Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a domain, say example.com, and don't run my own mailserver so I use my ISP's, say myisp.com, so in my DNS the MX records point to ex1.myisp.com and ex2.myisp.com.

I also have an ill-conceived notion about security and don't want it obvious that I use myisp.com for mail, so I want to setup m1.example.com and m2.example.com and point them at ex1.myisp.com and ex2.myisp.com respectively, and then set my MX records to use m1.example.com and m2.example.com.

This can be done by making CNAMEs for m1 and m2 but RFC 2181 says MX records cannot point to CNAMEs (although it does technically work). I could also make A records for m1 and m2 and point them to the IP addresses of the respective mail servers.

Is there a way to accomplish this without breaking the spec? What actually are the repercussions of breaking the spec in this instance (in addition to the increased load on DNS servers)? Is creating A records that point to the IP addresses a bad idea (even if the IP addresses never change)? Or is doing this at all a bad idea to begin with?

share|improve this question
1  
When you say pointing an MX at a CNAME "does technically work", what you really mean is that some MTAs tolerate it. But not necessarily all MTAs... –  Gordon Davisson Mar 17 '12 at 6:38
    
if you want email to flow properly on consistent basis, follow the RFC and listen to @womble –  tegbains Mar 17 '12 at 7:08

1 Answer 1

up vote 3 down vote accepted

It's a bad idea to begin with. Anyone who actually cares enough to look at your MX records will almost certainly resolve whatever they point to, and they'll either see the CNAMEs or reverse-lookup the IP addresses (which will just point to mx0[12].myisp.com anyway). All you're doing is increasing complexity and fragility for absolutely no benefit.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.