16

I use Route53 for DNS and want to prevent the use of a CNAME record for an untrusted domain.

For example, I have three domains:

  • master.com
  • test1.com
  • test2.com

master.com has the A records:

  • test1.com is a CNAME to master.com
  • test2.com is a CNAME to master.com

I want to protect master.com and prevent creation of CNAME for another domains (except test1.com and test2.com)

How can I do this?

4
  • 9
    Why do you think anybody has a reason to do it, and why do you care?
    – Jan Hudec
    Aug 25, 2019 at 11:30
  • @JanHudec: Perhaps somebody's trying to carry out a DNS rebinding attack on the OP's site, and the OP would like to prevent that. (Of course, DNS rebinding can be done without using any CNAME records anyway, so forbidding them would not be sufficient even if it was possible.) Aug 26, 2019 at 11:18
  • You cannot prevent that technically. You might be able to sue with legal help if it infringes on your trademarks or impersonates you (however it’s internationally a hard thing to succeed). You can also inform abuse department of source provider if you suspect abuse.
    – eckes
    Aug 26, 2019 at 14:16
  • @IlmariKaronen, ok, that's a valid concern—best handled by checking the Host: header and/or using TLS (which always checks the host name).
    – Jan Hudec
    Aug 26, 2019 at 17:30

2 Answers 2

30

DNS does not support this. It doesn't matter what DNS provider you use, because creating a CNAME record is done entirely at the 'source' domain and does not contact the 'target' at all. So a domain can publish any DNS records with any data.

The only thing you can do – when dealing with HTTP(S), TLS-SNI, and other protocols which support virtual hosts – is to make sure your server rejects all requests for unknown vhosts.

5
  • make sure your server rejects all requests for unknown vhosts...I'm curious, how does this help if a CNAME record is pointing to a valid hostname? Aug 24, 2019 at 16:51
  • 19
    @twisty a cname doesnt change the domain sent to server for vhost determination. So if I cnamed example.com to your master.com the browser would still present example.com as the domain used to your webserver. Your server could then reject that request.
    – kicken
    Aug 24, 2019 at 17:12
  • 4
    This is how many CDNs work -- thousands of website domains are CNAME'd to the same CDN servers, but the TLS and HTTP host headers still have the original domain that the user typed in. Aug 25, 2019 at 6:26
  • 3
    It should also be mentioned that it is the original hostname that is validated against any TLS certificate, so if the server serves everything over TLS (HTTPS, WSS etc.; as is becoming standard), it will come up as untrusted when accessed over any such rogue CNAME.
    – Jan Hudec
    Aug 25, 2019 at 11:28
  • 1
    @JanHudec the attacker could also just create a reverse proxy, which he provides under his own domain, but which directs all requests to the OPs domain, effectively creating the same effect, but also serving his own certificate. And all without any CNAME records.
    – Falco
    Aug 27, 2019 at 7:48
19

You cannot prevent someone from creating a CNAME record that points to your domain any more than you can prevent someone from telling their friends to call your telephone number.

A CNAME record is like leaving a recording on an answering machine that tells you to call a different number. For example, you call 555-1111 and the message says, "Call 555-2222." In the same way, a CNAME record for www.example.com can point to www.yourdomain.com. When the DNS client looks up www.example.com and encounters the CNAME record, it restarts the DNS lookup process for www.yourdomain.com...as if it had been trying to look up www.yourdomain.com in the first place.

Since you don't control the domain where the CNAME record is created, and because you cannot distinguish between lookups of your domain records that originated because of CNAME records versus native lookups, you cannot prevent CNAME records from pointing to you, any more than you could prevent someone from leaving a message on their own answering machine telling callers to call your number instead.

1
  • 1
    Or any more so than I can prevent numbskulls with names similar to mine from putting my email address on important things they sign up for. I've gotten car maintenance notifications in California (a VW) and Ohio (a Toyota), restaurant reservations in the Philippines, college scholarship inquiries from Missouri, a sports newsletter from the Netherlands, and probably several others I'm forgetting. I live in New England. But that doesn't allow those people to impersonate me; if anything, it allows me to impersonate them!
    – Doktor J
    Aug 26, 2019 at 20:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .