WEB / WEB-03.02

DNS records and aliasing

A DNS record’s type determines what its RDATA means. Read A/AAAA, a CNAME chain and NS/MX/TXT/PTR roles in one synthetic record table.

CORE · RED · BLUE · ARTIFACT · PRACTICE

Read every scenario without motion

A via two CNAMEs

Typed question ready
This scene assumes authority selection and does not repeat root/TLD. The loop case is a deliberately invalid local variant.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Authority/cache context selected
Authority + local RR data
Local record table · no query
Question reached resolver
Name/type/class are now in resolver context. Name-valued records do not all have the same resolution action.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
docs.example.org. / A / IN · query received
Authority + local RR data
Local record table · no query
Local authority selection
Delegation/server address data are initial conditions; lookup is not a transfer.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Selected authority example.org. · docs.example.org. / A / IN
Authority + local RR data
Local record table · no query
Authority received typed query
The selected query arrived at authority. Local records can now be read by type.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Selected authority example.org. · docs.example.org. / A / IN
Authority + local RR data
docs.example.org. / A / IN · query received
First local CNAME lookup
docs is the alias owner; edge is the RDATA target name. Same-zone lookup needs no new packet.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Selected authority example.org. · docs.example.org. / A / IN
Authority + local RR data
docs CNAME → edge.example.org. · path [docs]
Second local CNAME lookup
The selected normal record points edge to notes. No network arrow is drawn.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Selected authority example.org. · docs.example.org. / A / IN
Authority + local RR data
edge CNAME → notes.example.org. · path [docs,edge]
Terminal A RRset found locally
In the known finite table, notes A records are terminal data and the RRset contains two addresses.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Selected authority example.org. · docs.example.org. / A / IN
Authority + local RR data
CNAME docs→edge→notes + A [198.51.100.200,198.51.100.201]
Typed result reached resolver
The response/teaching-outcome summary is now at the resolver; the loop variant is not a real DNS packet/error representation.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Authority summary received · CNAME docs→edge→notes + A [198.51.100.200,198.51.100.201]
Authority + local RR data
CNAME docs→edge→notes + A [198.51.100.200,198.51.100.201]
Local result interpretation
Keep QTYPE-appropriate data separate from alias path. Records are not HTTP Location, user permissions or mail-delivery results.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Final result ready for question · A
Authority + local RR data
CNAME docs→edge→notes + A [198.51.100.200,198.51.100.201]
Result reached client
Delivery completed; address/name data are not the later application outcome.
Typed consumer
Typed result received · CNAME docs→edge→notes + A [198.51.100.200,198.51.100.201]
Resolver
Final result ready for question · A
Authority + local RR data
CNAME docs→edge→notes + A [198.51.100.200,198.51.100.201]

Direct AAAA RRset

Typed question ready
This scene assumes authority selection and does not repeat root/TLD. The loop case is a deliberately invalid local variant.
Typed consumer
notes.example.org. / AAAA / IN · no result
Resolver
Authority/cache context selected
Authority + local RR data
Local record table · no query
Question reached resolver
Name/type/class are now in resolver context. Name-valued records do not all have the same resolution action.
Typed consumer
notes.example.org. / AAAA / IN · no result
Resolver
notes.example.org. / AAAA / IN · query received
Authority + local RR data
Local record table · no query
Local authority selection
Delegation/server address data are initial conditions; lookup is not a transfer.
Typed consumer
notes.example.org. / AAAA / IN · no result
Resolver
Selected authority example.org. · notes.example.org. / AAAA / IN
Authority + local RR data
Local record table · no query
Authority received typed query
The selected query arrived at authority. Local records can now be read by type.
Typed consumer
notes.example.org. / AAAA / IN · no result
Resolver
Selected authority example.org. · notes.example.org. / AAAA / IN
Authority + local RR data
notes.example.org. / AAAA / IN · query received
Typed records found locally
AAAA is IPv6 address data; DNS transport family is separate. MX carries preferences, not a delivered-mail outcome.
Typed consumer
notes.example.org. / AAAA / IN · no result
Resolver
Selected authority example.org. · notes.example.org. / AAAA / IN
Authority + local RR data
AAAA [2001:db8:2::20]
Typed result reached resolver
The response/teaching-outcome summary is now at the resolver; the loop variant is not a real DNS packet/error representation.
Typed consumer
notes.example.org. / AAAA / IN · no result
Resolver
Authority summary received · AAAA [2001:db8:2::20]
Authority + local RR data
AAAA [2001:db8:2::20]
Local result interpretation
Keep QTYPE-appropriate data separate from alias path. Records are not HTTP Location, user permissions or mail-delivery results.
Typed consumer
notes.example.org. / AAAA / IN · no result
Resolver
Final result ready for question · AAAA
Authority + local RR data
AAAA [2001:db8:2::20]
Result reached client
Delivery completed; address/name data are not the later application outcome.
Typed consumer
Typed result received · AAAA [2001:db8:2::20]
Resolver
Final result ready for question · AAAA
Authority + local RR data
AAAA [2001:db8:2::20]

