Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.


  • is the main website, we do send/receive mail using DNS has got an SPF record "v=spf1 a mx ~all"

  • is just an alias for, but we do NOT send mail using Therefor DNS has got an SPF record "v=spf1 -all" to acknowledge everyone it does not send mail

Since is an alias for I wanted to use CNAME in DNS, thus: -> CNAME -> -> CNAME ->

But by doing this I noticed that when testing SPF for with a DNS tool like this the SPF returned is the one in "v=spf1 a mx ~all" and NOT as I would expect the "v=spf1 -all"

Is there a way to use different SPF for the two domains, by still using CNAME

share|improve this question
You can't CNAME a whole domain like that.... Are you using some control panel software? – Chris S Feb 21 '13 at 19:58
@Chris S: I'm using cPanel/WHM, and both domains have been added to the server. They work perfectly. When someone enters it goes to I thought to use CNAME in DNS because I wanted to avoid writing again the IP for each A record. But obviously there is something that I'm missing. about the CNAME, could you explain? Thanks – Marco Demaio Feb 21 '13 at 20:34
use a DNAME if you can, see my answer below. – isedev Feb 22 '13 at 1:29

3 Answers 3

up vote 4 down vote accepted

A CNAME means that the hostname is exactly the same as the target hostname with respect to all record types. If this is not what you want then you can't use a CNAME.

You also shouldn't CNAME the root of a domain (i.e., because this means that the SOA for is actually that of

share|improve this answer
It's an invalid configuration to CNAME a domain at the delegated name server; it would have to be CNAME'd at the root server level, and they don't allow that. – Chris S Feb 22 '13 at 0:42
@ChrisS That's what I meant in the second paragraph. – mgorven Feb 22 '13 at 1:36
I know you know what you're talking about... just spelling it out for the less informed. – Chris S Feb 22 '13 at 4:06
@mgorven: I think I almost got the point. What altrenatives do we have then to avoid rewriting same server IP hundereds of times in the DNS of each domain? See… – Marco Demaio Feb 22 '13 at 13:26
@MarcoDemaio There isn't if you want different SPF records. If you want both domains to be exactly the same you can use a DNAME record however. – mgorven Feb 22 '13 at 17:06

From a pure DNS point of view (i.e. don't know about cPanel), you can use a DNAME record to in to redirect to

In that case, queries for SPF will return the entry both in the corresponding domain but other entries will be aliased:

# zone file DNAME SPF   "'s SPF"

# zone file SPF   "'s SPF"
someip   A

# dig spf SPF "'s SPF"

# dig spf SPF "'s SPF"

# dig A
share|improve this answer

cPanel isn't actually using a CNAME; that would be an invalid configuration. I'm not sure how DNS servers would respond to it, but I suspect it just plain wouldn't work. BIND certainly has a tendency to refuse invalid data outright.

What has almost certainly happened is that the cPanel software setup a copy of all the records from the original domain in the second domain. Which would certainly "override" your SPF record.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.