CDN DNS & Domain Management 4 — Questions and Answers
Question 1: Which DNS record type is used by CDNs to publish SPF policy when the CDN sends email on behalf of a customer domain?
- TXT (Correct answer)
- MX
- SRV
- CAA
Correct answer: TXT
SPF policies are stored in TXT records and list authorized mail-sending IP ranges, including those used by CDN-hosted email services.
Question 2: What is the purpose of a CAA (Certification Authority Authorization) DNS record in a CDN deployment?
- It restricts which certificate authorities may issue TLS certificates for the domain (Correct answer)
- It maps the CDN edge IP to a hostname
- It delegates DNS authority to a CDN nameserver
- It authenticates DNSSEC signatures
Correct answer: It restricts which certificate authorities may issue TLS certificates for the domain
CAA records prevent unauthorized CAs from issuing certificates for your domain, reducing TLS hijacking risk.
Question 3: During a CDN failover, a TTL of 30 seconds on the primary A record was set in advance. What is the maximum time a client could still reach the failed origin after the DNS update?
- 30 seconds (Correct answer)
- 5 minutes
- 48 hours
- Indefinitely until browser cache clears
Correct answer: 30 seconds
Clients cache DNS responses for the duration of the TTL, so a 30-second TTL means at most 30 seconds before the new record is fetched.
Question 4: What is DNS anycast and why do CDNs use it?
- Multiple servers share the same IP; BGP routes users to the topologically nearest one (Correct answer)
- A single server responds to all DNS queries globally
- A protocol for encrypting DNS traffic in transit
- A DNS record type for load balancing
Correct answer: Multiple servers share the same IP; BGP routes users to the topologically nearest one
Anycast assigns identical IPs to multiple PoPs; BGP ensures each user's query reaches the geographically or topologically closest PoP.
Question 5: A CDN customer's subdomain media.example.com must be decommissioned, but its CNAME still points to the CDN edge. What security risk does this create?
- Subdomain takeover — an attacker can claim the CDN hostname and serve content under media.example.com (Correct answer)
- DNS amplification attacks against the authoritative server
- Increased latency due to stale CNAME resolution
- DNSSEC chain break for the parent zone
Correct answer: Subdomain takeover — an attacker can claim the CDN hostname and serve content under media.example.com
If the CDN hostname is released and an attacker re-registers it, the dangling CNAME lets them hijack the subdomain.
Question 6: Which DNS resolution mode does a CDN's authoritative DNS use to direct mobile users to edge nodes with lower latency?
- ECS (EDNS Client Subnet) — passes client IP prefix to authoritative for geo-aware responses (Correct answer)
- AXFR zone transfer
- Recursive resolution
- Reverse DNS lookup
Correct answer: ECS (EDNS Client Subnet) — passes client IP prefix to authoritative for geo-aware responses
EDNS Client Subnet (ECS) allows the recursive resolver to share the client's IP prefix so the CDN's authoritative DNS can return geo-optimized records.
Question 7: What is negative caching in DNS, and how does it affect CDN traffic routing after a configuration error?
- NXDOMAIN/NODATA responses are cached for the SOA negative TTL, delaying recovery after fixing the error (Correct answer)
- Negative caching blocks malicious DNS queries at the resolver
- It caches failed TCP connections to CDN edge nodes
- Recursive resolvers refuse to cache responses from CDN nameservers
Correct answer: NXDOMAIN/NODATA responses are cached for the SOA negative TTL, delaying recovery after fixing the error
When DNS returns NXDOMAIN or NODATA, resolvers cache that negative result for the SOA's minimum TTL, so even after fixing the record, clients may be denied temporarily.
CDN DNS & Domain Management 4
Which DNS record type is used by CDNs to publish SPF policy when the CDN sends email on behalf of a customer domain?