MX preferences

Typed question ready
This scene assumes authority selection and does not repeat root/TLD. The loop case is a deliberately invalid local variant.
Typed consumer
example.org. / MX / IN · no result
Resolver
Authority/cache context selected
Authority + local RR data
Local record table · no query
Question reached resolver
Name/type/class are now in resolver context. Name-valued records do not all have the same resolution action.
Typed consumer
example.org. / MX / IN · no result
Resolver
example.org. / MX / IN · query received
Authority + local RR data
Local record table · no query
Local authority selection
Delegation/server address data are initial conditions; lookup is not a transfer.
Typed consumer
example.org. / MX / IN · no result
Resolver
Selected authority example.org. · example.org. / MX / IN
Authority + local RR data
Local record table · no query
Authority received typed query
The selected query arrived at authority. Local records can now be read by type.
Typed consumer
example.org. / MX / IN · no result
Resolver
Selected authority example.org. · example.org. / MX / IN
Authority + local RR data
example.org. / MX / IN · query received
Typed records found locally
AAAA is IPv6 address data; DNS transport family is separate. MX carries preferences, not a delivered-mail outcome.
Typed consumer
example.org. / MX / IN · no result
Resolver
Selected authority example.org. · example.org. / MX / IN
Authority + local RR data
MX [10 mail1.example.org.,20 mail2.example.org.]
Typed result reached resolver
The response/teaching-outcome summary is now at the resolver; the loop variant is not a real DNS packet/error representation.
Typed consumer
example.org. / MX / IN · no result
Resolver
Authority summary received · MX [10 mail1.example.org.,20 mail2.example.org.]
Authority + local RR data
MX [10 mail1.example.org.,20 mail2.example.org.]
Local result interpretation
Keep QTYPE-appropriate data separate from alias path. Records are not HTTP Location, user permissions or mail-delivery results.
Typed consumer
example.org. / MX / IN · no result
Resolver
Final result ready for question · MX
Authority + local RR data
MX [10 mail1.example.org.,20 mail2.example.org.]
Result reached client
Delivery completed; address/name data are not the later application outcome.
Typed consumer
Typed result received · MX [10 mail1.example.org.,20 mail2.example.org.]
Resolver
Final result ready for question · MX
Authority + local RR data
MX [10 mail1.example.org.,20 mail2.example.org.]
Consumer interprets mail preference
Lower preference is preferred. This is local interpretation; no SMTP connection or mail sending is drawn.
Typed consumer
Mail consumer preference: mail1(10) before mail2(20)
Resolver
Final result ready for question · MX
Authority + local RR data
MX [10 mail1.example.org.,20 mail2.example.org.]

