1

I have a client who manages their own DNS - all the A records and CNAME records for example.com and a number of subdomains.

They want to use a dedicated subdomain for email - em.example.com. They want my company to manage the emails - not just the MTA but the MX records and SPF records. For this purpose, they want to delegate this subdomain to us, using an NS record.

My company is happy with this, in principle - we'd have the ability to update SPF records etc without having responsibility for the entire top-level domain - but we've hit a problem, our registrar / DNS provider doesn't support it. They won't allow us to add records for a zone that isn't registered with them.

How should I proceed? Do I have to find a new provider? What other options does anyone suggest?

Improve this question

2 Answers 2

Reset to default
3

Your client can setup a CNAME record for em.example.com which point to a domain name you can manage, let's say example.com.example.net:

em.example.com. IN CNAME example.com.example.net.

Setting an MX and TXT record for example.com.example.net will be equivalent to setting it for em.example.com.

For the MX record this is the only correct way to use CNAMEs, since the other way around will not work (an MX record can not point to a CNAME) as explained in this answer.

For the SPF record, however, you have another solution: the client can publish a record like:

em.example.com. IN TXT "v=spf1 include:example.com.example.net -all"

and the delegation works. Obviously this can not be used with the first solution, since a domain with a CNAME record can not have (almost) any other record.

Improve this answer
1
  • 1
    Good answer. You may expand on other parts of email authentication, such as DKIM and DMARC. This article on Dmarcian explains CNAME delegation well, IMO: dmarcian.com/…
    – Reinto
    Jan 9, 2020 at 20:57
1

As the MX record point to FQDN and SPF (TXT type) could include any other SPF record there is not necessary to have subdomain (of course it is not and issue)...

Let assume your client has domain example.com and you have domain example.net. You would like to handle clients records as FQDN mail.example.com.example.net.

You client would create (one time) records:

With subdomain (em)

em.example.com.  IN MX 10 mail.example.com.example.net.
em.exmaple.com.  IN TXT "v=spf1 include:mail.example.com.example.net -all"

Without subdomain

example.com.  IN MX 10 mail.example.com.example.net.
exmaple.com.  IN TXT "v=spf1 include:mail.example.com.example.net -all"

Than you can manage the mail system location with A record for mail.example.com.example.net. and SPF and TXT record mail.example.com.example.net..

This way the mail solution is practically delegated to the DNS records in your zone. So you can have something like this:

mail.example.com.example.net. IN A 192.0.2.10
mail.exmaple.com.example.net. IN TXT "v=spf1 A -all"
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .