Hacker News Reader

Comment by mlyle | Hacker News Reader

> But, MX records are supposed to refer to a CNAME not an IP.

To be clear, MX records are supposed to point to an A record. Pointing to a CNAME record is not legal.

I can see the value in pointing at a name so TLS can validate correctly, but I don't see any value in limiting it to an A record.

Pointing to a CNAME isn't legal, but it should be. This particular limitation never made any sense to me and it should be lifted.

It might not be legal, but works quite well for me.

Having a dynamic IPv4 address with multiple domains on it, updating every record would take more time.

Admittedly, I could also have a copy of the IP per domain, but the CNAME was easier to setup.

That would require updating too much software in the field.

Meanwhile you can use ALIAS record and get the same result, without others noticing.

There is no such thing as an ALIAS record. That’s something your DNS provider made up and shows to you in the interface, but behind the scenes they are providing the same old AAAA and A records as always, along with some sort of auto-updating feature which they will run to detect changes in the address of the name in the “ALIAS record”. How often this will update is anyone’s guess as it’s up to the DNS provider.

See: https://en.wikipedia.org/wiki/CNAME_record#ANAME_record

Sorry to be pedantic, but there is no such thing as an ALIAS record. It's just the DNS server doing the indirection for you.

What if it's an AAAA record?

RFC 5321 is ambivalent of A vs. AAAA. When discussing the matter, 5321 says "A or AAAA RR". It later says about IPv6 that "The appropriate actions to be taken either will depend on local circumstances." When I re-wrote Gmail's DNS libraries about 6 years ago, I wrote it to start with AAAA and fall back to A. So if you have an MX and AAAA records for those names, you should notice all your inbound from Google comes via IPv6.

I've noticed that!

I believe Postfix also delivers to IPv6 if possible.

In my travels there's a significant portion of the internet which is not IPv6 capable; for example the World Community Grid failed for me when trying to use pure IPv6, and they send emails about things. I'd currently not risk using an IPv6 record for my MX, I suspect a high failure rate delivering email from every service on the planet will follow.

> set qu=mx > gmail.com. Server: 10.1.1.1 Address: 10.1.1.1#53

Non-authoritative answer: gmail.com mail exchanger = 20 alt2.gmail-smtp-in.l.google.com. gmail.com mail exchanger = 5 gmail-smtp-in.l.google.com. gmail.com mail exchanger = 40 alt4.gmail-smtp-in.l.google.com. gmail.com mail exchanger = 10 alt1.gmail-smtp-in.l.google.com. gmail.com mail exchanger = 30 alt3.gmail-smtp-in.l.google.com.

Authoritative answers can be found from: > set qu=aaaa > gmail-smtp-in.l.google.com. Server: 10.1.1.1 Address: 10.1.1.1#53

Non-authoritative answer: gmail-smtp-in.l.google.com has AAAA address 2607:f8b0:4001:c05::1a

Sure, but it has A records too.

I wake up and see the HackerNews downvote train has hit myself and you, when what you said is 100% correct; gmail-smtp-in.l.google.com is both IPv4 and IPv6.

The network I'm on right now (VPN to work) cannot service IPv6 and I cannot connect to the IPv6 IP for that MX host, but I can easily connect to the IPv4 endpoint.

I fixed it, that was a brain fart.

Reply on news.ycombinator.com