diff --git a/site/profiles/manifests/haproxy/dns.pp b/site/profiles/manifests/haproxy/dns.pp
index 8338ea2..159e598 100644
--- a/site/profiles/manifests/haproxy/dns.pp
+++ b/site/profiles/manifests/haproxy/dns.pp
@@ -21,7 +21,10 @@ class profiles::haproxy::dns (
     $parts = split($cname, '\.')
     $domain = join($parts[1, $parts.length], '.')
     profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
-      value  => "${location_environment}-halb",
+      # CNAME target must be a fully-qualified name (trailing dot): dns-updater
+      # parses the value with no $ORIGIN, so a bare label becomes root-absolute
+      # ("au-syd1-prod-halb.") and dead-ends in NXDOMAIN.
+      value  => "${location_environment}-halb.${facts['networking']['domain']}.",
       type   => 'CNAME',
       record => "${cname}.",
       zone   => $domain,
@@ -58,7 +61,10 @@ class profiles::haproxy::dns (
         $parts = split($cname, '\.')
         $domain = join($parts[1, $parts.length], '.')
         profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
-          value  => "${location_environment}-halb-vrrp",
+          # Fully-qualified target (trailing dot); see the note on the non-vrrp
+          # cnames above. The matching A record is published in main.unkin.net
+          # and unkin.net just above.
+          value  => "${location_environment}-halb-vrrp.${facts['networking']['domain']}.",
           type   => 'CNAME',
           record => "${cname}.",
           zone   => $domain,