Problem description:

I'm managing a corporate Email server for nlscan.com serving xxx@nlscan.com. However, for historical reason, we still support xxx@mail.nlscan.com. That is, foo@nlscan.com and foo@mail.nlscan.com refer to exactly the same mailbox and mail account. We recently find that some alien domain like @corp.url.com.tw fails to send email to us; our SMTP log shows that @corp.url.com.tw's SMTP server issues SMTP command

RCPT TO:<xxx@nlsgate.nlscan.com>

We do not recognize nlsgate.nlscan.com as recipient address, so it fails. We just allow 'RCPT TO: <xxx@mail.nlscan.com>' .

Where does that @nlsgate.nlscan.com come from? I fact, on our DNS, mail.nlscan.com is defined to be a CNAME of nlsgate.nlscan.com .

If sending from Gmail or Hotmail, we see the correct

RCPT TO:<xxx@mail.nlscan.com>

So, I'd like to ask, is the behavior of corp.url.com.tw's SMTP server RFC compliant? If it is compliant, we have to make mail.nlscan.com a A record instead of a CNAME record, right? And please tell me which RFC is it?


I don't know that it's causing the underlying problem, but to answer your specific question, no, an MX record must not be a CNAME. According to RFC2181 s10.3,

The domain name used as the value of a NS resource record, or part of the value of a MX resource record, must not be an alias. Not only is the specification clear on this point, but using an alias in either of these positions neither works as well as might be hoped, nor well fulfills the ambition that may have led to this approach. This domain name must have as its value one or more address records. Currently those will be A records, however in the future other record types giving addressing information may be acceptable. It can also have other RRs, but never a CNAME RR.

In practice, it often works, but if you're experiencing issues then the very first thing is to get yourself RFC-compliant, then investigate issues that continue past that.

  • Thank you MadHatter for pointing out the exact RFC section. Now I'll give mail.nlscan.com an A record as RFC suggests. It is better if you can explain why part(like the mail in mail.nlscan.com) of MX must not be an alias? What is the design rationale behind this limitation. In my opinion for an MX record, it should work well as long as corresponding IP address can be found, regardless it is found through an A record or a CNAME record. – Jimm Chen Oct 2 '11 at 14:34
  • Not being one of the RFC's authors, I can shed no light on this requirement. It is, however, mandatory. – MadHatter Oct 2 '11 at 15:18
  • 1
    My understanding is that thee design consideration was to minimize DNS lookups. The MX record is an in indirect lookup. Using a CNAME would add one or more additional lookup. It also prevents introducing lookup loops in the email system. This allows email to be used to report CNAME loops to addresses in the domain. – BillThor Oct 2 '11 at 18:05

Good style of zone (which will allow both @mail and @nlscan e-mail)

@    IN MX mail
mail IN A

And hire good hostmaster


CNAME is real alias when it comes to SMTP. I. e., if someone tried sending mail to mail.nlscan.com it's been translated as if it was sent to its alias. This is RFCed, IIRC, no surprise actually.

  • Can you point out the exact RFC section stating that? If like you said, then Gmail and Hotmail is violating that RFC requirement, right? – Jimm Chen Nov 6 '11 at 4:10
  • @Jun Chen, I think it might be tools.ietf.org/html/rfc2821#section-5 which states: «… If a CNAME record is found instead, the resulting name is processed as if it were the initial name. …». But it's rather not 100 % clear. May be that's why Google/Hotmail don't obey it. – poige Nov 6 '11 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.