RFC 2219

Use of DNS Aliases for Network Services ✨

Okay bestie, let's start with the title block 🎀 This one is RFC 2219, a Best Current Practice (that's BCP 17!), from the Network Working Group. It was written by M. Hamilton (Loughborough University) and R. Wright (Lawrence Berkeley Laboratory), and it's dated October 1997. The block doesn't list anything it obsoletes or updates, so no drama there 💅

Status of This Memo 📜

This document is an Internet Best Current Practice for the Internet Community 🌈 It also asks people to discuss it and send in suggestions for improvements. Distribution of this memo is unlimited, so share away 🦋

Abstract 🌸

Using symbolic names (usually CNAMEs) in the Domain Name Service (DNS - [RFC-1034, RFC-1035]) to point at network services has become super common 💖 Think anonymous FTP [RFC-959] servers, Gopher [RFC-1436] servers, and most notably World-Wide Web HTTP [RFC-1945] servers. It's honestly so useful for a bunch of reasons. It lets you move a service from one machine to another without anyone noticing, and it gives people or programs a way to find out that an organization runs, say, a World-Wide Web server ✨

Even though basically everyone does this, there's no standards document or similar spec for these commonly used names. This document is here to fix that 🫶 It collects the existing "folklore" about naming conventions, and it proposes a mechanism for making room for new protocols.

It's important to know that these naming conventions aren't a complete long-term fix for finding a particular network service for a site 👀 Other IETF working groups are working on the long-term solution, such as the Server Location Resource Records (DNS SRV) [RFC-2052] work.

1. Rationale 💜

So to find the network services offered at a particular Internet domain, you've got a choice to make. You can pick from a growing pile of centralized databases (usually Web or Usenet News "wanderers"), or you can try to infer what services exist from whatever DNS information happens to be there. The first option isn't practical in some cases, especially when the thing looking for service info is a program 🤖

The most visible example of the second option is World-Wide Web HTTP servers. It's common practice to stick "http://www." in front of an organization's domain name to reach its Web site. For example, you take "hivnet.fr" and end up at "http://www.hivnet.fr". Some popular World-Wide Web browsers have even built in automatic support for this domain name expansion 😭

Ideally, the DNS or some complementary directory service would let programs figure out automatically which network services a particular Internet domain offers, which protocols deliver them, and other technical info. Sadly, even though lots of work has gone into directory service technologies and into defining new DNS resource record types for this, there's no widely agreed upon or widely deployed solution. The exception is a small number of cases 🥺

The first case is where the DNS already has a lookup capability for the info you want. For example, Mail Exchanger (MX) records specify how mail to a particular domain should be routed [RFC-974]. Start of Authority (SOA) records make it possible to figure out who's responsible for a given domain. Name Server (NS) records show which hosts provide DNS name service for a given domain 💅

The second case is where the DNS doesn't have an appropriate lookup capability, but there's a widely accepted convention for finding the info anyway. Text (TXT) [RFC-1035] records have been used in this situation, but in the vast majority of cases a Canonical Name (CNAME) or Address (A) record pointer is used to point at the host or hosts providing the service. This document proposes a slight formalization of this well-known alias approach 🎀

Also, the DNS has a Well Known Services (WKS) [RFC-1035] lookup capability, which makes it possible to find the network services offered at a given domain name. In practice, though, it isn't widely used, maybe because there's no suitable programming interface. The Host Requirements specification [RFC-1123] deprecated using WKS for mail routing in favour of the MX record. In the long term, it's conceivable that SRV records will replace both WKS and MX 🦋

2. A generic framework 🧚

Our approach to aliases for protocols is pretty straightforward ✨ We define a standard set of DNS aliases for the most popular network services that exist right now (see the "Special Cases" section below). For protocols that aren't explicitly listed in this document, the protocol specification must propose a name.

3. Special cases 🍓

Here's the list of special cases, bestie 💖

Special Cases:
     -----------------------------------------------------------
     Alias     Service
     -----------------------------------------------------------
     archie    archie [ARCHIE]
     finger    Finger [RFC-1288]
     ftp       File Transfer Protocol [RFC-959]
     gopher    Internet Gopher Protocol [RFC-1436]
     ldap      Lightweight Directory Access Protocol [RFC-1777]
     mail      SMTP mail [RFC-821]
     news      Usenet News via NNTP [RFC-977]
     ntp       Network Time Protocol [RFC-1305]
     ph        CCSO nameserver [PH]
     pop       Post Office Protocol [RFC-1939]
     rwhois    Referral WHOIS [RFC-1714]
     wais      Wide Area Information Server [RFC-1625]
     whois     NICNAME/WHOIS [RFC-954]
     www       World-Wide Web HTTP [RFC-1945]
     -----------------------------------------------------------

4. (Ab)Use of the DNS as a directory service 🙈

Because these common aliases are used so widely, it's sometimes possible to "guess" the domain names tied to an organization's network services. That's getting harder, though, as more organizations register in the DNS 😅

Implementors should understand that a DNS entry like this:

www.hivnet.fr

does not count as registering a World-Wide Web service ⚠️ There's no requirement that the domain name resolves to an IP address or addresses. There's no requirement that a host is listening for HTTP connections, or that, if it is, the HTTP server runs on port 80. And even if all of that is true, there's no guarantee the World-Wide Web server will be willing to honor requests from arbitrary clients 💀

Okay, the aliases are still useful "hints" about the services offered, though. We propose that they be taken in that spirit 🫶

The conventions in this document are basically only useful when the organization's domain name can be determined, for example from some external database. A number of groups, the IETF included, have been working on ways to find domain names from info like organization name, location, and business type. Hopefully one or more of these will eventually let us add a more generalized search and retrieval capability on top of the basic DNS lookup service 👑

5. DNS server configuration 🌈

While directory service technology and more DNS resource record types are still being developed, domain name administrators are encouraged to use these common names for the network services they run. It makes it easier for outsiders to find info about your organization, and it also makes it easier for you to move services from one machine to another 🎀

There are two conventional ways to create these DNS entries 💅 The first is to add a single CNAME record to your DNS server's configuration, like this:

ph.hivnet.fr. IN CNAME baby.hivnet.fr.

In this setup, there should be no info about ph.hivnet.fr in the DNS other than that CNAME record. For example, ph.hivnet.fr could not contain an MX record 🙅

The alternative is to create an A record for each of the IP addresses associated with ph.hivnet.fr, like this:

ph.hivnet.fr. IN A 194.167.157.2

It's not a simple case of CNAMEs being better than A records. Each site has it's own set of requirements that might make one approach better than the other 🤔 RFC 1912 [RFC-1912] talks about some of the configuration issues involved in using CNAMEs.

Recent DNS server implementations have a "round-robin" feature that makes the host's IP addresses come back in a different order each time the address is looked up 🔁

Some network clients are starting to show up that use heuristics to pick an address when they hit a host with multiple addresses. For example, they might pick the one with the shortest round-trip-time ⚡ So if a server is mirrored (replicated) at a number of locations, it may be desirable to list the mirror servers' IP addresses as A records of the primary server. This is only likely to be appropriate if the mirror servers are exact copies of the original server 🪞

6. Limitations of this approach 🚧

Some services need the client to have more info than just the server's domain name. For example, an LDAP client needs to know a starting search base within the Directory Information Tree to have a meaningful dialogue with the server. This document doesn't try to address that problem 🤷‍♀️

7. CCSO service name 📞

Right now there are at least three different aliases commonly used for the CCSO nameserver: "ph", "cso" and "ns". It would seem to be in everyone's interest to narrow the choice down to a single name ✨ "ns" would seem to be the best choice since it's the most commonly used name. However, "ns" is also used by DNS to point to the DNS server. In fact, the most prevalent use of "ns" is to name DNS servers. For this reason, we suggest "ph" as the best name to use for CCSO nameservers 💜

Sites with existing CCSO servers using some of these aliases might find it desirable to use all three. This increases the likelihood of the service being found 🍓

As noted earlier, implementations should be resilient in the event that the name doesn't point to the expected service 🛡️

8. Security Considerations 🔐

Okay, this part is serious, bestie 😭 The DNS is open to many kinds of "spoofing" attacks, and it can't be guaranteed that the result of a DNS lookup is the genuine info. Spoofing might look like a denial of service, such as directing the client to a non-existent address, or like a passive attack, such as an intruder's server masquerading as the legitimate one 🚨

Work is ongoing to fix this for the DNS [RFC-2065]. In the meantime, you should know that stronger authentication mechanisms, such as public key cryptography with large key sizes, are a pre-requisite if the DNS is being used in any sensitive situations 🔑 Examples include on-line financial transactions and any situation where privacy is a concern, such as querying medical records over the network. Strong encryption of the network traffic may also be advisable to protect against TCP connection "hijacking" and packet sniffing 🕵️‍♀️

Part 2 is coming next, so stay tuned 🦋💖

9. Conclusions 🎀

okay so the service names in this doc are like, a sensible starter pack of defaults 🧚 you can totally use them to figure out which hosts offer which services for a given domain name. no cap, super helpful ✨

BUT 😭 the doc also calls out a few exceptions. some services are just inherently not a good fit for this whole approach, and others already have a big installed base using their own aliases, so yeah, those ones are kinda their own thing 💅

