Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We recently moved to EC2 and started using amazon's elb for load balancing. We're using CloudFlare for DNS which allows us to use a cname the domain root. However, we occasionally have people tell us that our emails are bouncing with some variation of the following error: Deferred: Connection refused by

We are using google apps for mail and our MX records are configured properly, so I'm not sure at what point the mail clients or servers are attempting to resolve our domain and receiving the cname record instead.

Does anyone understand why the MX records would be ignored? Is this a result of using a CNAME? I would imagine that the same thing could/would happen if we pointed an A record at an IP address that was also not accepting mail.

share|improve this question
Where are your MX records configured - same FQDN as the CNAME, or where the CNAME points to? This would definitely break things. – Shane Madden Oct 6 '11 at 16:18
Same FQDN as the CNAME. – Jonathan7413 Oct 6 '11 at 18:01
Then, as stated in the answers, it shouldn't work. CloudFlare is breaking RFC compliance by even allowing you to have an MX and CNAME on the same name. – Shane Madden Oct 6 '11 at 18:04
Thanks for the quick and helpful response! – Jonathan7413 Oct 6 '11 at 18:27
up vote 2 down vote accepted

If you have a domain example.invalid:

; example.invalid
$TTL    604800
@       IN      SOA     ns1.example.invalid. root.example.invalid. (
                     2006020201 ; Serial
                         604800 ; Refresh
                          86400 ; Retry
                        2419200 ; Expire
                         604800); Negative Cache TTL
@       IN      NS      ns1
        IN      MX      10 mail
        IN      CNAME   anotherdomain.invalid

You are saying:

Hey, you can find example.invalid under whatever address anotherdomain.invalid can be found. And btw, any MX records SRV records or other stuff for example.invalid is also whatever anotherdomain.invalid tells you. That means Mail sent to example.invalid will use the MX record of anotherdomain.invalid


share|improve this answer

Per RFC1034§3.6.2

If a CNAME RR is present at a node, no other data should be present; this 
ensures that the data for a canonical name and its aliases cannot be different.

Thus, if you have a CNAME configured at then it is the only record you may have configured there. All records which pertain to that domain must be under the alias.

For example. If you have IN CNAME then your NS, SOA, MX, etc records must all be under They may not be under

Additionally if no MX record is found for a domain, then the A record for that domain may be tried as a last resort. So a properly functioning MTA should lookup your domain, find the CNAME, try the alias, fail to find an MX record there, try the A record instead (your load balancer in this case). Your load balancer apparently isn't capable of receiving e-mail.

The failing MTA are actually behaving correctly. Any MTAs finding your mail server are not.

share|improve this answer

I'm assuming that you have the CNAME for the balancer marked with an orange cloud in DNS settings at CloudFlare? If so, you should login & change the cloud from orange to gray for that CNAME record.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.