Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Let us say we own the zone

I would like each of my customers to get their own subdomain, such as needs to be a CNAME to a given server offsite. Since that site manages its own equipment and can change addresses at any point in time, the CNAME is a requirement.

People also need to be able to send email to, which would require a simple MX record.

However, and this is where I'd like some guidance:

According to RFC 1034:

If a CNAME RR is present at a node, no other data should be
present; this ensures that the data for a canonical name and its aliases
cannot be different.

I have also verified that my DNS server will refuse to serve up anything but a CNAME for hosts that use them.

So, it seems that I may have a losing situation. If I want to use the MX record, I need to use an A instead of a CNAME.

Can anyone think of any workarounds? Thanks!

share|improve this question

7 Answers 7

up vote 13 down vote accepted

Unfortunately, what you're running into is a limitation of the DNS specification. Having an MX record for the same hostname as is defined as a CNAME record will fail in most DNS server implementations. Some older DNS servers will allow this, but they have been mostly phased out in favor of newer, more secure implementations.

Instead of using CNAME records, you will need to use 'A' records with the IP addresses of the customer sites directly instead of aliasing the names.

share|improve this answer
Yeah, I guess I'm just going to face up to this one. Thanks! – Michael Gorsuch Jun 2 '09 at 23:25
I should also note, for those reading this down the road, that the reason for this limitation is that a CNAME is supposed to refer to the "canonical name" for the host being looked up. For example, if you have a host, which is a CNAME record pointing to, then any resolver looking up x2 should see the CNAME, replace whatever it's doing for x2 with x1, and start over. If you had an MX record for x2 in addition to the CNAME, then if x1 also had an MX there is a chance they would be different which is undesirable, so they simply disallow it. – Justin Scott Apr 28 '10 at 19:36

After a lot of work and research here, I have found an acceptable solution. First, it is important that we all follow the RFCs. I patched my DNS server to violate the RFC, and I discovered that several other major DNS servers would not respect the change.

The appropriate move is to put the MX on the host that the CNAME points to. So, if is a CNAME to the A record, it is proper to also build an MX record for I have verified that this works with all major resolvers.

If a MX query is made for, the resolver library will follow the CNAME and get the proper MX for the final A record. Hurrah!

share|improve this answer needs to be a CNAME to a given server offsite. Since that site manages its own equipment and can change addresses at any point in time, the CNAME is a requirement.

Can anyone think of any workarounds? Thanks!

You have a requirement that the customers must be able to change the address, have you considered allowing the customer to dynamically update their own record? With dynamic dns you could use the A record, and the customer could change the record as needed. It would take a bit of work, but you could each individual sub-domain as a separate zone so you can make sure a customer can only touch their own zone.

I haven't tried it but gnudip appears to be an open source tool for facilitating dynamic updates without having to deal with authentication and setting up lots of zones on your DNS server.

share|improve this answer

If your MX records will be the same for all of these records, then you could attempt to use a DNAME to redirect to Under add your relavent MX and A records.

I must say that I have never utilized DNAME records in production, but you can read more about them in RFC2672.

share|improve this answer
I wanted to try using DNAME with some of our SSL domains, but I heard there are still problems with older DNS servers, etc. Is this relevant? Or is DNAME safe to use on production servers? – drybjed Jun 2 '09 at 18:31
If I had to guess, many applications don't expect DNAME records and probably break when using them. Do all mail servers follow DNAMEs to lookup MX records? I don't know, but they should. For your SSL issue, DNS servers that don't understand DNAME should instead receive a CNAME reference. I would thoroughly test this before implementing it. – Doug Luxem Jun 2 '09 at 18:37
The application certainly does NOT have to process DNAME records! It is done only in name servers. – bortzmeyer Jun 4 '09 at 9:24

Does the RHS of the CNAME have an MX entry?

If so, then the mail server will use that MX to find the mail server to use. Hopefully you can control that.

share|improve this answer

Michael Gorsuch's answer is largely correct, the CNAME -> A+MX chain does work... mostly. However, it does trigger some bad behavior in certain MTAs. What I've found running this solution at a decent amount of scale:

  • some MTAs will simply refuse to find the record.
  • others will incorrectly substitute the A record where the CNAME should be: ie I sent mail to "", which CNAMES to, which has an MX of, and the MTA rewrites the envelope header as "To:".

It's not clear yet how pervasive these issues are (google/hotmail/yahoo/etc all seem to deal with this correctly), but they certainly have us looking about for better solutions.

share|improve this answer
This is correct; the documented behaviour for RFC5321-compliant SMTP servers is to first check for the existence of an MX record for the domain, and if that fails, check for the existence of an A record. This behaviour is the real, technical reason why the MX should not be a CNAME: it will stop resolving after the first usable answer. – adaptr Mar 12 '12 at 13:42

MX and CNAME are completely separate records - first one determines the mail server for given domain, second gives the address for a domain. This should work:

@       IN      SOA (


customer                CNAME
customer                MX 10   mail.server.
share|improve this answer
That may work, but it violates RFC1034 and RFC1219 which state that no other resource records may have the same name as a CNAME. – Doug Luxem Jun 2 '09 at 18:27
My DNS daemon is RFC strict, which just flat out refuses to send the response for the MX. I believe that there are some potential caching issues on the client side if we were to put this in place. – Michael Gorsuch Jun 2 '09 at 18:38
Which DNS daemon? I'm using BIND9 which should work with that configuration without a problem. Maybe it's time to upgrade? Big infrastructure, I presume? – drybjed Jun 2 '09 at 18:43
I'm using MyDNS. It's quite a large configuration, and this little daemon has been a blessing up until this point. I am considering patching it, but am not very interested in dealing with whatever side effects that gives birth to. If it goes against the RFC, it sounds like a bad idea. – Michael Gorsuch Jun 2 '09 at 19:06
@Maciej - sure, your authoritative server might be able to host these records. They'll confuse the hell out of most any recursive server that queries them though. – Alnitak Jun 3 '09 at 7:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.