Invalid local CNAME loop

Typed question ready
This scene assumes authority selection and does not repeat root/TLD. The loop case is a deliberately invalid local variant.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Authority/cache context selected
Authority + local RR data
Local record table · no query
Question reached resolver
Name/type/class are now in resolver context. Name-valued records do not all have the same resolution action.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
docs.example.org. / A / IN · query received
Authority + local RR data
Local record table · no query
Local authority selection
Delegation/server address data are initial conditions; lookup is not a transfer.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Selected authority example.org. · docs.example.org. / A / IN
Authority + local RR data
Local record table · no query
Authority received typed query
The selected query arrived at authority. Local records can now be read by type.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Selected authority example.org. · docs.example.org. / A / IN
Authority + local RR data
docs.example.org. / A / IN · query received
First local CNAME lookup
docs is the alias owner; edge is the RDATA target name. Same-zone lookup needs no new packet.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Selected authority example.org. · docs.example.org. / A / IN
Authority + local RR data
docs CNAME → edge.example.org. · path [docs]
Second local CNAME lookup
The selected invalid variant points edge back to docs. No network arrow is drawn.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Selected authority example.org. · docs.example.org. / A / IN
Authority + local RR data
edge CNAME → docs.example.org. · path [docs,edge]
Cycle found locally
In the known finite table, a repeated owner is a cycle; no actual resolver RCODE is generated.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Selected authority example.org. · docs.example.org. / A / IN
Authority + local RR data
Cycle detected · no terminal address
Typed result reached resolver
The response/teaching-outcome summary is now at the resolver; the loop variant is not a real DNS packet/error representation.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Authority summary received · Cycle detected · no terminal address
Authority + local RR data
Cycle detected · no terminal address
Local result interpretation
Keep QTYPE-appropriate data separate from alias path. Records are not HTTP Location, user permissions or mail-delivery results.
Typed consumer
docs.example.org. / A / IN · no result
Resolver
Final result ready for question · A
Authority + local RR data
Cycle detected · no terminal address
Result reached client
Delivery completed; the CNAME cycle has no terminal address.
Typed consumer
Typed result received · Cycle detected · no terminal address
Resolver
Final result ready for question · A
Authority + local RR data
Cycle detected · no terminal address

ACTORS · STATE · DATA FLOW

Record owner and data are different fields

A Resource Record attaches type/class/TTL/RDATA to an owner name. Owner answers which name, and type answers what kind of data. Records sharing owner, class and type form an RRset. Two IPv4 addresses in the notes.example.org. A RRset do not mean two domains.

The artifact uses an explicit JSON table rather than a deployable master file. TTL 120 seconds is a selected cache bound, not an application timeout or hop count. RDATA is not uniformly text: A carries an address, CNAME a name, MX preference plus exchange, and TXT strings. Parsing all RDATA as IP ignores its type.

A and AAAA: address family is separate from transport

An IN-class A record carries a 32-bit IPv4 address; AAAA carries one 128-bit IPv6 address. The fixture gives notes.example.org A addresses 198.51.100.200 and .201 plus AAAA 2001:db8:2::20. They are distinct RRsets; an A answer alone does not determine AAAA presence.

An AAAA query can travel over IPv4 and an A query over IPv6: record address family is not DNS transport family. Selection or ordering of multiple answers requires client behavior; the fixture does not mandate using the first IP. These records describe addresses, not listening services, routes or TLS/user permissions.

CNAME owner is an alias; RDATA is the target name

For docs.example.org. CNAME edge.example.org., docs is the alias owner and edge the target. A second CNAME leads to notes.example.org. An A lookup can follow targets to the terminal A RRset. A same-zone target can be resolved locally; each alias link does not require another network exchange.

A standard CNAME does not coexist at its owner with ordinary A/AAAA/MX/TXT data; applicable DNSSEC metadata exceptions are outside this table. A zone apex with required SOA/NS therefore cannot simply host a standard CNAME too. Distinguish provider ALIAS/flattening behavior through its vendor contract rather than calling it a wire CNAME.

An alias-chain result is not an HTTP action

CNAME is DNS name indirection; it carries neither URL scheme/path/port nor HTTP status/location fields. Obtaining an address for docs does not mean a browser received an HTTP redirect response. The subsequent request’s naming and identity conditions remain at the application layer.

A valid chain reaches terminal address data. If the target is absent, the alias owner can exist while a negative result concerns the target. A docs→edge→docs loop is a deliberately invalid inert variant, not an infinite success path. The checker detects it locally without inventing production errors, retries or live queries.

