2

I am aware of explicitly defined DNS resource records are matched before any wildcard records. But how could I exclude a single subdomain from a wildcard without creating an explicit resource record for it?

I am using this for mail autodiscovery according to the Microsoft/Outlook scheme where the autodiscover resource record takes precedence over the _autodiscover._tcp SRV resource record. The autodiscover is no viable solution for us (as it would require to maintain a separate SSL certificate for each customer domain). If there is a wildcard CNAME in place, Outlook would still lookup autodiscover.mydomain.com instead of respecting the SRV record alternative.

_autodiscover._tcp  300 IN  SRV 0 0 443 maildiscovery.example.com.
*       900 IN  CNAME   web.example.com.

To exclude autodiscover from the wildcard record, I cannot specify a RR for autodiscover as this one should not exist at all. So, there either must be a "void" type of RR (some kind of "explicit NXDOMAIN" record) or regex support for such a wildcard record.

The wildcard record is needed as we provide our customers with a quick way to add/remove subdomains without waiting for the DNS records to get propagated.

I hope there is a solution for this problem in Bind9. Thanks.

Philip Iezzi
  • 21
  • 1
  • I don't think this is possible. Why can't you get a cert for autodiscover.xxx.xxx for all your clients? Let's Encrypt is free and you can automate it. DNS propegation really shouldn't be much of an issue either, it doesn't take that long... also how would that speed up provisioning? Do you only have a single node with a single IP that every record points to? – Dylan Knoll Apr 25 '17 at 20:33
  • Maintaining several hundreds of additional Let's Encrypt certificates in my eyes is still more costly than giving up that wildcard CNAME solution. We chose to provision subdomains by creating explicit CNAMEs and lowering NCACHE on all customer zones, then using `_autodiscover._tcp SRV` as proposed. I'm quite happy with that workaround but still find it a pity there was no real solution for this in Bind/DNS. – Philip Iezzi Jun 06 '17 at 13:39

0 Answers0