I have read that I "must not" use CNAMEs in MX record entries.

My in-house mail server is connected to the internet with a provider where the IP changes every two/three months. I have a subdomain mail.mydomain.com set up which I later reference in my MX entries mydomain.com IN MX 10 mail.mydomain.com. I am the only one in my organization who knows how to do this. When I was gone a couple of days ago the IP changed and obviously mails were not reaching the mail server.

I then thought I would solve my problem with something like CNAME and dyndns. My router would automatically update the dyndns-information and I would change mail.mydomain.com from an A entry to a CNAME (pointing to my dyndns address) and be done with it. The MX entries would stay the same, pointing to the subdomain.

I have implemented this solution and it works fine, except for one specific mail server (of which I know), who apparently can't resolve the domain name. It can if I use an A entry.

Is there a "correct" way of doing this? Without enlisting the services of someone like zoneedit?


  • 5
    The correct way is to get a static IP address. – Michael Hampton Nov 6 '12 at 15:03
  • I would love to have a static IP, but none of the providers at our disposal offer this option. I have tried time and time again to pay a premium for one. – Joseph Nov 6 '12 at 15:03
  • If you're willing to pay a premium, can't you pay someone else to handle your mail? Given your network situation, that might be the "correct" way. – cjc Nov 6 '12 at 15:11

Presumably, mail.mydomain.com is a CNAME pointing to a dyndns.org (or similar) A record, which is the one you update dynamically.

The right way to do this is to list that dyndns.org record as your MX. It's all very well to quote "must not" as if it were some random prohibition by some passing martinet, but it's a verbatim quote from, if memory serves, RFC974, and that makes it authoritative. That means that any other mail server out there is free to ignore your MX record. Clearly, most are nice, and tolerant, and don't ignore it; but at least one does, and you are at fault when it does so.

Edit: yes, mydomain.com IN MX myip.dyndns.org. is what I mean. Why do you feel that's bad practice? Because the MX is an A record outwith your domain? That's not an issue, I have many of those, and they work fine. Even huge companies do it, he said, picking one at random:

astrazeneca.com.    86400   IN  MX  10 mail79.messagelabs.com.
astrazeneca.com.    86400   IN  MX  10 mail124.messagelabs.com.

though in their case it's done to outsource content filtering rather than because they can't afford a static address!

  • Yes. Sorry. Wasn't explicit enough. Edited my post. – Joseph Nov 6 '12 at 15:05
  • What do you mean with "list that dyndns.org record as your MX"? Do you mean to actually do something like: mydomain.com IN MX myip.dyndns.org.? I thought that was bad practice. – Joseph Nov 6 '12 at 15:06
  • So the problem is my "workaround" using the CNAME opposed to just using the dnydns directly? – Joseph Nov 6 '12 at 15:09
  • If you are right in thinking that the mailserver that ignores you does so because you're using a CNAME MX, then yes, that is correct. – MadHatter Nov 6 '12 at 15:10
  • 2
    Good luck. Note that you'll need to be extremely prompt with your DDNS updates, otherwise someone else's mail server may get your mail, and it'll bounce it (or worse, accept it). Keep the TTL on your dyndns.org A record way down, if you can. – MadHatter Nov 6 '12 at 15:19

It seems like you're doing it the hard way. I've used a dynamic ip address for years and haven't had any problem hosting email and web sites using a dynamic ip address. I use DynDNS.org for my DNS as well. Here's what I do (which seems pretty standard):

  1. Create an A record for your current ip address. It doesn't matter what you call it, if you want to call it mail.Yourdomain.TLD then call it that. There's no requirement that a mail server has to be called mail.YourDomain.TLD, but if that makes it easier for you then so be it. Make sure to set a reasonable TTL, like 1 hour.

  2. Create an MX record that points to the A record created in step 1. Make sure to set a reasonable TTL, like 1 hour.

  3. Use a Dynamic DNS client utility (installed on one of your internal computers) to update the A record whenever the dynamic ip address changes.

  4. Done. You'll never have to manually do anything ever again.

  • One of the most reliable ways of determining if a message is spam that is being sent from a dynamic IP address. This is followed closely by failure of PTR record to return the domains name (reverse DNS validation). You will fail to deliver to many domains unless you use a relay with a static IP address. – BillThor Nov 7 '12 at 0:56
  • @BillThor sending is not the concern. Receiving mail was the question. To avoid false spam positives sending mails gets relayed through a separate host. – Joseph Nov 7 '12 at 5:11
  • @Casper True, but most systems have the MX setup as the outgoing MTA. On a dynamic address it should be set to relay all outgoing mail via a properly configured server. Most ISPs provide a suitable relay. – BillThor Nov 8 '12 at 1:11

MadHatter's solutions is perfectly OK, however there are other possibilities you may consider:

  1. Use SMTP forwarding service. It's a hosted service (dynamic DNS companies like no-ip.com tend to provide it at a separate fee) which accepts incoming SMTP mails for you and then forwards them to your own SMTP server. This way when your server is down, mails aren't lost - they collected at the SMTP forwarder and once your server becomes available, pushed there.

  2. Use POP mailbox polling. Open account for your domain with your ISP or Google Apps or any other mail service. Emails will be delivered to your mailbox and then your mail server can poll this POP mailbox periodically and deliver emails to your users. (polling mailserver can deliver messages from a single POP mailbox to multiple internal accounts). This a "budget" solution, yet it gives you the advantage of never loosing emails.

  3. Host your domain with a DNS provider which supports dynamic DNS (like dyn.com or my own net-me.net). This way your dynamic DNS record can be mail.mydomain.com.

  • Regarding 1 & 3 as mentioned: "Without enlisting the services of someone like zoneedit?" POP-Polling had caused errors in the past. MadHatter's solution worked. – Joseph Nov 7 '12 at 5:08
  • @Casper Yes, I missed the zonnedit part. – Sandman4 Nov 7 '12 at 6:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.