0

I have one domain example.com which is associated with four public IP address. I want to hide my four public IPs during dig/host etc. Should I use CNAME to hide my original public IP's?

What will be the pros and cons if I choose CNAME?

Example:

MacBook-Pro-4:~ Raj$ dig example.com

; <<>> DiG 9.10.6 <<>> example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5974
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;example.com        IN  A

;; ANSWER SECTION:
example.com.    60  IN  A   22.11.33.111
example.com.    60  IN  A   22.11.33.112
example.com.    60  IN  A   22.11.33.113
example.com.    60  IN  A   22.11.33.114
  • 1
    Why do you want to hide the IP address? – HazardousGlitch Jan 11 at 12:17
4

Using CNAME will simply redirect your name to different FQDN which should in turn resolve to IP address (possibly the same you are pointing to directly right now).

There is no way to hide your IP address if you want the site to be reachable. One way or another, the name must finally resolve to the address.

3

If you intend to accept direct connections over the Internet at your public IP addresses, then you cannot hide them, else other computers on the Internet won't be able to communicate with the computers at those IP addresses.

CNAME records don't hide IP addresses. They are used to create aliases for other DNS entries. When a DNS lookup encounters a CNAME record it causes the DNS resolution process to "start over" using the name returned by the CNAME record.

For example, suppose you may have a CNAME record named alias.example.com pointing to the name server.example.com. When a user accesses alias.example.com, their DNS resolver will:

  1. Look up alias.example.com
  2. Encounter the CNAME record
  3. Start a new lookup for the name server.example.com
  4. Obtain the IP address of server.example.com

In the end, the IP address of server.example.com must be revealed an order for communication to occur over the Internet.

  • How Akami is hiding A record "MacBook-Pro-4:~ Raj$ host akami.com akami.com mail is handled by 5 alt1.aspmx.l.google.com. akami.com mail is handled by 1 aspmx.l.google.com. akami.com mail is handled by 10 aspmx2.googlemail.com. akami.com mail is handled by 10 aspmx3.googlemail.com. akami.com mail is handled by 5 alt2.aspmx.l.google.com." – AL-Linux-AWS Jan 11 at 11:56
  • MacBook-Pro-4:~ raj$ dig akami.com ; <<>> DiG 9.10.6 <<>> akami.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47181 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;akami.com. IN A ;; AUTHORITY SECTION: akami.com. 10800 IN SOA prod-unix-extdns04.akamai.com. hostmaster.akamai.com. 2012011701 259200 21600 15724800 1209600 – AL-Linux-AWS Jan 11 at 11:57
  • Is there any service like site-shied from Akami to hide the A record ? – AL-Linux-AWS Jan 11 at 11:59
  • Services such as this essentially proxy your traffic. But if you set up something like this, you would own the proxy to which the remote users connect, bringing you full circle back to hosting servers on IP addresses directly accessed by remote users. – Twisty Impersonator Jan 11 at 13:30

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.