What Is a CNAME Record and When Does Email Setup Use One?

A CNAME record (canonical name record) tells DNS that one hostname is simply an alias for another. When a resolver looks up the alias, it follows the CNAME to the target and uses whatever records the target has. Email setup uses CNAMEs mainly for provider-managed DKIM keys and tracking domains, but never for the MX host and never at the root of your domain.

Quick summary

• Delegated DKIM: some services ask you to create selector._domainkey as a CNAME to a key they host, so they can rotate keys without you editing DNS again.
• Click and open tracking domains for newsletter tools, so links show your brand instead of the vendor.
• MTA-STS policy hosts, where mta-sts.yourdomain.com is often a CNAME to a provider that serves the policy file over HTTPS.
• Custom webmail addresses such as webmail.yourdomain.com pointing at a hosted login page, where the provider supports it.
• The root domain (@). The root already holds SOA and NS records, and a CNAME cannot coexist with any other record. Every compliant DNS server refuses it, and the ones that fake it (ANAME, ALIAS, CNAME flattening) are doing something else behind the scenes.

How a CNAME works

Suppose mail.yourdomain.com is a CNAME pointing to mail.oqumail.com. Anyone resolving the first name is silently redirected to the second, and the A, AAAA or TXT records of mail.oqumail.com are returned. The alias has no records of its own. That single rule, an alias name cannot hold any other record, explains every restriction that follows.

Example CNAME record

Type:   CNAME
Host:   news
Value:  tracking.newsletter-provider.com
TTL:    3600

Result: news.yourdomain.com -> tracking.newsletter-provider.com

Where email setup uses CNAMEs

• Delegated DKIM: some services ask you to create selector._domainkey as a CNAME to a key they host, so they can rotate keys without you editing DNS again.
• Click and open tracking domains for newsletter tools, so links show your brand instead of the vendor.
• MTA-STS policy hosts, where mta-sts.yourdomain.com is often a CNAME to a provider that serves the policy file over HTTPS.
• Custom webmail addresses such as webmail.yourdomain.com pointing at a hosted login page, where the provider supports it.

Where you must not use a CNAME

• The root domain (@). The root already holds SOA and NS records, and a CNAME cannot coexist with any other record. Every compliant DNS server refuses it, and the ones that fake it (ANAME, ALIAS, CNAME flattening) are doing something else behind the scenes.
• The MX target. Standards say the hostname in an MX records (the settings that tell the internet where to deliver email for your domain) must resolve directly to an address, not through a CNAME. Some senders tolerate it, some reject, so publish the MX as OquMail gives it: mail.oqumail.com, which has real A records.
• The same name as your SPF or DMARC TXT records (short text lines in DNS used for email security). If _dmarc is a CNAME, it cannot also hold a TXT record of its own; the TXT must live at the target.
• Any host that also needs a TXT verification token, for the same reason.

How to check a CNAME

1. Run nslookup -type=cname host.yourdomain.com or dig cname host.yourdomain.com.
2. The answer shows the canonical name. If it returns nothing, the name is not a CNAME.
3. Then resolve the target directly to confirm it has the records you expect.
4. If a service says verification failed, check whether your panel silently created an A record instead of a CNAME, or added the domain twice in the target.

CNAMEs in OquMail setup

OquMail does not require any CNAME. Your domain needs one MX records (the settings that tell the internet where to deliver email for your domain) and three TXT records (SPF, DKIM and DMARC), all of which you paste from the dashboard and verify with Check DNS. Keeping DKIM as a plain TXT record means you can see the exact key that is published, which makes troubleshooting straightforward. If a separate marketing tool asks for CNAMEs, they live on their own subdomains and do not conflict with OquMail.

Common questions

What is the difference between a CNAME and an A record?

An A record maps a name to an IPv4 address. A CNAME maps a name to another name and inherits whatever that name resolves to. Use A when you control the IP, CNAME when a provider may change theirs.

What is CNAME flattening?

A feature at Cloudflare and some other DNS hosts that lets you type a CNAME at the root, then serves A records to the world by resolving the target for you. It is a convenience for websites and does not change the rule for mail.

Can a CNAME point to another CNAME?

Yes, chains are allowed, but each hop adds a lookup and a chance of failure. Keep chains short, especially for anything mail-related.