DNS on biomejs.dev is misconfigured

[Sn0wCrack]

I was initially having issues accessing biomejs.dev due to DNSSEC error. Disabling DNSSEC validation on my setup successfully allowed me to navigate to the site.

Investigating this, it appears to have a CNAME record on the apex zone of your domain.

❯ dig A biomejs.dev                              
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 30442
;; flags: qr rd ra ; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 
;; QUESTION SECTION:
;; biomejs.dev. IN      A

;; ANSWER SECTION:
biomejs.dev.    156     IN      CNAME   biomejs.netlify.app.
biomejs.netlify.app.    120     IN      A       54.253.94.210

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:
biomejs.netlify.app.    156     IN      AAAA    2406:da1c:cc9:3500::258

;; Query time: 95 msec
;; SERVER: 127.0.0.53
;; WHEN: Sun Jul 27 18:08:18 2025
;; MSG SIZE  rcvd: 106

This is invalid in standard DNS setups and generally requires CNAME flatten, ALIAS records or ANAME records as a feature to work.

[siketyan]

For A RR, it seems the authoritative server responses a correct answer, flattening the CNAME RR:

❯ dig @dns1.p09.nsone.net biomejs.dev. A +norec

; <<>> DiG 9.10.6 <<>> @dns1.p09.nsone.net biomejs.dev. A +norec
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51178
;; flags: qr aa; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;biomejs.dev.			IN	A

;; ANSWER SECTION:
biomejs.dev.		120	IN	A	52.74.6.109
biomejs.dev.		120	IN	A	13.215.239.219

;; Query time: 8 msec
;; SERVER: 2620:4d:4000:6259:7:9:0:1#53(2620:4d:4000:6259:7:9:0:1)
;; WHEN: Sun Jul 27 17:15:04 JST 2025
;; MSG SIZE  rcvd: 72

However, for AAAA RR, it returns the CNAME RR without flattening it, this is a problem.

❯ dig @dns1.p09.nsone.net biomejs.dev. AAAA +norec

; <<>> DiG 9.10.6 <<>> @dns1.p09.nsone.net biomejs.dev. AAAA +norec
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50632
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;biomejs.dev.			IN	AAAA

;; ANSWER SECTION:
biomejs.dev.		3600	IN	CNAME	biomejs.netlify.app.

;; Query time: 6 msec
;; SERVER: 2620:4d:4000:6259:7:9:0:1#53(2620:4d:4000:6259:7:9:0:1)
;; WHEN: Sun Jul 27 17:15:19 JST 2025
;; MSG SIZE  rcvd: 73

It seems your recursive resolver or cache server also queries for AAAA RR even if you queried only A, which causes the DNS resolution to fail.

[siketyan]

I deleted an unnecessary CNAME RR and it looks the problem has been fixed. DNSSEC issue still exists though.

❯ dig @dns1.p09.nsone.net biomejs.dev. AAAA +norec

; <<>> DiG 9.10.6 <<>> @dns1.p09.nsone.net biomejs.dev. AAAA +norec
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39134
;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;biomejs.dev.			IN	AAAA

;; AUTHORITY SECTION:
biomejs.dev.		3600	IN	SOA	dns1.p01.nsone.net. domains+netlify.netlify.com. 1701467254 43200 7200 1209600 3600

;; Query time: 6 msec
;; SERVER: 2620:4d:4000:6259:7:9:0:1#53(2620:4d:4000:6259:7:9:0:1)
;; WHEN: Sun Jul 27 17:23:15 JST 2025
;; MSG SIZE  rcvd: 121

[Sn0wCrack]

I have tried this out again, re-enabling DNSSEC validation and flushing cache, and I don't appear to be getting issues now.

CNAME no longer appears in results as well.

❯ dig biomejs.dev                                   
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 32690
;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; biomejs.dev. IN      A

;; ANSWER SECTION:
biomejs.dev.    120     IN      A       54.253.94.210

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 117 msec
;; SERVER: 127.0.0.53
;; WHEN: Sun Jul 27 18:41:48 2025
;; MSG SIZE  rcvd: 45

[siketyan]

Happy to hear that!
I have no idea that DNSViz analysis still shows some errors around DS RR 😢: https://dnsviz.net/d/biomejs.dev/aIXiNg/dnssec/

[Sn0wCrack]

Appears to be .dev's DNS just being weird.

Results for my own .dev domain look the same: https://dnsviz.net/d/sn0wcrack.dev/dnssec/

[siketyan]

It seems so, I'll ignore the errors.
Thank you for reporting!