Why not a CNAME?

jg3

Hi - I'm a longtime pfSense fan here to ask about how to do something that is fairly simple in DNS generally: alias one hostname to another.

TLDR, how do I configure pfSense to resolve and return the IP of dynamic host fooNN when queried for an alias hostname of foo?

Here's an example scenario:

Within my local network ,using the TLD .localnetwork
I have a host that provides a service called "foo"
A host on my network comes up with the hostname foo20250923. So FQDN is foo20250923.localnetwork
pfSense has "DHCP Registration" ticked
pfSense DHCP server assigns IP 10.11.12.34 to the host
foo20250923.localnetwork resolves to 10.11.12.34 as it should.
Other hosts in my network who make use of the service "foo" now must all be reconfigured to use today's new hostname (or the IP address, eliminating the benefits of DNS altogether)

In this scenario, foo20250923 is just today's iteration of a host that provides the "foo" service .. I would like to be able to configure any other hosts to use an alias of foo.localnetwork for this service and let DNS simply re-direct the alias for foo to the iteration of the host to use currently.

Is there a workaround here? Or is there a reason I'm not seeing for the omission of this fairly standard DNS feature?

How can I enter this as an enhancement request for pfSense?

I realize pfSense relies on Unbound as upstream, but it looks* like this feature is supported. (* TBF I read through these docs but did not thoroughly soak in them. In any case, I'm a pfSense customer, hence posting here.)

Best,
--jg3

SteveITS

@jg3 If you had this set up on an internal DNS server using a different domain, you could create a domain override pointing to the other server, to resolve it. Which is more complex than you're asking but should work. You might try overriding just foo.localnetwork, not sure if that will work but maybe.

feature requests are at redmine.pfsense.org.

jg3

@SteveITS

Right, I'm trying to avoid running a separate DNS server, being attached to static DHCP entries, MAC addresses, or IPs. I just want to alias name2 -> name1.

Thanks for reading,
--jg3

jg3

@SteveITS

P.S. Thanks for the pointer to redmine.pfsense.org, I was able to find and attach comments to an existing enhancement request from the 2.x era, about 13 years ago which was itself a resubmission of an enhacement request from the 1.x days of pfSense, about 16 years ago. (This amuses me because that's about how long I've been using pfSense).

I think that suffices to say that this is a feature that has been long awaited, and since moving to Unbound is feasible for the first time in a long time.

johnpoz

@jg3 Not sure how you think a Response Policy Zone (RPZ) solves what your looking for?

If I understand what your asking for is you have some host that changes its name on some schedule or whenever..

foo20250923.localnetwork and gets an IP of 10.11.12.34

but say tmrw that host would be

foo20250924.localnetwork and the IP changes, now it might be 10.11.12.35

But you want to point foo.localnetwork to whatever this hosts name/ip is be it foo2025923, or 24 or 31 or 20251002 and the IP always changes??

That is not how cnames work, nor am I seeing how a rpz could solve that for you..

I am just at a loss what sort of whatever would do that? Why would you not just setup a reservation in dhcp so this instance no matter what its name it wants to use always gets say 10.11.12.100

jg3

@johnpoz

Thanks for chiming in here.

You're missing my question. I'm not looking for an RPZ (I don't know where RPZ entered the chat), I'm looking to be able to create a CNAME.

I'm afraid you might have gotten lost in my example, the point is to be able to use a consistent hostname for a given service and provide that service from a (potentially one of many) host that has been assigned a DHCP address, by simply updating the DNS alias to point to the desired host. That change is simpler and less involved than the DHCP reservation approach.

If -- and from everything I've seen confirms this -- there's no feature or practical workaround to alias DNS names in pfSense, then my request for it as an enhancement is the best way forward. And given the fact that this has long been a request, only one that was unimplemented because dnsmasq didn't support it, it's probably a good time to reevaluate it.

--jg

johnpoz

@jg3 said in Why not a CNAME?:

RPZ (I don't know where RPZ entered the chat)

that is what you linked too.

I realize pfSense relies on Unbound as upstream, but it looks* like this feature is supported.

You can for sure create a cname - but that cname that points to X fqdn, can not magically point to now Y fqdn.

If you have a host that changes its name/ip - what you should look for is just a ddns that changes the ddns name you want to point to this new IP.

Not sure why zerod in on cnames - other than cnames are a way to point to a different fqdn that you might not control what IP that fqdn points to. But I am not aware of anyway to dynamically change what fqdn a cname record points to other than via a API into the dns.. Or maybe you could script something with unbound-control.

tinfoilmatt

@johnpoz said in Why not a CNAME?:

But I am not aware of anyway to dynamically change what fqdn a cname record points to other than via a API into the dns.. Or maybe you could script something with unbound-control.

Agreed.