What came first- the CNAME or the A record
Jan 14, 2026Sebastiaan Neuteboom

Summary
This post details a DNS resolution incident caused by a change in the order of CNAME records within 1.1.1.1's responses. The change, intended to reduce memory usage, broke DNS clients that expected CNAMEs to appear before A/AAAA records, such as glibc's getaddrinfo and Cisco's DNSC process. The post explains the RFC 1034 ambiguity regarding the ordering of RRs in message sections versus RRsets, and how this led to the incident. It also discusses the importance of robust parsing logic in DNS clients to handle variations in response ordering.
More from the DNS Infrastructure & Naming Conventions trail
- The keys to the Internet change on October 11, 2026. Are you ready?
- 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
- How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
- BGP ORIGIN attribute manipulation and its impact on the Internet
- Cloudflare Internal DNS is now generally available