spf-discuss
[Top] [All Lists]

Re: how to avoid receiving email w. sender forged to be a host in my domain

2004-08-12 11:24:39

DNS does not allow there to be both a CNAME and a TXT (or any other type)
record for a name.  You would think bind would be smart enough to
realize that a CNAME counts as a specific definition overriding a wildcard
of any other record type.  But then, bind is bind.

If you must have the CNAME on the same level as the wildcard, then
you'll have to use another authoritative DNS server.  Using a CNAME
effectively blocks use of a wildcard at the same level in bind.

That is exactly the rule most often violated with CNAMEs. Any node that contains a CNAME record cannot contain any "other data" records, which also excludes "*" in a CNAME node, giving the infamous BIND log line of "...CNAME and other data...".

CNAMEs work great, people don't, so people should avoid CNAMEs unless they really need them and they know how to use CNAMEs.


Len


_____________________________________________________________________
http://IMGate.MEIway.com : free anti-spam gateway, runs on 1000's of sites