NS, MX, TXT, PTR and SOA describe different roles

NS names an authority server whose address is separate A/AAAA data. MX carries exchange name and preference: 10 is preferred to 20, without guaranteeing uptime or mail delivery. Standard MX and NS targets must not be aliases. Our ns1/mail1/mail2 have direct A records.

TXT holds one or more character strings whose consumer defines semantics. course=atlas is neither a verification secret nor security policy. PTR is a name pointer in reverse namespace: 198.51.100.200 maps to owner 200.100.51.198.in-addr.arpa. Reverse data does not prove forward A ownership or TLS identity. SOA carries zone metadata; RFC2308 updated the old RFC1035 MINIMUM meaning for negative-cache lifetime.

Read every scenario without motion

Alias / rights

Record type selects interpretation
docs.example.org. CNAME edge.example.org. and edge CNAME notes.example.org. establish address indirection. The chain carries no user or tenant grant.
Record inventory
docs → edge → notes
Typed consumer
No consumer decision
Permission boundary
No grant
A type-aware contract was applied
The CNAME chain reaches the A RRset at notes. Terminal addresses and alias owners are recorded separately; adding A at a CNAME owner does not resolve a conflict.
Record inventory
docs → edge → notes
Typed consumer
Terminal A: .200,.201
Permission boundary
No grant
An unsupported permission conclusion was stopped
DNS records provide consumer-specific direction. NS indicates naming authority, PTR a reverse pointer and TXT consumer-specific text; none alone establishes application permission.
Record inventory
docs → edge → notes
Typed consumer
Terminal A: .200,.201
Permission boundary
Name-valued record ≠ grant
Reverse scope stayed separate
The separate PTR example links owner 200.100.51.198.in-addr.arpa. to notes.example.org. That reverse pointer is not a step in docs→edge→notes. Forward and reverse management scopes need not match, and PTR does not validate service identity.
Record inventory
docs → edge → notes
Typed consumer
Terminal A: .200,.201
Permission boundary
Name-valued record ≠ grant
The chain-termination condition was retained
The selected normal chain reaches two A addresses at notes. The separate docs→edge→docs loopVariant stops without a terminal address. Keep the outcomes distinct: this normal case has no repeated owner, and its addresses grant no resource access.
Record inventory
docs → edge → notes
Typed consumer
Terminal A: .200,.201
Permission boundary
Name-valued record ≠ grant
The control finished at the correct layer
Record type and terminal scope are interpreted correctly; the application separately checks intended name, TLS identity and resource policy. DNS indirection is not carried as an access token.
Record inventory
docs → edge → notes
Typed consumer
Terminal A: .200,.201
Permission boundary
Terminal A available; resource rights separate

MX consumer

Record type selects interpretation
MX preference 10/mail1 and 20/mail2 belong to mail routing. Their name-valued RDATA does not make them CNAME records.
Record inventory
MX 10/mail1,20/mail2
Typed consumer
No consumer decision
Permission boundary
No grant
A type-aware contract was applied
Lower preference is preferred: mxPriority orders mail1 then mail2. This selection does not establish successful mail delivery or a web endpoint IP.
Record inventory
MX 10/mail1,20/mail2
Typed consumer
mail1 first / delivery unknown
Permission boundary
No grant
An unsupported permission conclusion was stopped
DNS records provide consumer-specific direction. NS indicates naming authority, PTR a reverse pointer and TXT consumer-specific text; none alone establishes application permission.
Record inventory
MX 10/mail1,20/mail2
Typed consumer
mail1 first / delivery unknown
Permission boundary
Name-valued record ≠ grant
MX targets have direct address records
mail1.example.org. and mail2.example.org. have direct A records and neither is a CNAME owner. The MX exchange field is a mail-consumer target. A PTR reverse pointer or web alias chain does not replace this MX selection.
Record inventory
MX 10/mail1,20/mail2
Typed consumer
mail1 first / delivery unknown
Permission boundary
Name-valued record ≠ grant
Preference is not a delivery guarantee
mail1 has preference 10 and mail2 preference 20; the consumer prefers the lower value first. This ordering establishes neither a successful SMTP connection nor delivered mail. Target selection and actual delivery remain separate.
Record inventory
MX 10/mail1,20/mail2
Typed consumer
mail1 first / delivery unknown
Permission boundary
Name-valued record ≠ grant
The control finished at the correct layer
Type-aware MX interpretation explains preference for mail1; it is neither CNAME resolution nor a web-resource grant. Mail delivery needs separate SMTP-layer results. Do not merge a correct preference order with unobserved delivery.
Record inventory
MX 10/mail1,20/mail2
Typed consumer
mail1 first / delivery unknown
Permission boundary
mail1 preferred; delivery unknown

