Invalid SOA record

Hi Matthias,

It is true that the mname is supposed to be “the name server that was the original or primary source” of data for this zone" (RFC 1035). However, the mname host needs not to be publicly accessible (think of hidden master setups, which is in fact what we use). Also, Internet participants are not going to care about the mname value.

There may replication systems that rely on mname, but ours doesn’t. There also may be an edge case in case we implement RFC 2136 dynamic updates; the RFC admits though that the mname host could or could not be reachable, and update clients can equally well contact any of the NS hosts.

It would be meaningless to put our hidden master’s hostname, and it would be arbitrary to prefer any one of our NS hosts in the mname. We wanted to put a value that is guaranteed to have no side effects, and given the considerable degree of freedom arising from the fact that mname is practically irrelevant, we figured it’s time for an easteregg! So, set an example, and get desec.io!

The rname value actually corresponds to an email address that is forwarded to our support mailbox.

Considering everything, we think our SOA fields are perfectly compliant, but they read much nicer than what other providers tend to put there.

Stay secure,
Peter

1 Like