10. Acknowledgements 🫶

big thank you to Jeff Allen, Tom Gillman, Renato Iannella, Thomas Lenggenhager, Bill Manning, Andy Powell, Sri Sataluri, Patrik Faltstrom, Paul Vixie and Greg Woods 💖 they all left comments on draft versions of this doc, iconic of them 🌸

this work was supported by UK Electronic Libraries Programme (eLib) grant 12/39/01, the European Commission's Telematics for Research Programme grant RE 1004, and U. S. Department of Energy Contract Number DE-AC03-76SF00098 🌈

11. References 📚

RFC documents live at <URL:ftp://ftp.internic.net/rfc> and a bunch of mirror sites 🦋

• [ARCHIE] A. Emtage, P. Deutsch. "archie - An Electronic Directory Service for the Internet", Winter Usenix Conference Proceedings 1992. Pages 93-110. 🍓
• [PH] R. Hedberg, S. Dorner, P. Pomes. "The CCSO Nameserver (Ph) Architecture", Work in Progress. 🧚
• [RFC-768] Postel, J., "User Datagram Protocol", STD 6, RFC 768, August 1980. 💜
• [RFC-793] Postel, J., "Transmission Control Protocol", STD 7, RFC 793, September 1981. 💜
• [RFC-821] Postel, J., "Simple Mail Transfer Protocol", STD 10, RFC 821, August 1982. 💜
• [RFC-954] Harrenstien, K., Stahl, M., and E. Feinler, "NICNAME/WHOIS", RFC 954, October 1985. 💜
• [RFC-959] Postel, J., and J.K. Reynolds, "File Transfer Protocol", STD 9, RFC 959, October 1985. 💜
• [RFC-974] Partridge, C., "Mail routing and the domain System", STD 14, RFC 974, January 1986. 💜
• [RFC-977] Kantor, B., and P. Lapsley, "Network News Transfer Protocol", RFC 977, February 1986. 💜
• [RFC-1034] Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, November 1987. 💜
• [RFC-1035] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, November 1987. 💜
• [RFC-1123] Braden, R., "Requirements for Internet hosts - application and support", STD 3, RFC 1123, October 1989. 💜
• [RFC-1288] Zimmerman, D., "The Finger User Information Protocol", RFC 1288, December 1992. 💜
• [RFC-1305] Mills, D., "Network Time Protocol (Version 3) Specification, Implementation", RFC 1305, March 1992. 💜
• [RFC-1436] Anklesaria, F., McCahill, M., Lindner, P., Johnson, D., Torrey, D., and B. Albert, "The Internet Gopher Protocol (a distributed document search and retrieval protocol)", RFC 1436, March 1993. 💜
• [RFC-1590] Postel, J., "Media Type Registration Procedure", RFC 1590, March 1994. 💜
• [RFC-1625] St. Pierre, M., Fullton, J., Gamiel, K., Goldman, J., Kahle, B., Kunze, J., Morris, H., and F. Schiettecatte, "WAIS over Z39.50-1988", RFC 1625, June 1994. 💜
• [RFC-1700] Reynolds, J.K., and J. Postel, "ASSIGNED NUMBERS", STD 2, RFC 1700, October 1994. 💜
• [RFC-1714] Williamson, S., and M. Kosters, "Referral Whois Protocol (RWhois)", RFC 1714, November 1994. 💜
• [RFC-1777] Yeong, W., Howes, T., and S. Kille, "Lightweight Directory Access Protocol", RFC 1777, March 1995. 💜
• [RFC-1912] Barr, D., "Common DNS Operational and Configuration Errors", RFC 1912, Feburary 1996. 💜
• [RFC-1939] Myers, J., and M. Rose, "Post Office Protocol - Version 3", STD 53, RFC 1939, May 1996. 💜
• [RFC-1945] Berners-Lee, T., Fielding, R., and H. Nielsen, "Hypertext Transfer Protocol -- HTTP/1.0", RFC 1945, May 1996. 💜
• [RFC-2052] Gulbrandsen, A., and P. Vixie, "A DNS RR for specifying the location of services (DNS SRV)", RFC 2052, October 1996. 💜
• [RFC-2065] Eastlake, D., and C. Kaufman, "Domain Name System Security Extensions", RFC 2065, January 1997. 💜

12. Authors' Addresses 🌟

Martin Hamilton Department of Computer Studies Loughborough University of Technology Leics. LE11 3TU, UK

EMail: m.t.hamilton@lut.ac.uk

Russ Wright Information & Computing Sciences Division Lawrence Berkeley National Laboratory 1 Cyclotron Road, Berkeley Mail-Stop: 50A-3111 CA 94720, USA

EMail: wright@lbl.gov

the end, bestie 🦋✨ you made it through the whole thing 👑