The subdomain marthastewart.msn.com pointed by CNAME to msnmarthastewartsweeps.com, a domain nobody had owned for 21 years. In September 2022, someone bought it. From then on they controlled the DNS answers for that subdomain, SPF included, and their servers could send authenticated mail as marthastewart.msn.com. Guardio Labs documented the case on February 26, 2024, in its SubdoMailing report.
A CNAME (Canonical Name) record is a DNS alias: the name that carries it points to another name, and the resolver picks up that name’s answers. It plugs a subdomain into a third-party service, an ESP for instance, without copying its IP addresses. You create it in a few lines of the DNS zone and check it with dig. Forgotten after you cancel the service, it becomes an open door.
What a CNAME record is
A CNAME is a DNS alias: one name that points to another name. RFC 1034 (section 3.6.2, published in November 1987) defines it. The record declares its owner an alias and puts the canonical name in the record data. In the RFC’s example (USC-ISIC.ARPA as a CNAME to C.ISI.EDU), when a name server finds no record of the requested type on a name that carries a CNAME, it returns the CNAME and restarts the query on the target. Only a query for the CNAME type itself is not restarted.
In a DNS zone, a record looks like this: links.yourdomain.com. 3600 IN CNAME target.esp-example.net. The trailing dot marks a fully qualified name, and 3600 is the TTL in seconds. RFC 2181 (July 1997) sets the vocabulary: the label that carries the CNAME is the alias, and the value is the canonical name.
A target can itself be a CNAME. RFC 1034 asks software to follow these chains and to report loops as an error. Each extra link costs one more query.
CNAME or A record: which one to pick
Pick a CNAME when the service hands you a name (CDN, SaaS, ESP), and an A or AAAA record when you have an IP address. RFC 2181 (section 10.1) states the underlying rule: for a given name, either a CNAME exists alone, or records of other types exist, or the name is empty. A CNAME therefore rules out any neighbor under that name.
| Criterion | A / AAAA | CNAME |
|---|---|---|
| Value | An IPv4 address (A) or an IPv6 address (AAAA) | A domain name |
| The provider changes its IP address | You edit the record | Nothing to do, the target name follows |
| Other types alongside it (MX, TXT) | Allowed | Ruled out |
| Root domain (apex) | Yes | Not in standard DNS |
| DNS queries | One | At least one more |
A CNAME covers IPv4 and IPv6 in one go, where you would otherwise need an A (IPv4) and an AAAA (IPv6): the target supplies its own A and AAAA records, and you maintain a single line. It fits when a CDN or SaaS platform publishes a name rather than an address. For a custom domain on that kind of service, the CNAME carries no certificate: the service has to issue a TLS certificate for your name, or the browser shows an error.
CNAME on the root domain or on www
On the root domain, no. The apex of a zone always carries SOA and NS records, which rules out a CNAME under the previous rule. Most domains also put their MX records there. RFC 2181 (section 10.3, July 1997) also forbids an MX or NS from pointing to an alias: the value must resolve directly to addresses.
The usual home for a CNAME is www. You write www.yourdomain.com as a CNAME to the service; the root points to www with an HTTP redirect.
Some DNS providers work around the limit. Cloudflare’s documentation says CNAME flattening allows a CNAME at the root: Cloudflare resolves the target, through several CNAMEs if needed, and returns the final IP address instead of the CNAME. The feature is on by default for every plan when the root is a CNAME.
What a CNAME does in email sending
A CNAME publishes your DKIM keys at the provider, puts your name on click-tracking links and isolates a sending subdomain. Domain authentication drives email deliverability. At Brevo it has been mandatory since February 1, 2024, in line with Gmail and Yahoo requirements. The three platforms in the table all ask for CNAMEs under your domain, with variations.
| Platform | CNAMEs requested | Purpose |
|---|---|---|
| Twilio SendGrid | 1 CNAME for the sending domain and 2 link-branding CNAMEs | SPF and DKIM for the first, click and open tracking for the other two |
| Microsoft 365 | 2 DKIM selector CNAMEs (selector1._domainkey and selector2._domainkey) | Point to the DKIM public keys |
| Brevo | 2 DKIM CNAMEs or 1 TXT record, depending on the account | Sign messages in the name of your domain |
For DKIM, the CNAME leaves the public key at the provider: you publish the pointer, and it keeps control of the key. Microsoft 365 runs two key pairs, hence its two selector CNAMEs. The signature then carries your domain in the d= tag. That detail matters for DMARC: Microsoft states that DKIM only passes DMARC when the signing domain is aligned with the domain of the From address. The mechanism is covered in the article on how DKIM works.
A custom tracking domain replaces the provider’s generic domain in click links. With a generic domain, the links of all the provider’s customers share one name. With yours, the reputation of those links belongs to you. The sender-side steps are described in the article on customizing sender DNS.
A CNAME also isolates reputation. Microsoft advises a subdomain for bulk sending you do not fully control (marketing.contoso.com, for example). The choice of IP address is separate: a shared or dedicated IP. A new subdomain starts with no history, so warm it up gradually before raising volume. The limits of the approach are discussed in the article on sending subdomains. The bounce domain (the Return-Path) and confirmation messages (transactional emails) follow the same principle.
Setting up a CNAME step by step
You need access to the DNS zone, hosted at your registrar or at a dedicated provider.
- In the sending or hosting platform, open the domain authentication page (at Brevo: Settings > Senders, Domains, IPs > Domains > Authenticate) and copy each name + value pair without changing it.
- Open the domain’s DNS zone and look up the name to create. Check that no other record exists on it (A, AAAA, TXT, MX). If one does, the RFC 2181 rule blocks the creation.
- Add the record: type CNAME, name (the subdomain alone in most interfaces, for example links or s1._domainkey), target (the name you were given, with a trailing dot if the interface asks for one).
- Leave the default TTL on the first try. Lower it to a few minutes only if you expect to change the record.
- On Cloudflare, set the record to “DNS only” (grey cloud). Keep the option that flattens all CNAMEs turned off, or the next step will fail.
- Check with dig or nslookup (next section), then start the validation from the provider’s interface.
If your DNS host refuses underscores in a CNAME name, you cannot publish the DKIM selectors (“_domainkey”). Twilio flags this case for its automated security feature. If it happens, contact the platform’s support or your DNS host’s.
Checking a CNAME with dig and nslookup
Run “dig links.yourdomain.com CNAME +short”. The answer shows the target, with its trailing dot. An empty answer means no CNAME is visible from your resolver.
The full chain appears with “dig links.yourdomain.com A”. The ANSWER section lists the CNAME, then the target’s addresses. On Windows, nslookup ships with TCP/IP: “nslookup -type=CNAME links.yourdomain.com 8.8.8.8” queries Google’s public resolver and prints a “canonical name =” line.
Your local resolver may be holding the old answer in cache. To query the source, get the name servers with “dig yourdomain.com NS +short”, then run “dig @ns1.example.net links.yourdomain.com CNAME” (replacing ns1.example.net with one of them). If the authoritative server answers correctly, your record is published.
TTL and propagation: how long to wait
The TTL is the time, in seconds, that a resolver keeps an answer before revalidating it. At Cloudflare, the Auto value of a proxied record is 300 seconds. An answer cached before your change keeps being served until its TTL runs out.
For a replacement, the delay depends on the old record’s TTL. Twilio says DNS changes can take up to 48 hours: run the check again after that. Lower the TTL the day before a migration.
Errors that break a CNAME
- A TXT, A or MX record already on the same name: a name that carries a CNAME can carry nothing else.
- The domain typed twice: some interfaces append the domain on their own, so links.yourdomain.com becomes links.yourdomain.com.yourdomain.com.
- A proxied or flattened CNAME at Cloudflare: the resolver receives IP addresses instead of the expected CNAME, and the sending provider does not recognize the record. Cloudflare’s documentation warns that flattening all CNAMEs can make a third party’s domain verification fail.
- A target that no longer resolves: after flattening, Cloudflare returns an empty answer (NODATA), which looks like a propagation delay when the target is actually broken.
- A name over the limits: a label holds at most 63 characters and the full name 253, according to Cloudflare’s documentation.
- A check that still fails after 48 hours: Twilio SendGrid then asks you to contact its support, because the propagation delay has passed.
- An MX that points to a name that is itself a CNAME, which RFC 2181 forbids.
Dangling CNAMEs and subdomain takeover
A dangling CNAME points to a resource that no longer exists. Microsoft describes the scenario: you create greatapp.contoso.com as a CNAME to a hosted application, then delete the application but not the CNAME. A third party recreates a resource with an identical name, and your subdomain now serves their content. Microsoft lists two consequences: cookies harvested from subdomains and a valid TLS certificate obtained for the hijacked subdomain.
For email, the subdomain inherits the records of its target, SPF included, as the MSN case shows. In its February 2024 report, Guardio counted more than 8,000 affected domains, among them brands such as eBay, VMware and McAfee.
Audit your zone: for every CNAME you export, query the target with dig and look for “NXDOMAIN” answers or the service’s “resource not found” pages. Delete the CNAME as soon as you cancel a tool, before you close the account.
Frequently asked questions
Can a CNAME point to an IP address?
No. A CNAME’s data is a domain name. For an IP address, use an A (IPv4) or AAAA (IPv6) record.
Can you put two CNAMEs on the same name?
Nor can you. RFC 2181 (section 10.1) allows a single canonical name per alias. If two services both want that alias, give each its own subdomain.
CNAME or 301 redirect?
A CNAME resolves a name in DNS and leaves the URL unchanged. A 301 redirect is an HTTP response that changes the displayed URL and tells Google the page has moved. For a site address change, use the redirect.
Validate your list before the next send
Clean DNS does not remove nonexistent addresses from your file: a hard bounce happens whatever the CNAME. CaptainVerify sorts each address into one of six statuses (valid, invalid, unknown, free, risky, disposable). It gives 100 email credits when you create an account. Test your next list before sending.
