3 ms·

25 years ago I added a rule to my employer’s firewall to allow the bare domain to work on our web server. Inbound email immediately broke. I was still very new

25 years ago I added a rule to my employer’s firewall to allow the bare domain to work on our web server. Inbound email immediately broke. I was still very new, and didn’t want to prolong the downtime, so I reverted instead of troubleshooting. A few months after I left, I sent an email to a former co-worker, my replacement, and got the same bounce message. I rang him up and verified that he had just set up the same firewall rule. Been much too long to have any clue now what we did wrong.

JackMcMack 4y ago
You probably created a cname from the apex to www? This problem still exists today. From https://en.wikipedia.org/wiki/CNAME_record https://en.wikipedia.org/wiki/CNAME_record: "If a CNAME record is present at a node, no other data should be present; this ensures that the data for a canonical name and its aliases cannot be different." So if you're looking up the MX record for domain, but happen to find a cname for domain to www.domain , it will follow that and won't find any MX records for www.domain. The correct approach is to create a cname record from www.domain to domain, and have the A record (and MX and other records) on the apex. Most DNS providers have a proprietary workaround to create dns-redirects on the apex (such as AWS Route53 Alias records) and serve them as A records, but those rarely play nice with external resources.
- tux2bsd 4y ago
  > You probably created a cname from the apex to You can't do that, period. A lot of "cloud" and other GUI interfaces deceive people into thinking it's possible, they just do A record fuckery behind the scenes (clever in it's own right but it causes misunderstanding).