TL;DR
['Recent changes at 1.1.1.1 altered the order of CNAME records in DNS responses, causing resolution failures for certain clients due to ambiguities in RFCs and implementation discrepancies.']
What happened
["A recent update to Cloudflare's DNS resolver 1.1.1.1 inadvertently changed the sequence of CNAME records in DNS replies.", 'This alteration led to incorrect DNS resolution for some users, resulting from discrepancies between different DNS resolver implementations and ambiguities in RFC standards.']
Why it matters for ops
['DNS resolvers often interpret the order of resource records differently, leading to inconsistencies when a change alters this order.', "The ambiguity in DNS standards allows for varied interpretations by different software, causing unexpected behavior when one component's interpretation changes."]
Mitigation
- Review and potentially update local DNS resolution configurations to align with standard practices
- Monitor for unexpected behavior related to DNS record ordering
Action items
- Check DNS resolver implementations for any reliance on a specific CNAME record sequence
- Update resolver software according to vendor recommendations
Detection IOCs
- Increased failure rates of DNS lookups returning CNAME records
- Logs showing discrepancies between expected and actual record order in DNS responses
Source link
https://blog.cloudflare.com/cname-a-record-order-dns-standards/