1

I'm using an AWS pattern to host a flat website at example.com. It goes like this:

  1. S3 bucket configured like a website

  2. CloudFront distribution pointing at the S3 bucket with an SSL certificate for the example.com

  3. Route53 hosted zone with the A record aliased to the CloudFront distribution.

This all works very well!

However:

When I have a client that needs to control their own DNS (i.e. can't use my Route53 DNS) then I have to figure out a way to configure their DNS (e.g. GoDaddy) to route traffic to my CloudFront domain.

This is a problem because GoDaddy does not allow aliasing an A record to another domain. Some do but GoDaddy doesn't. So I have to use a trick:

  1. Create a CNAME for www.example.com pointing to my CloudFront domain.

  2. Create a 'forward' to redirect 301 all requests to www.example.com.

This works a treat for HTTP requests. But HTTPS requests hang and eventually gives ERR_CONNECTION_TIMED_OUT. If I do the same thing on Enom I get ERR_ADDRESS_UNREACHABLE.

Please note that I do have a certificate and have HTTPS connections allowed on CloudFront so this is very puzzling to me.

1
  • " does not allow aliasing an A record to another domain." Which, as is, is expected since a DNS A record by design maps a name to an IP address (same for AAAA for IPv6). So you can't make appear there another domain. Jul 17 at 23:58

2 Answers 2

1

A. Create a CNAME for www.example.com pointing to my CloudFront domain.

That's all you need to do.

B. Create a 'forward' to redirect 301 all requests to www.example.com.

? From where? This makes no sense.

The only reason for Cloudfront not to respond is because you've not configured it correctly.

0

Yes yes, the cloudfront is fine and https://www.example.com resolves well.

It turns out that we needed to use an an ALIAS record which only some DNS providers support. Route53 does this which we normally use but cant for some clients.

We started using NameCheap for this reason.

5
  • 1
    Your self-answer must be wrong. Godaddy absolutely knows how to route HTTPS requests, and routing requests have nothing to do with DNS other then converting domain to IP address. ALIAS records are not real records, rather they are aritrary constructs provided by some DNS providers to flatten into A records and not part of the DNS specifications.
    – davidgo
    Jun 25 at 4:12
  • @davidgo I believe we are talking about SVCB records for http/2 and http/3, which provide a https hint along with a http/2 and http/3 hint ... example.com 3600 IN HTTPS 1 . alpn=”h3,h2” ... the proposal was put forward in 2020 datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-https-01 ... and Cloudflare is already using http/3 live blog.cloudflare.com/… ... Apache is waiting until http/3 is no longer experimental. So best practice has yet to be determined / peer reviewed. Jun 25 at 23:01
  • Support is still limited for http/3 ... Chrome, since v102 (released in May 2022), Firefox, since v92 (released in July 2021), HTTP/3 support in Safari is under an "experimental" feature flag, still as Safari v16.3 (March 2023) ... however: cloudflare.com, Google.com. Facebook.com.Youtube.com. Netflix.com. Instagram.com. Live.com. Bing.com. and Blogspot.com are all able to negotiate http/3 connections. Jun 25 at 23:13
  • @davidgo yea my accusation against godaddy might be incorrect; im no dns expert. However the symptom is true. I AM an aws expert so my cloudfront is correct. Using an alias record does the trick. I provided steps to reproduce and i invite you to try and reproduce! Im happy to clarify if needed.
    – Ted Benice
    Jun 26 at 14:18
  • @Wayne The specialization of SVCB records specifically for HTTPS are called... HTTPS records (yeah major source of confusion will happen out of this choice) and those records are already consumed by various browsers (Safari, Chrome, and Firefox depending on configuration) and published by various providers, like CloudFlare. So not a total solution right now as some clients won't see them, but already something that works solidly. Jul 18 at 0:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.