what do you mean "Resolves fine for non-wildcards"? It has the same behavior for non-wildcards and w

what do you mean "Resolves fine for non-wildcards"? It has the same behavior for non-wildcards and wildcards pointing to proxied records as far as I can see, still resolves fine for mailserver lookups: https://mxtoolbox.com/SuperTool.aspx?action=mx%3aok.mx-test.yarn.network&run=toolpage

MxToolbox

Network Tools: DNS,IP,Email

Ccraftxbox Just a curious question, Is it possible to register subdomains with cloudflare d...

ChaikaOP•9/6/24, 2:59 AM

Business can do subdomains (partial zones) with CNAMEs as long as the underlying domain isn't using Cf DNS, and ENT can do partial zones with Nameserver delegation regardless of underlying DNS.
Other then that you can use CF For SaaS (SSL/TLS -> Custom Hostnames), free has 100 included, it can kind of work but is a bit hacky of a setup

CChaika what do you mean "Resolves fine for non-wildcards"? It has the same behavior for...

Idle•9/6/24, 3:00 AM

Also the rfc on wildcard mx entries specifically discourages the use of them xd

Idle•9/6/24, 3:00 AM

which makes a lot of sense

Ccraftxbox sadly i don't think my budget of 5$ can afford enterprise 😅

ChaikaOP•9/6/24, 3:01 AM

well you have the CF For SaaS option even on free but it's hacky, can only have one origin server for all on them on free and it basically proxies the subdomain's traffic through that existing zone and it runs through your rules/etc within that zone

Mmia this checker doesn't perform a recursive lookup, and trusts the hint, other mail...

Idle•9/6/24, 3:05 AM

https://www.rfc-editor.org/rfc/rfc4592#section-2.2.1

Idle•9/6/24, 3:06 AM

do you use a arbitrarily large number of subdomains for your mail service?

Idle•9/6/24, 3:06 AM

otherwise I would recommend adding an entry for each

Idle•9/6/24, 3:06 AM

Mmia either way this is still a cloudflare bug

Idle•9/6/24, 3:07 AM

this was already declined

Mmia no I need a catchall

Idle•9/6/24, 3:07 AM

a catchall for what

Idle•9/6/24, 3:07 AM

(it's not a bug)

Idle•9/6/24, 3:08 AM

Idle•9/6/24, 3:08 AM

helps to pay attention to the people that respond to your question

ChaikaOP•9/6/24, 3:08 AM

I thought he was talking just about the fact it randomly doesn't work because _ isn't valid for hostnames in some systems, it seems that wasn't entirely what he was talking about

Idle•9/6/24, 3:09 AM

Mmia either way this is still a cloudflare bug

ChaikaOP•9/6/24, 3:09 AM

there's a really easy fix here: make an unproxied AA record and point your MX record to that. There's literally zero point/extra safety by pointing to a proxied record when it exposes it anyway.
It is curious that wildcard records seem to work like that though, I was playing around with it a bit

ChaikaOP•9/6/24, 3:14 AM

he was just saying wildcard mx are generally a bad idea -- which is true, they have their uses though

Idle•9/6/24, 3:14 AM

:shrugpepe:

Idle•9/6/24, 3:14 AM

I'm sure you know what you are doing

Mmia yes, I know the logical solution is to not use a proxied domain, I have mentione...

ChaikaOP•9/6/24, 3:18 AM

tbh there should probably just be more warnings about this overall or that behavior should just be gone, there's pages of warnings about not using that feature even on non-wildcards because of the underscore breaking some systems

ChaikaOP•9/6/24, 3:19 AM

what's funny is that you can see it trying

dig _dc-mx.669ab1666829.*.mx-test.yarn.network +short
49.13.146.203

ChaikaOP•9/6/24, 3:20 AM

just a little bit too literal

c•9/6/24, 6:17 AM

can someone help me when i try and install cloudfire warp vpn it gives me error code 2503 and 2502

4d62•9/6/24, 4:34 PM

Do cloudflare access configured as SASS work on applications which are behind a protected network (ex: vpn)

Rares•9/6/24, 7:05 PM

One question about renewing the certificates for SaaS, if the customer does not have the DNS at cloudflare at all, and the method is Http, and the pki is avaliable, if i serve the .well-known, will it work?

RRares One question about renewing the certificates for SaaS, if the customer does not ...

ChaikaOP•9/6/24, 7:06 PM

you don't need to serve the .well-known, it just does it for you

Rares•9/6/24, 7:06 PM

even if the custom hostname is not managed by Cloudflare?

Rares•9/6/24, 7:06 PM

let;s say the Customer has it at GoDaddy

Rares•9/6/24, 7:08 PM

This is what i see in the CF docs

If the custom hostname is not proxying traffic through Cloudflare, then the custom hostname domain owner will need to add the TXT or HTTP DCV token for the new certificate to validate and issue. As the SaaS provider, you will be responsible for sharing this token with the custom hostname domain owner.

If the custom hostname is not proxying traffic through Cloudflare, then the custom hostname domain owner will need to add the TXT or HTTP DCV token for the new certificate to validate and issue. As the SaaS provider, you will be responsible for sharing this token with the custom hostname domain owner.

RRares This is what i see in the CF docs ``` If the custom hostname is not proxying tr...

ChaikaOP•9/6/24, 7:11 PM

That is about the original version for SSL for SaaS which was completely different and weird

ChaikaOP•9/6/24, 7:12 PM

You can't use HTTP DCv for prevalidation (before they add the CNAME) for.. obvious reasons but see
https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/http/

Cloudflare is able to serve a random token from our edge due to the fact that site.example.com has a CNAME in place to $CNAME_TARGET, which ultimately resolves to Cloudflare IPs. If your customer has not yet added the CNAME, the CA will not be able to retrieve the token and the process will not complete.

We will attempt to retry this validation check for a finite period before timing out. Refer to Validation Retry Schedule for more details.

If the custom hostname is not proxying traffic through Cloudflare, then the custom hostname domain owner will need to add the TXT or HTTP DCV token for the new certificate to validate and issue. As the SaaS provider, you will be responsible for sharing this token with the custom hostname domain owner.

what do you mean "Resolves fine for non-wildcards"? It has the same behavior for non-wildcards and w

Similar Threads