What came first: the CNAME or the A record? (blog.cloudflare.com)

Article summary

A routine update to Cloudflare's 1.1.1.1 DNS service caused a wave of DNS resolution failures due to a subtle change in the order of records within DNS responses. The change, intended to reduce memory usage, resulted in CNAME records appearing after A records, which broke some DNS client implementations that expect CNAME records to appear first. The issue was caused by a 40-year-old protocol ambiguity that makes the 'correct' order of a DNS response difficult to define. The problem was resolved by reverting the change.

Main themes

• DNS protocol ambiguity
• Cloudflare 1.1.1.1 update
• CNAME record ordering
• DNS client implementations
• Testing and validation

What commenters say

• The DNS protocol's ambiguity is a fundamental problem that will continue to cause issues until it is addressed.
• Postel's Law, which suggests being liberal in what you accept, can be harmful and lead to unexpected behavior.
• Some argue that accepting extra random bytes in places can be just as harmful as accepting ill-defined syntax.
• Others believe that warnings are ineffective and that it's better to fail fast when encountering malformed data.
• The issue highlights the importance of comprehensive testing, including integration tests with DNS infrastructure.
• The problem could have been avoided if Cloudflare had observed the behavior of other public DNS resolvers and tested their change more thoroughly.
• Some argue that the engineer's decision to change the order of records without thorough testing was a mistake and an attempt to deflect blame.
• Others believe that the issue is a result of the complexity of working with massive infrastructure and the difficulty of predicting all possible edge cases.