diff --git a/site/profiles/manifests/cobbler/config.pp b/site/profiles/manifests/cobbler/config.pp
index 3042d98..adce4aa 100644
--- a/site/profiles/manifests/cobbler/config.pp
+++ b/site/profiles/manifests/cobbler/config.pp
@@ -68,7 +68,10 @@ class profiles::cobbler::config {
   # export cnames for cobbler
   if $is_cobbler_master {
     profiles::dns::record { "${::facts['networking']['fqdn']}_${service_cname}_CNAME":
-      value  => $::facts['networking']['hostname'],
+      # CNAME target must be a fully-qualified name (trailing dot): dns-updater
+      # parses the value with no $ORIGIN, so a bare label becomes root-absolute
+      # ("ausyd1nxvm2098.") and dead-ends in NXDOMAIN.
+      value  => "${::facts['networking']['fqdn']}.",
       type   => 'CNAME',
       record => "${service_cname}.",
       zone   => $::facts['networking']['domain'],