0

I'm trying to wrap my head around DNS and records. Let's say I have a root AWS account with a Route53 Hosted Zone with a domain of example.com, now I want to route beta.example.com traffic to another Route53 HostedZone in another account (that Route53 would then direct traffic to an EC2 instance or ELB), would I create a new CNAME record in my root account? I assume then I would create an alias record in my other account that would direct traffic to my ELB/EC2 (Q1)?

So basically something like this:

Root Account:

root-domain.com   CNAME   subdomain.root-domain.com

Subdomain Account:

subdomain.root-domain  ALIAS   ELB/EC2

Why does AWS create 4 NS records (something like ns-1xxx.awsdns.co.uk, ns-1xxxx.awsdns.org) and 1 SOA record? (Q2)

I'm just trying to wrap my head around how all these records work in conjunction with each other (Q3)

Is it possible for me to create a CNAME record that points to www.google.ca? Are CNAME records only for subdomains? (Q4)

Improve this question

1 Answer 1

Reset to default
0

CNAMES are funny, and best avoided as much as possible.

YOU CAN NOT USE A CNAME AT THE ROOT LEVEL - this will not work as expected and breaks the RFC (ie rules) for them. A CNAME must be a subdomain.

An ALIAS record is not actually a real record - it is a construct some providers use to allow pointing of a domain to another domain by converting it into an A record. As its a construct there are limitations about how it can be done (often the parent domain needs to be hosted with the same provider).

NS records are something different, and are required as part of DNS. AWS has created NS records to point to its nameservers - these are required (for the root of the domain) in addition to whatever other records you use. Likewise an SOA record is a management record required for each domain as part of DNS.

So -

Q1 - No, it won't work because you can't put a cname on the root of the domain. You may be able to use an ALIAS record, but I'm not familiar with the exact way these work in AWS.

Q2 - This is a requirement of DNS implementation and specification. (See RFC1034 setion 4.2.1) A lot of the SOA record is no longer very meaningful in most cases - its more for helping with the administration - nonetheless, it is required for each domain delegation (ie for root-domain.com)

Q3 - Not sure what the question is. Every domain delegation needs an SOA and NS records. root-domain is a delegation.

Q4 - Yes, its possible to create a cname that points to any other domain which can resolve (ideally directly, but through additional CNAMES is permissible). Yes, CNAME records are only for subdomains because they can't be combined with A records - see section 2.4 of RFC1912

Improve this answer
4
  • This is a fantastic answer, thank you so much! I see, so I would have to create a CNAME on a subdomain of my root domain. If I did something like create a CNAME on something like 'test.example.com' to route traffic to my other account's Route53. But what if I wanted to create a CNAME record from something like 'test.example.com' to 'google.com', why would this not work? When I did create this and navigated to test.example.com, it just sends a message saying connection not private, am I doing something wrong?
    – Learner120
    Jan 4 at 17:14
  • You can set up a cname from test.example.com to google.com - and indeed it sounds like that is actually working. CNAMES are only used to help convert a domain to an IP, nothing more.. HTTP (v 1.1 up) passes the name tequested in the request header and the web server often produces diffetent content bsded on tjat (name based virtual hosting) and https/ssl expands on this concept by requiring a recognised name in the certificate used by https.The connection not private likely implies the CNAME is working and Googles cert does not include test.example.com
    – davidgo
    Jan 4 at 18:46
  • To have trst.rxample.com show content of google.com id tricky. One way to do this is called "masking" which means embedding an iframe in another oage. This is frowned upon and has more and more limits because of security and IP implications of iframes.. The other way is to set up test.example.com as a reverse proxy.
    – davidgo
    Jan 4 at 18:50
  • this is very helpful! Thank you so much for all the information. I'm basically just testing my Route53 and working with records. I understand that CNAMEs can be used for this purpose (i.e. using test.example.com to route traffic to google.com). When I created this record, my dig command is working and is showing the IP of google.com but the browser isn't working. I did create a certificate in AWS for my domain name (example.com). I could setup an iFrame but I'm just playing around with records and wanted to see some actual results on my web browser.
    – Learner120
    Jan 4 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.