0

I have a domain, say example.com, and don't run my own mailserver so I use my ISP's, say myisp.com, so in my DNS the MX records point to ex1.myisp.com and ex2.myisp.com.

I also have an ill-conceived notion about security and don't want it obvious that I use myisp.com for mail, so I want to setup m1.example.com and m2.example.com and point them at ex1.myisp.com and ex2.myisp.com respectively, and then set my MX records to use m1.example.com and m2.example.com.

This can be done by making CNAMEs for m1 and m2 but RFC 2181 says MX records cannot point to CNAMEs (although it does technically work). I could also make A records for m1 and m2 and point them to the IP addresses of the respective mail servers.

Is there a way to accomplish this without breaking the spec? What actually are the repercussions of breaking the spec in this instance (in addition to the increased load on DNS servers)? Is creating A records that point to the IP addresses a bad idea (even if the IP addresses never change)? Or is doing this at all a bad idea to begin with?

2
  • 1
    When you say pointing an MX at a CNAME "does technically work", what you really mean is that some MTAs tolerate it. But not necessarily all MTAs... Mar 17, 2012 at 6:38
  • if you want email to flow properly on consistent basis, follow the RFC and listen to @womble
    – tegbains
    Mar 17, 2012 at 7:08

1 Answer 1

4

It's a bad idea to begin with. Anyone who actually cares enough to look at your MX records will almost certainly resolve whatever they point to, and they'll either see the CNAMEs or reverse-lookup the IP addresses (which will just point to mx0[12].myisp.com anyway). All you're doing is increasing complexity and fragility for absolutely no benefit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .