I'm trying to set up DNS records for a domain name, such that mail.domain.com uses a server that is different from any other request to *.domain.com. As I've been going about trying to figure out how to do this, I realize there's a possibility I'm in over my head.

I've tried a few things that have wound up with a `zone domain.com/IN not loaded due to errors. The zone file at the time looked like this (not hiding info since a simple DNS lookup with reveal everything anyways:

$TTL    1800
@       IN  SOA ns1.domain.com. hostmaster.domain.com. (
            1393205447 ; last update: 2014-02-24 01:30:47 UTC
            3600 ; refresh
            900 ; retry
            1209600 ; expire
            1800 ; ttl
             IN      NS      ns1.domain.com.
                     NS      ns2.domain.com.
                     NS      ns3.domain.com.
            MX 10   mail.domain.com.
ns1.domain.com. IN A
ns2.domain.com. IN A
ns3.domain.com. IN A
@   IN A
*   CNAME   @
mail.domain.com.    IN A
mail    CNAME   mail.domain.com.

So, first, is what I'm trying to do an acceptible "good practice/best practice", and second, if it is, how can I set this up so that mail requests go to the IP of the second server, and from there, do I need to set MX records as: priority mail.domain.com. (What did I do wrong specifically in regards to redirecting mail.domain.com requests and mx DNS settings to the second servers IP

Note, I am using digitalocean, so I have a DNS entry panel that creates the zone file for me.

  • You can't CNAME * to @ -- you're creating a catch-22 situation. whatever.domain.com is a CNAME to domain.com but you can't have any other RR's in domain.com, including NS and MX records. – fukawi2 Feb 24 '14 at 3:44
  • Just following up, check RFC1912 for more, section 2.4: rfc-editor.org/rfc/rfc1912.txt – fukawi2 Feb 24 '14 at 3:45
  • I have had * CNAME to @ for months, and have used it succesfully for a subdomain catchall, and using my server to create virtual hosts. This was actually recommended by digitalocean: how to setup hostname with digitaloceanhost-name-with-digitalocean – Brian Vanderbusch Feb 24 '14 at 4:14

You don't need to specify the FQDN when creating an A record for a host that is on a different network.

Correction to your zone config:

mail IN A
@ IN MX 10 mail.domain.com

How this translates to a client perspective is this:

  • When a mail server checks for MX routes, it will find mail.domain.com as the primary route.
  • When the mail server does a lookup on mail.domain.com it will return with

Why you don't need a FQDN in your A record:

mail.domain.com. IN A

This is perfectly fine.

mail.3rdparty.com. IN A

This is not valid. Reason: You aren't authoritative for 3rdparty.com

mail IN A

This is valid. Reason: anything not ending in a . will have the $ORIGIN appended to it.
So, mail actually means mail.domain.com, if you have $ORIGIN = domain.com

Some history:

The . actually means the root of all domains.

Take this record for example:


This is what it means:

  • mail: a subdomain or "host"
  • domain: the domain
  • com: a "top-level" domain (TLD)
  • .: the root

That's why not appending a . to your records will result in accidental records like mail.domain.com.domain.com.

But in most modern DNS servers, they assume you mean a dot on the end.

  • Sorry, I mixed it up a little. I've just edited it. Let me explain further in my answer, editing now. – Vasili Syrakis Feb 24 '14 at 2:33
  • thx, also recognize all my settings as shown above, I already have an a CNAME for @ which resolves domains to server files from my primary server. – Brian Vanderbusch Feb 24 '14 at 2:34
  • @ just means the root of the domain. You can have as many of them as you want. As for interaction with your wildcard, that's a different RR type, so I think it's fine. – Vasili Syrakis Feb 24 '14 at 2:40
  • My DNS settings only allow me to enter two fields for MX records: hostname and priority. – Brian Vanderbusch Feb 24 '14 at 2:45
  • If that means what I think it does, you would specify mail.domain.com with a priority of 1-65535. Are you saying it doesn't let you specify the record name? – Vasili Syrakis Feb 24 '14 at 2:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.