ASSUMPTION · BOUNDARY · CONTROL

Broken assumption: an alias grants access rights

An alias links names without conveying user or tenant rights to a target resource. A TXT string likewise does not prove correct consumer/policy processing; a security conclusion needs evidence beyond the record.

Require naming indirection to agree with intended service identity and lifecycle scope during review. Explain unsupported assumptions in the inert table without takeover or external-target validation workflows.

Broken assumption: every name-valued record is an alias

CNAME, NS, MX and PTR can all contain names but do not trigger identical resolution actions. PTR is a pointer, MX a mail-routing preference and NS a naming-authority role. A consumer following all of them as CNAME loses type semantics.

The necessary condition is type-aware processing: NS/MX targets need direct address data and MX preference follows lower-is-preferred. Scope the impact of a wrong interpretation to its required data/control conditions without reproduction on real mail or DNS services.

Broken assumption: every chain yields an address

Missing target, missing requested address type and a loop are different conditions. Adding A beside an alias is not a standard fallback for a CNAME conflict. Table review must inspect owner records and the alias path together.

Fixture loop detection is local cycle reasoning on known finite data. It is not resolver fingerprinting or domain discovery. Actual error reporting depends on implementation and complete response context.

Read every scenario without motion

RRset review

Owner and type were selected together
The alias query requests A/IN for docs.example.org. A separate AAAA query for notes.example.org. expects 2001:db8:2::20. A and AAAA are different address-family results and are not substituted.
Question evidence
docs / A / IN
Chain review
Path unread
Lifecycle review
No conclusion
Path records were read one by one
expectedPath docs→edge→notes and expectedAddresses [.200, .201] are read together. Alias steps and the terminal RRset are separate evidence pieces.
Question evidence
docs / A / IN
Chain review
docs → edge → notes
Lifecycle review
No conclusion
Termination evidence was evaluated
The notes A RRset contains two addresses; their order does not establish a preferred service or actual connection result.
Question evidence
docs / A / IN
Chain review
Terminal RRset: two A
Lifecycle review
No conclusion
Scope changes were recorded
Forward records and a separate reverse PTR illustration do not form one deployable zone file. Owner/class/type/TTL/RDATA grouping retains those management boundaries.
Question evidence
Forward zone / reverse separate
Chain review
Terminal RRset: two A
Lifecycle review
No conclusion
Valid and negative controls stay together
The normal docs chain gives terminal A, the loop gives a cycle and notes AAAA gives another family. Review must not pass by closing the valid path.
Question evidence
Forward zone / reverse separate
Chain review
Terminal RRset: two A
Lifecycle review
Valid A + AAAA + cycle controls
Uncovered outcomes remain explicit
The inventory supports record and chain semantics only. Provider change, cache provenance, mail delivery and browser TLS acceptance are not observed; actual service outcome remains UNKNOWN.
Question evidence
Forward zone / reverse separate
Chain review
Terminal RRset: two A
Lifecycle review
Record scope explicit; service unknown

