Loading Empire…

Skip to content

Learn Fix Tools

Search/

Appearance

Filter problems…

SPF Problems
DKIM Problems
DMARC Problems
DNS & Infrastructure Problems
Delivery Problems
Inbox Placement Problems
Provider Problems
Reputation Problems
Campaign Performance Problems
- High unsubscribe rate
- Low open rate
Warmup Problems

Home
Fix
DNS & Infrastructure Problems
CNAME at zone apex

CNAME at zone apex

A CNAME is placed at the zone apex where other record types are also required.

Reading time:: 5 min
Difficulty:: Advanced
Estimated duration:: 5 min
Prerequisites:: None
Last updated:: 2026-07-15
Author:: empire

Problem summary

A CNAME is placed at the zone apex where other record types are also required.

Severity: High

Symptoms

MX, NS, or SOA conflicts with an apex CNAME
Mail or delegation breaks after apex CNAME publication

Possible causes

Misconfiguration
Incomplete rollout
DNS propagation delay

How to diagnose

Confirm the symptom in headers or reports
Inspect the relevant DNS records
Validate with a trusted checker

How to fix

Correct the DNS or signing configuration
Re-test and confirm alignment where required

How to verify

Re-check DNS
Send a test message
Confirm expected authentication results

Prevention

Document changes
Monitor reports after deployment

When to escalate

Production mail is failing authentication after a change window

CNAME recordsDNS aliases often used for DKIM selectors and vendor CNAMEs.

HELO / EHLO problemsThe SMTP HELO/EHLO hostname is missing, invalid, or inconsistent with reverse DNS.
Inconsistent authoritative answersAuthoritative name servers for the same zone return conflicting data.
Incorrect MX targetMX points to the wrong host name or unreachable mail server.
Missing glue recordsDelegation references in-bailiwick name servers without required glue.
MX record missingNo MX record is published for a domain that should receive mail.
NXDOMAIN for expected nameA name that should exist returns NXDOMAIN from authoritative servers.
Reverse DNS mismatchPTR (reverse DNS) for a sending IP is missing or does not match the forward hostname used in mail.
Stale DNS cache after changeResolvers still serve prior answers after an authoritative change because TTL has not expired.
Wrong TTL for cutoverTTL values are too high for a planned cutover, prolonging mixed old/new answers.

digCLI DNS lookup utility for authoritative and recursive inspection of mail-related records.
nslookupInteractive DNS lookup utility commonly used for quick MX and TXT checks.
Google Admin Toolbox DigBrowser-based dig-style DNS lookup from Google’s Admin Toolbox.
Google Admin Toolbox CheckMXGoogle Admin Toolbox Check MX for inbound mail DNS sanity checks.

PreviousDNS & Infrastructure Problems NextHELO / EHLO problems

Company

About
Contact
Services

Platform

Learn
Fix
Tools

Community

Empire is a living operator community — share practice, follow releases, and help shape the knowledge base.

Newsletter — coming soon

Legal

Privacy Policy
Terms of Use
Disclaimer
Editorial Policy
Cookie Policy

© 2026 Empire Email

Independent educational platform focused on email infrastructure, deliverability, and lifecycle marketing.