amazon web services - RRSet of type CNAME with DNS name foo.com. is not permitted at apex in zone bar.com

Question

I own foo.com and bar.com. I am managing both in Route53. foo.com hosts my site, and I'd like to direct traffic from bar.com to foo.com. I tried to set up a CNAME record for bar.com pointing to foo.com, but I got the error message:

RRSet of type CNAME with DNS name foo.com. is not permitted at apex in zone bar.com.

Why doesn't this work, and what can I do instead?

Answer 1

As per RFC1912 section 2.4:

 A CNAME record is not allowed to coexist with any other data.  In
 other words, if suzy.podunk.xx is an alias for sue.podunk.xx, you
 can't also have an MX record for suzy.podunk.edu, or an A record, or
 even a TXT record.  Especially do not try to combine CNAMEs and NS 
 records like this!:

           podunk.xx.      IN      NS      ns1
                           IN      NS      ns2
                           IN      CNAME   mary
           mary            IN      A

The RFC makes perfect sense as the nameserver wouldn't know whether it needs to follow the CNAME or answer with the actual record the CNAME overlaps with. bar.com is a zone therefore it implicitly has an SOA record for the bar.com name. You can't have both a SOA record and a CNAME with the same name.

However, given that SOA records are generally used only for zone maintenance, these situations where you want to provide a CNAME at the zone's apex are quite common. Even though the RFC prohibits it, many engineers would like a behaviour such as: "follow the CNAME unless the query explicitly asks for the SOA record". That's why Route 53 provides alias records. These are a Route 53 specific feature which offer the exact functionality you require. Have a look at http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/CreatingAliasRRSets.html