Cycle review

Owner and type were selected together
The alias query requests A/IN for docs.example.org. A separate AAAA query for notes.example.org. expects 2001:db8:2::20. A and AAAA are different address-family results and are not substituted.
Question evidence
docs / A / IN
Chain review
Path unread
Lifecycle review
No conclusion
Path records were read one by one
loopVariant records supply docs→edge→docs; deliberatelyInvalid=true belongs only to this finite supplied table.
Question evidence
docs / A / IN
Chain review
docs → edge → docs
Lifecycle review
No conclusion
Termination evidence was evaluated
docs is seen a second time, with no terminal address. expectedClassification=cycle-no-terminal-address is not a measured timeout or actual DNS error.
Question evidence
docs / A / IN
Chain review
Cycle / no terminal
Lifecycle review
No conclusion
Scope changes were recorded
Forward records and a separate reverse PTR illustration do not form one deployable zone file. Owner/class/type/TTL/RDATA grouping retains those management boundaries.
Question evidence
Forward zone / reverse separate
Chain review
Cycle / no terminal
Lifecycle review
No conclusion
Valid and negative controls stay together
The normal docs chain gives terminal A, the loop gives a cycle and notes AAAA gives another family. Review must not pass by closing the valid path.
Question evidence
Forward zone / reverse separate
Chain review
Cycle / no terminal
Lifecycle review
Valid A + AAAA + cycle controls
Uncovered outcomes remain explicit
The inventory supports record and chain semantics only. Provider change, cache provenance, mail delivery and browser TLS acceptance are not observed; actual service outcome remains UNKNOWN.
Question evidence
Forward zone / reverse separate
Chain review
Cycle / no terminal
Lifecycle review
Record scope explicit; service unknown

IMPLEMENTATION · SECURITY CONTROL · VERIFICATION

Record inventory needs type and scope

Store owner/class/type/TTL/RDATA with authority scope. Keeping alias and terminal address RRsets separate reveals the chain’s names. The PTR reverse zone need not be managed by the same party as forward example.org.

This teaching artifact combines forward-zone rows with a separate reverse-zone illustration; it is not one deployable zone file. Do not force provider exports into its custom fields. Current answers, cache provenance and change times are separate observations.

Valid baselines and conflict/loop checks

The normal docs→edge→notes path reaches the terminal A RRset; an AAAA question has a separate family result. The MX case prioritizes mail1 at preference 10. NS/MX targets are not alias owners. Local grouping checks are not resolver-availability tests.

The negative loop stops without a terminal address. The standard conflict check flags CNAME alongside ordinary data at one owner. DNSSEC/provider extensions are explicitly omitted, so the checker does not judge them.

Change review: consumers and lifecycle

Review an alias change alongside terminal data, intended consumer name, TLS/application identity and cache/delegation lifecycle. MX/TXT/NS changes should not be assumed to perform the same job as a web-address change.

Read record semantics together with which owner supplied each value along the chain. This artifact uses synthetic records rather than DNS-server, mail-delivery or provider-control-panel outcomes. Correctly reading the example does not establish the same response in a real environment.

NOW APPLY IT TO THE CASE

Which decisions are not shared by the name-valued CNAME, MX and PTR records?

docs points through edge to notes and reaches its A RRset. MX records instead prioritize mail1 and mail2. Reverse PTR belongs to a separate scope; the cycle between docs and edge produces no terminal address.

Does a DNS answer establish the case’s correct book result? Separate the end of name-resolution knowledge from the start of HTTP and application observations.

Open the related case file ↗

READ THE EXAMPLE TOGETHER

Typed RR table and alias graph

Select a field and examine what it supports and where the evidence ends.

