Hacker News Reader

Comment by cadence- | Hacker News Reader

I would be interested to know why the RFC 1035 forbids using IP addresses in MX records. What was the original concern with doing this?

View on HN

Looks like this goes back to the days when Internet with TCP/IP was not yet the only option and when there was also other networks available (Chaosnet). [1]

For the A records you can different classes of addresses. Nowadays we are using the "IN", but the spec also supports others like "CH" (Chaos) and "HS" (Hesiod).[2]

MX record points to mail.example.org (A-record). mail.example.org could then point to two different addresses in the different networks, using the different classes. Depending on what network the client is connected to, it can request specify the class in the query and get address on the correct network.

I guess they could have baked this in to the MX records as well, but that would have made it more complicated.

Disclaimer: Just googled this up.

[1] https://serverfault.com/questions/663112/why-cant-mx-records... [2] https://serverfault.com/questions/220775/what-does-the-in-me...

I guess nowadays that should still be useful to give both an IPv4 and IPv6 address for the mail server?

Yep, just have A and AAAA records for the hostname the MX points to

Why? You can just make mail.example.com resolve to two IPs: an IPv4 and IPv6 address. Nothing wrong with that.

Isn't that what Natsu said?

No. If you read the top-level comment, it sounds like the response directly indicates that these days it would be useful to use the defunct multiple classes (IN vs CH) functionality to instead reference different IP types (v4 or v6) in today's Internet, hence "nowadays". That isn't needed because we can already mix v4 and v6 records within the IN class itself through A/AAAA records.

If I misunderstood the comment, then my bad.

I see, I haven't had to dig too deep into DNS so it wasn't obvious to me that those were separated like that. I guess, then, that it's only useful to allow us to someday upgrade to some post-TCP/IP world if there's ever a reason for that.

DNS standards tend to favor using aliases rather than IP's. My observation is that the overall goal is to have the IP listed as few times as possible. Otherwise there'd be no need for CNAME's in general, and everything would be an A record or an IP. But, MX records are supposed to refer to an A record not an IP.

The author is correct- if somebody is doing this, they're simply doing it wrong. Standards exist so that we can say "This configuration is wrong" instead of "Lets complicate software to allow people to use any configuration they want."

> But, MX records are supposed to refer to a CNAME not an IP.

To be clear, MX records are supposed to point to an A record. Pointing to a CNAME record is not legal.

What if it's an AAAA record?

In my travels there's a significant portion of the internet which is not IPv6 capable; for example the World Community Grid failed for me when trying to use pure IPv6, and they send emails about things. I'd currently not risk using an IPv6 record for my MX, I suspect a high failure rate delivering email from every service on the planet will follow.

> set qu=mx > gmail.com. Server: 10.1.1.1 Address: 10.1.1.1#53

Non-authoritative answer: gmail.com mail exchanger = 20 alt2.gmail-smtp-in.l.google.com. gmail.com mail exchanger = 5 gmail-smtp-in.l.google.com. gmail.com mail exchanger = 40 alt4.gmail-smtp-in.l.google.com. gmail.com mail exchanger = 10 alt1.gmail-smtp-in.l.google.com. gmail.com mail exchanger = 30 alt3.gmail-smtp-in.l.google.com.

Authoritative answers can be found from: > set qu=aaaa > gmail-smtp-in.l.google.com. Server: 10.1.1.1 Address: 10.1.1.1#53

Non-authoritative answer: gmail-smtp-in.l.google.com has AAAA address 2607:f8b0:4001:c05::1a

Sure, but it has A records too.

I wake up and see the HackerNews downvote train has hit myself and you, when what you said is 100% correct; gmail-smtp-in.l.google.com is both IPv4 and IPv6.

The network I'm on right now (VPN to work) cannot service IPv6 and I cannot connect to the IPv6 IP for that MX host, but I can easily connect to the IPv4 endpoint.

RFC 5321 is ambivalent of A vs. AAAA. When discussing the matter, 5321 says "A or AAAA RR". It later says about IPv6 that "The appropriate actions to be taken either will depend on local circumstances." When I re-wrote Gmail's DNS libraries about 6 years ago, I wrote it to start with AAAA and fall back to A. So if you have an MX and AAAA records for those names, you should notice all your inbound from Google comes via IPv6.

I've noticed that!

I believe Postfix also delivers to IPv6 if possible.

I fixed it, that was a brain fart.

Pointing to a CNAME isn't legal, but it should be. This particular limitation never made any sense to me and it should be lifted.

That would require updating too much software in the field.

Meanwhile you can use ALIAS record and get the same result, without others noticing.

Sorry to be pedantic, but there is no such thing as an ALIAS record. It's just the DNS server doing the indirection for you.

There is no such thing as an ALIAS record. That’s something your DNS provider made up and shows to you in the interface, but behind the scenes they are providing the same old AAAA and A records as always, along with some sort of auto-updating feature which they will run to detect changes in the address of the name in the “ALIAS record”. How often this will update is anyone’s guess as it’s up to the DNS provider.

See: https://en.wikipedia.org/wiki/CNAME_record#ANAME_record

It might not be legal, but works quite well for me.

Having a dynamic IPv4 address with multiple domains on it, updating every record would take more time.

Admittedly, I could also have a copy of the IP per domain, but the CNAME was easier to setup.

I can see the value in pointing at a name so TLS can validate correctly, but I don't see any value in limiting it to an A record.

If it’s an IP address, you’re restricting it to IPv4 or IPv6. If it’s a name, then it can work on both IPv4 and IPv6.

You want pretty much everything but A and AAAA records to use domain names for pointing, so that they’re not tied to a particular version of IP. Keep the IP resolution to the last step only, and let everything else use domain names.

The RFC doesn’t “forbid” using IP addresses in MX records – it’s physically impossible to have them. The fact that the IPv4 address syntax is also parseable as a domain name is unrelated; what is physically stored inside the MX record is a textual domain name.

So you can have multiple address for the same MX, eg IN A 10.77.0.1 and IN AAAA fd77::1.

The RFC is pretty readable, but the tldr is that DNS is more strongly typed than that. It's not just a string-lookup service. There's a wire format for names, which some records carry; there are wire formats for v4 and v6 addresses, which other records carry, but in no situation do the strings "foo.example.com" or "10.1.0.1" actually go over the network when doing a DNS resolution.

Nitpick: Statically typed, not strongly typed.

Reply on news.ycombinator.com