View file

@ -49,4 +49,11 @@ _submission._tcp 600 IN SRV 20 0 587 mail.supported.systems
_autodiscover._tcp 600 IN SRV 10 0 443 mail.supported.systems
_submissions._tcp 600 IN SRV 10 0 465 mail.supported.systems
_imaps._tcp 600 IN SRV 10 0 993 mail.supported.systems
_pop3s._tcp 600 IN SRV 10 0 995 mail.supported.systems
_pop3s._tcp 600 IN SRV 10 0 995 mail.supported.systems
; Explicit CNAMEs added to fix RFC 4592 empty-non-terminal cases
; (parent name has _acme-challenge children, so wildcard would skip it)
api.dispatch 300 IN CNAME qubeseptic.com
dispatch 300 IN CNAME qubeseptic.com
leads 300 IN CNAME qubeseptic.com
mail.dispatch 300 IN CNAME qubeseptic.com
rentcache.dispatch 300 IN CNAME qubeseptic.com