Read the raw artifact and field explanations

{
  "scope": "Original forward example.org illustration plus separately scoped reverse PTR; not a deployable zone or actual DNS answers.",
  "records": [
    {
      "owner": "example.org.",
      "class": "IN",
      "type": "NS",
      "ttl": 300,
      "rdata": "ns1.example.org."
    },
    {
      "owner": "example.org.",
      "class": "IN",
      "type": "MX",
      "ttl": 300,
      "rdata": {
        "preference": 10,
        "exchange": "mail1.example.org."
      }
    },
    {
      "owner": "example.org.",
      "class": "IN",
      "type": "MX",
      "ttl": 300,
      "rdata": {
        "preference": 20,
        "exchange": "mail2.example.org."
      }
    },
    {
      "owner": "example.org.",
      "class": "IN",
      "type": "TXT",
      "ttl": 300,
      "rdata": [
        "course=atlas",
        "purpose=synthetic"
      ]
    },
    {
      "owner": "docs.example.org.",
      "class": "IN",
      "type": "CNAME",
      "ttl": 120,
      "rdata": "edge.example.org."
    },
    {
      "owner": "edge.example.org.",
      "class": "IN",
      "type": "CNAME",
      "ttl": 120,
      "rdata": "notes.example.org."
    },
    {
      "owner": "notes.example.org.",
      "class": "IN",
      "type": "A",
      "ttl": 120,
      "rdata": "198.51.100.200"
    },
    {
      "owner": "notes.example.org.",
      "class": "IN",
      "type": "A",
      "ttl": 120,
      "rdata": "198.51.100.201"
    },
    {
      "owner": "notes.example.org.",
      "class": "IN",
      "type": "AAAA",
      "ttl": 120,
      "rdata": "2001:db8:2::20"
    },
    {
      "owner": "ns1.example.org.",
      "class": "IN",
      "type": "A",
      "ttl": 300,
      "rdata": "192.0.2.53"
    },
    {
      "owner": "mail1.example.org.",
      "class": "IN",
      "type": "A",
      "ttl": 300,
      "rdata": "192.0.2.25"
    },
    {
      "owner": "mail2.example.org.",
      "class": "IN",
      "type": "A",
      "ttl": 300,
      "rdata": "192.0.2.26"
    },
    {
      "owner": "200.100.51.198.in-addr.arpa.",
      "class": "IN",
      "type": "PTR",
      "ttl": 300,
      "rdata": "notes.example.org."
    }
  ],
  "aliasQuery": {
    "name": "docs.example.org.",
    "type": "A",
    "class": "IN",
    "expectedPath": [
      "docs.example.org.",
      "edge.example.org.",
      "notes.example.org."
    ],
    "expectedAddresses": [
      "198.51.100.200",
      "198.51.100.201"
    ]
  },
  "aaaaQuery": {
    "name": "notes.example.org.",
    "type": "AAAA",
    "class": "IN",
    "expectedAddresses": [
      "2001:db8:2::20"
    ]
  },
  "mxPriority": [
    "mail1.example.org.",
    "mail2.example.org."
  ],
  "loopVariant": {
    "deliberatelyInvalid": true,
    "records": [
      {
        "owner": "docs.example.org.",
        "type": "CNAME",
        "rdata": "edge.example.org."
      },
      {
        "owner": "edge.example.org.",
        "type": "CNAME",
        "rdata": "docs.example.org."
      }
    ],
    "expectedClassification": "cycle-no-terminal-address"
  },
  "soaSummary": {
    "owner": "example.org.",
    "mname": "ns1.example.org.",
    "rname": "hostmaster.example.org.",
    "serial": 2026100801,
    "refresh": 3600,
    "retry": 600,
    "expire": 86400,
    "minimum": 60,
    "ttl": 300
  }
}

records.owner / type / class: Keys for RRset grouping and type-specific interpretation.
records.rdata: Address, name, preference/exchange or text list depending on type.
aliasQuery.expectedPath: Terminal owner reached after two CNAME indirections.
loopVariant: Deliberately invalid inert data, not submitted to a live resolver.
soaSummary.minimum: RFC2308 negative-cache semantics, not a zone-wide lower TTL bound.

Inert partial inventory plus separate reverse PTR. No DNSSEC metadata, provider ALIAS/flattening, actual answers, wildcards, full master-file syntax, transport, mail delivery or HTTP redirects.

Two reality checks

A CNAME is an HTTP redirect.

CNAME is DNS name indirection without HTTP status/Location or URL-path data.

An AAAA query must use an IPv6 network.

DNS transport family is independent of the record family; AAAA can be queried over IPv4.

YOUR TURN

Work through this story.

Predict the outcome, find the evidence boundary, and explain it in your own words.

An A query for docs.example.org follows two CNAMEs. Does the browser URL automatically become notes.example.org?

