How Do I Handle the Conflict Between CNAME and MX Record Sets?

Background

If your enterprise purchases a domain name for end users to access the website of your enterprise and for employees to access the office mailbox of your enterprise. Appropriate record set configuration is necessary.

For access acceleration or secure purposes, cloud services such as CDN, WAF, and OBS are configured for the website. In this case, A record sets cannot be configured to map the domain name to the IP address of the website. Instead, CNAME record sets are required to map the domain name to the domain name of the cloud service such as CDN, WAF, or OBS. The standard DNS protocol does not allow the same domain name to have both CNAME record sets and other types of record sets such as MX record sets at the same time. If a domain name is used for accessing the website and for accessing the enterprise office mailbox as well, the mailbox may be unavailable when there is a conflict between CNAME record sets and MX record sets.

If this happens, refer to this FAQ to solve the problem. Domain name example.com is used as an example here.

(Recommended) Universal Solution

Accessing a website

1. Add an A record set for mapping example.com to the IP address of the website.
2. Add CNAME record sets for mapping www.example.com to the domain names of the cloud services such as CDN, WAF, or OBS.
3. Configure 301/302 redirection for the website IP address to redirect example.com to www.example.com.

Accessing a mailbox: An MX record set and an A record set can coexist for the primary domain name example.com.

For details about how to add an A, CNAME, or MX record, see Adding Record Sets.

(Not Recommended) Alternative Solution

If 301/302 redirection cannot be configured and you want both a CNAME record set and an MX record set to be configured for example.com, the office mailbox of your enterprise may become unavailable.

If a local client first accesses the website using example.com, the domain name is mapped to www.example.com.c.cdnhwc1.com (domain name of CDN). The local DNS server caches the CNAME value based on the TTL. If at this time the local client accesses the mailbox, the MX record set configured for example.com is requested. Because the local DNS server has already cached the CNAME value of example.com, the local DNS directly returns www.example.com.c.cdnhwc1.com. As a result, the request to the MX record set fails. The email sending and receiving of the mailbox is affected and will restore only after the cache of the CNAME value expires.

You can refer to the following configuration:

Accessing a website: Add a CNAME record set for example.com to map the domain name to the domain name of the cloud service such as CDN, WAF, or OBS.

Accessing a mailbox: Add an MX record set for example.com using a different line to avoid conflicts with the CNAME record set.

This solution cannot prevent the situation where the mailbox may become unavailable. Evaluate the risks carefully.