7
I have a client which uses our white label web application. Their url is portal.client.com. When I asked them to point the url to CNAME app.company.com, they said that it has to be an A record.
I argued that CNAME would be ideal because if we ever have ever need to change the ip address, we can just do it in one place rather than contacting each of our clients to update their DNS record, saving time and hassle for both parties.
And here is the response I got from them:
The fact that the CNAME is a URL redirect the best approach is to set an A record to the Hosting provider webserver. This provides a more secure approach as we can't guarantee that the CNAME will continue to masquerade the third party URL as far as end users are concerned on the browser level.
Now, none of that makes sense to me. First and foremost, CNAME is not a URL redirect... Can someone shine a light how or in what situation an A record would be a better or more secure approach than CNAME and if that is applicable in this case.
Thanks,
I don't understand the question. Are you saying you have a server with an IP address and portal.client.com, but you want to also access it via app.company.com? Some DNS providers provide a URL re-direct service and they might confuse that with CNAME. It can be more secure because CNAME record can point to portal.client.com, but maybe that name is hijacked and its A record changed to a Russian server? Now app.company.com will also point to the Russian server. If the IP address of app.company.com was hard-coded with an A record, it would go directly to the IP address without the added lookup. – Chloe – 2017-01-13T03:03:53.827
@Chloe portal.client.com is owned and managed by the client's IT team, we own the app.company.com. You are right that if company.com domain is hijacked, it can change the A record of app.company.com to a malicious server, but doesn't seem to be argument there. My purpose is that portal.client.com should be set as an alias of app.company.com so that we can update the IP address whenever we need to. A good scenario will be a multi region server where the IP address may be resolved differently depending on a Geo Location. – Adrian Gunawan – 2017-01-13T04:08:25.453
“The fact that the CNAME is a URL redirect” ... is wrong. It’s not. Their point about “URL masquerade” is certainly valid in a multi-tenant application, but using an A record changes nothing. Simply ask them to use
nslookup
and they will see that there is no difference whatsoever. – Daniel B – 2017-01-18T13:33:53.497