Why can't my provider simply delegate my /27 to me?

Because IPv4 reverse DNS is split into zones per octet. The smallest zone that exists by itself belongs to a /24. A block inside it has no zone name that can be delegated; that is what the CNAME construction from RFC 2317 is for.

Do I need this for IPv6 too?

Usually not. IPv6 reverse works per nibble (four bits), so a /48, /56 or /64 has its own zone name and can be delegated directly with NS records. Only a prefix length that is not a multiple of four would bring the same problem back.

Do resolvers and mail servers follow that CNAME?

Yes. A resolver follows a CNAME on a PTR query just as on any other query, and has done so for decades. Some test tools do show the CNAME and the PTR record as two lines, which looks like an error the first time you see it.

Classless reverse DNS delegation: how RFC 2317 works

If you have a block of IPv4 addresses smaller than a /24, say a /27 for a few servers, reverse DNS runs into a limitation: the zone holding the PTR records for those addresses belongs to the provider, not to you. You can have the names set, as described in Setting up reverse DNS, but you cannot manage them on your own name servers. Classless delegation, defined in RFC 2317, makes that possible. This first part explains how it works; part 2 covers setting it up and troubleshooting.

Why reverse DNS runs per octet

IPv4 reverse DNS lives under in-addr.arpa, with the octets of the address in reverse order. The PTR record for 192.0.2.25 is called 25.2.0.192.in-addr.arpa. Each octet is a label, and a zone boundary can only sit between two labels.

So you get zones for a /8, a /16 and a /24, and nothing in between. The zone 2.0.192.in-addr.arpa contains all 256 addresses of 192.0.2.0/24. A /27 is a slice of a single label, 0 to 31 in the last octet, and no name exists for such a slice that you could hand to other name servers with an NS record.

You see the same at the RIR: RIPE NCC delegates IPv4 reverse zones on /16 and /24 boundaries. A /24 of your own can simply point to your own name servers. Anything smaller depends on whoever manages the /24.

The solution: a subzone and a CNAME per address

RFC 2317 changes nothing about DNS itself. It combines two things that were always possible:

A subzone with a chosen name — inside 2.0.192.in-addr.arpa, the manager of the /24 creates a name such as 0/27 and delegates it to your name servers with NS records. That is an ordinary delegation, just of a label that is not an octet.
A CNAME per address — for every address in your block, the manager adds a CNAME from the normal reverse name to the same name under the subzone: 25.2.0.192.in-addr.arpa points to 25.0/27.2.0.192.in-addr.arpa.
Your PTR records — in the zone 0/27.2.0.192.in-addr.arpa on your name servers you set the PTR records yourself, and change them whenever you like.

A resolver looking up 192.0.2.25 asks for 25.2.0.192.in-addr.arpa, gets the CNAME, follows it to the subzone, finds the delegation to your name servers there, and gets the PTR record from you. Two steps more than usual, and nothing else special.

What lives where

At the manager of the /24, 2.0.192.in-addr.arpa holds the NS records for the subzone and the 32 CNAMEs:

0/27    IN NS     ns1.example.com.
0/27    IN NS     ns2.example.com.
0       IN CNAME  0.0/27
1       IN CNAME  1.0/27
...
31      IN CNAME  31.0/27

Your name servers hold the zone 0/27.2.0.192.in-addr.arpa, with an SOA, your own NS records and the PTRs:

25      IN PTR    mail.example.com.
26      IN PTR    web1.example.com.

The manager sets the CNAMEs once, for the whole block. After that nothing needs to happen on their side when you change a name or start using an address.

The slash is a convention

The misconception is that 0/27 is special syntax that DNS software understands. It is not. It is a label like any other; DNS allows a / in labels, just not in hostnames. RFC 2317 uses it because it is readable: the first address and the prefix length.

You could just as well use 0-31 or customer-a, and some operators do, because a / causes trouble in a file name or in a DNS panel's API. What matters: the name the manager of the /24 chooses is the name your zone must have, character for character. If it differs, your name server is not authoritative for what the resolver asks and you get no answer.

IPv6 does not need this

Under ip6.arpa every label is a nibble, four bits. A /48, /56 or /64 therefore falls on a label boundary and has its own zone name that can be delegated directly. Classless delegation is an IPv4 problem, and a consequence of how small IPv4 blocks are handed out these days. More on the move in Deploying IPv6.

Reverse DNS at Xyphen IT

If you get addresses from us through IP transit or with colocation, you set the PTR records in our dashboard and no delegation is needed. Want to host them yourself, or manage your own address space through our LIR services? Get in touch. How to set up and check the zone on your side is in part 2.