No; address resolution is not a URL-changing redirect.
Yes; every CNAME changes browser location.

Read the explained answer

No; address resolution is not a URL-changing redirect. — The alias path reaches the terminal A RRset; browser URL/HTTP Host/service identity remain a separate context.

What ordering do MX preferences 10 and 20 define?

Selected lesson artifact fields; teaching example

records[1]: {"owner":"example.org.","class":"IN","type":"MX","ttl":300,"rdata":{"preference":10,"exchange":"mail1.example.org."}}
records[2]: {"owner":"example.org.","class":"IN","type":"MX","ttl":300,"rdata":{"preference":20,"exchange":"mail2.example.org."}}
mxPriority: ["mail1.example.org.","mail2.example.org."]

mail1 is preferred first; actual delivery is not measured.
mail2 definitely receives delivery because 20 is larger.

Read the explained answer

mail1 is preferred first; actual delivery is not measured. — 10 is the lower preference. Mail-exchanger selection does not prove successful SMTP delivery.

Explain the docs→edge→docs loop variant and why it supplies no terminal address result.

Read the explained answer

CNAME traversal goes from docs to edge and back to docs. This deliberately-invalid fixture never reaches a terminal A/AAAA record and is classified cycle-no-terminal-address. It does not observe a real resolver’s exact error response or HTTP behavior.

□ I distinguished a cycle from a terminal address.

□ I did not invent a real resolver error output.

Open the application console · request / response / browser

Also open request, URL, cookie and DOM examples

Sources and scope

RFC 1035 — DNS specification3.3.1 CNAME · 3.3.9 MX · 3.3.11 NS · 3.3.12 PTR · 3.3.13 SOA · 3.3.14 TXT · 3.4.1 A · 3.5 IN-ADDR.ARPA · 4.1.1 Header · 4.1.2 Question · 4.1.3 Resource record
RFC 1034 — DNS concepts2.2 DNS design goals · 3.1 Namespace specifications and terminology · 3.6.2 Aliases and canonical names · 4.2 How the database is divided into zones · 4.3.1 Queries and responses · 4.3.2 Algorithm · 5.3.1 Stub resolvers
RFC 2181 — DNS clarifications5.1 RRsets · 8 Time to Live · 10.1 CNAME resource records · 10.2 PTR records · 10.3 MX and NS records
RFC 3596 — DNS IPv6 extensions1 Introduction: transport independent of RR address family · 2.1 AAAA record type · 2.2 AAAA data format · 2.5 IP6.ARPA Domain · 3 Modifications to existing query types
RFC 2308 — DNS negative caching2.1 Name Error · 2.2 No Data · 3 Negative Answers from Authoritative Servers · 4 SOA Minimum Field · 5 Caching Negative Answers
RFC 2606 — Reserved example domains3 Reserved Example Second Level Domain Names
RFC 5737 — Documentation IPv43 Documentation Address Blocks
RFC 3849 — Documentation IPv62 Documentation IPv6 Address Prefix

YOUR NOTES / THIS BROWSER

DNS records and aliasing

1. Core · Mechanism

A via two CNAMEs

Direct AAAA RRset

MX preferences

Invalid local CNAME loop

Record owner and data are different fields

A and AAAA: address family is separate from transport

CNAME owner is an alias; RDATA is the target name

An alias-chain result is not an HTTP action

NS, MX, TXT, PTR and SOA describe different roles

2. Red · Trust & Impact

Alias / rights

MX consumer

Broken assumption: an alias grants access rights

Broken assumption: every name-valued record is an alias

Broken assumption: every chain yields an address

3. Blue · Secure development & defense

RRset review

Cycle review

Record inventory needs type and scope

Valid baselines and conflict/loop checks

Change review: consumers and lifecycle

Which decisions are not shared by the name-valued CNAME, MX and PTR records?

Two reality checks

An A query for docs.example.org follows two CNAMEs. Does the browser URL automatically become notes.example.org?

What ordering do MX preferences 10 and 20 define?

Explain the docs→edge→docs loop variant and why it supplies no terminal address result.

Sources and scope