Examkin

Question

Difficulty: HardDNS Infrastructure and Record Types

A network administrator is configuring DNS infrastructure for an enterprise web application hosted behind a cloud provider's elastic load balancer. The administrator must map the organization's root domain apex (`example.com`) to the load balancer's domain name (`lb-prod-948201.cloudprovider.net`). When attempting to create a CNAME record for `example.com`, the primary DNS server fails to commit the change. The administrator executes the following diagnostic query against the local authoritative DNS server:

text
$ dig @192.168.1.10 example.com SOA +noall +answer +authority
;; ANSWER SECTION:
example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. 2026072701 7200 3600 1209600 3600

;; AUTHORITY SECTION:
example.com. 3600 IN NS ns1.example.com.

Which of the following DNS record implementations will successfully map the root domain apex to the cloud load balancer hostname without violating standard DNS specifications?

  1. An ALIAS (or ANAME) record at the zone apex, which dynamically resolves the target hostname to IP addresses for incoming client queries.Answer
  2. B
    A standard CNAME record at the zone apex after removing the existing SOA and NS records to prevent resource record coexistence conflicts.
  3. C
    A SRV record at the zone apex configured to route all HTTP traffic to the load balancer domain over TCP port 53.
  4. D
    A PTR record at the zone apex mapping `example.com` directly to port 443 on the load balancer host.

Answer

An ALIAS (or ANAME) record at the zone apex, which dynamically resolves the target hostname to IP addresses for incoming client queries.
The DNS specification (RFC 1034 section 3.6.2) mandates that if a CNAME record is present at a host label, no other resource records (such as MX, A, SOA, or NS) can exist for that same label. Because every DNS zone root (apex) must contain SOA and NS records, a standard CNAME record at `example.com` is invalid. Modern DNS providers offer virtual or synthetic record types—commonly called ALIAS or ANAME records—that simulate CNAME functionality at the zone apex by dynamically resolving the target domain's IP addresses and returning A/AAAA records to querying clients.

Step-by-Step Solution

1
Analyze the DNS RFC requirement for CNAME coexistence at the zone apex.
According to RFC 1034, a CNAME record cannot coexist with any other record types for the same label. Because a zone apex MUST contain SOA and NS records, a standard CNAME record cannot be placed at `example.com`.
Placing a standard CNAME at the apex creates structural conflicts with the SOA and NS records essential for domain operation.
2
Evaluate technical mechanisms designed to overcome zone apex CNAME limitations.
DNS providers implement synthetic or virtual record types (such as ALIAS, ANAME, or CNAME flattening) that allow a hostname target at the root apex.
The authoritative DNS server resolves the target hostname (`lb-prod-948201.cloudprovider.net`) to its underlying IP addresses on the backend and responds to clients with standard A or AAAA records.
3
Select the compliant record type that satisfies the application requirements.
Deploying an ALIAS (or ANAME) record maps `example.com` to the load balancer hostname without violating DNS specifications.
This maintains RFC compliance for SOA/NS records while fulfilling the dynamic host mapping requirement.

Key Concept

DNS Zone Apex Restrictions and ALIAS/ANAME Records
Estimated Time:2m 0s
Rate this question

Topics

DNS Infrastructure and Record Types

More questions from this topic