Hacker News Reader

Comment by harryh | Hacker News Reader

What's an ALIAS record? I don't even see that here:

https://en.wikipedia.org/wiki/List_of_DNS_record_types

Generally speaking, an ALIAS record points to a hostname. The DNS server software then fetches the IP address behind that hostname, and returns it as an A record to the user.

Normally, this is solved by using a CNAME record, but if you use a CNAME as the zone apex, then you cannot have any subdomains (because they will all be resolved through the CNAME record).

For some additional information: http://scripting.com/stories/2011/11/13/dnsimplesNewAliasFea... http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/Cre...

That's absolutely correct.

Building on that: The github blog post states that using an ALIAS record will allow you to take advantage of their CDN. I don't know if I believe that. Since the ip is being fetched by the ALIAS supporting nameserver, the CDN will use that as the end user location. Therefore, everyone is going to that location.

The only way around that would be:

1) CDN uses IP ANYCAST (in which case their CDN would work with just listing the IP as well and the ALIAS point is moot)

2) ALIAS supporting nameserver uses the draft edns-client-subnet rfc (very low probability any current ALIAS provider uses it to resolve the ALIAS since support for the draft may be iffy and much heavier ns resolve logic for ALIAS provider).

Additional thoughts welcome.

Update: Github's external CDN provider is using ANYCAST, so that explains why that's working --- AND --- to explain why their CDN doesn't work on direct ip pointing is because they are giving you the ip to their own direct servers, which are non-cdn / non-anycast, which explains why in this case, the ALIAS record gives the benefit for their CDN, while the ip doesn't (because they're having you use a different non-cdn ip so they can change external cdn providers at will and not affect those that are pointing to the ip directly).

I think that's right. But:

a) this is a common problem for CDNs, as you can never guarantee the DNS server that's asking for your CNAME is close to the cache servers that you want to deliver your end-user content; I'd be surprised if the first CDN cache server a client fetches github content from didn't inspect the end-user IP address from the HTTP session and redirect to a closer / "more optimal" point of presence if one were available;

b) In any case, it looks like Fastly is using anycast from a quick telnet to route-views.routeviews.org.

this is a common problem for CDNs, as you can never guarantee the DNS server that's asking for your CNAME is close to the cache servers that you want to deliver your end-user content;

This is the case, and it's a significant problem - especially for people who use Google's DNS server or OpenDNS

There is an experimental, but reasonably widely deployed[1] solution available though.

I'd be surprised if the first CDN cache server a client fetches github content from didn't inspect the end-user IP address from the HTTP session and redirect to a closer / "more optimal" point of presence if one were available;

That's pretty unlikely. The redirect is going to cost more than just serving the data (and of course there is no way to persist that redirect back to the DNS layer, so it will happen for every resource). "Media" CDNs (ie, CDNs optimised for delivery of large files like movies) sometimes work like this though.

HOWEVER, since Fastly/Github is doing Anycast, none of this should affect them.

[1] http://www.cdnplanet.com/blog/which-cdns-support-edns-client...

Google's public DNS (8.8.8.8) uses anycast as well.

https://developers.google.com/speed/public-dns/faq#anycast

I'll just put this here: Anycast doesn't _necessarily_ break CDNs in the way this thread has been implying. Ideally you've got some sort of loose unicast rpf in place for your DNS nodes, and have them receive DNS queries on the anycast address, and send outbound queries out of a local interface so that the NS you're querying knows where you're located... but this is getting a bit far afield of GitHub's new features in any case. PM me if you want to here me blather about DNS and CDNs more. And cross your fingers that edns0-subnet gets implemented sometime soon.

definitely not doing Anycast. As I wrote just a few days ago [1] github.map.fastly.net resolves to a different IP address based on the geographic location of the user. The exact server location might be approximated from the X-Served-By response header:

  X-Served-By: cache-fra1225-FRA
  X-Served-By: cache-d46-DAL

[1] https://news.ycombinator.com/item?id=6975830

That article says that Fastly is not doing Anycast.

Redirecting the user to somewhere closer, for small content like you would have on Pages, would make a bad situation (talking to a suboptimal server) much much worse (due to having to setup a second connection and do another round trip with the new request).

I have always wanted to be able to use routeviews for more than an easy way to bring about feelings of network inadequacy.

To my understanding, it's a new, nonstandard thing invented by DNSimple that lets you specify your base domain as a reference to another domain — basically, it's like a CNAME where an A record would normally be required.

Yep. ALIAS records exist basically to get around the CNAME restriction introduced in RFC 1034. Basically, with a CNAME, you can't have any other qtypes for the leaf that you're on. (I'll explain what that means...)

For example:

If you set up subdomain.yourdomain.com to be an A record to to 10.0.1.1, you can also set up additional A records, AAAA records for IPv6, and even MX and NS records for subdomain.yourdomain.com.

If you set up subdomain.yourdomain.com to be a CNAME, you can't have any other record types for subdomain.yourdomain.com.

ALIAS records exist because you can't CNAME your root record - the root of your domain has to have at the very least an SOA record, and NS records are going to be needed for the domain to actually resolve. Since those record types exist at the root of your domain, and since CNAME's can't coexist with other record types, you can't use CNAME's at the root of your domain.

Accordingly, the ALIAS record really is only useful to redirect the root apex of your domain somewhere else.

(Just my two cents.)

So is this blog incorrect in stating that you can simply change CNAME at your domain's registrar and still take advantage of github's CDN for "apex" domains? http://davidensinger.com/2013/03/setting-the-dns-for-github-...

Github stated that if you use an "apex" domain your only option is to set A records to their IP but that doesn't seem right.

Yeah, that blog isn't right, or at least it shouldn't be. (Just because a DNS registrar allows you to set up @ to point to a CNAME, or www to point to multiple CNAMEs on their authoritative servers, doesn't mean that your recursive nameserver will know what to do with that.)

It might be that Namecheap allows you to configure "CNAME's" but actually implements them as ALIAS records or HTTP redirects or something similar and obscures that from the user. Not having a Namecheap account I can't say for certain.

GitHub is correct, the @ record cannot be a CNAME.

Interesting and thanks for the clarification. I see they have (Alias) in parenthesis so it makes me wonder if they are implemented as ALIAS records. This will take some more digging.

You can not have a CNAME at apex/root/naked domain such as example.com level. you can not point example.com CNAME username.github.io. The DNS spec only allows A records/Ip Addresses at this level. some companies have come up with Alias record which works like CNAME on apex domain, some old DNS Servers might not recognize this but most do these days.

Reply on news.ycombinator.com