we're trying to add an MX record to a Windows Server 2003 DNS server and getting the following error:

"A new record cannot be created. Node is a CNAME DNS record."

The domain is xyz.com. We create a new MX record and leave the "Host or child domain:" field blank, then we're putting "cluster122.us.messagelabs.com" in the "Fully qualified domain name (FQDN) of mail server:" field and leaving the default Priority of 10.

Are we missing something?

4 Answers 4


If you are trying to set an MX record for a hostname such as corp.example.com (for mail to user@corp.example.com) and that name exists as a CNAME record instead of an A record, it would result in this error. If a host exists as a CNAME, it cannot also have other record types associated with it. You would need to re-create the hostname as an A record and then add the MX record to it.

  • On a BIND DNS name server, you would get "CNAME and other data (invalid)" errors showing up in logs.
    – netlinxman
    Jun 7, 2009 at 1:04

RFC 2181 forbids the use of a CNAME value in a MX record:

10.3. MX and NS records
   The domain name used as the value of a NS resource record, or part of
   the value of a MX resource record must not be an alias.  Not only is
   the specification clear on this point, but using an alias in either
   of these positions neither works as well as might be hoped, nor well
   fulfills the ambition that may have led to this approach.  This
   domain name must have as its value one or more address records.
   Currently those will be A records, however in the future other record
   types giving addressing information may be acceptable.  It can also
   have other RRs, but never a CNAME RR.

Microsoft specifically has this to say on the subject.

  • Correct but unrelated to the error message he got. The problem is more likely the one spotted by Justin Scott.
    – bortzmeyer
    May 20, 2009 at 6:54
  • @bortzmeyer Eh? Justin actually said the same thing.
    – MikeyB
    May 20, 2009 at 13:39

Try adding a trailing dot to "cluster122.us.messagelabs.com"

That's something I constantly forget, and it doesn't work without it.


Had exactly the same issue even logging onto multiple DC's directly to try and create the record.

Problem ended up being copy and pasting the information from a third party application. Seemed to be a unknown illegal Character, typing the record "manually" worked fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.