Mail is arriving. Is this actually a problem?

Yes, and the fact that it is arriving is what makes it hard to take seriously. Permissive senders deliver, strict ones do not. You are losing some inbound mail without any signal that it happened.

Why do the standards prohibit it?

To avoid ambiguity and extra lookups during delivery, and because aliasing a mail exchanger creates chains that can loop or resolve inconsistently. The MX target is defined as a host with address records.

Can I point an MX at a name in another domain?

Yes. The target may be in any domain, which is exactly what happens when you point at a hosted mail provider. The requirement is about the record type it resolves to, not where it lives.

What about apex CNAME flattening at my DNS provider?

If the provider flattens the alias and returns address records in the answer, the MX target resolves to an address and is acceptable. The distinction is what the resolver receives, not what the panel calls the record.

MediumInfrastructure

An MX record points at an alias

An MX record points at a hostname that is itself a CNAME. The mail standards prohibit this: an MX target must resolve directly to an address record. Some sending servers follow the CNAME anyway and mail works; others refuse and the delivery fails. The result is mail that arrives from some senders and not others, with no pattern visible from your side.

Check your own domainMX lookup

What causes this

RFC 2181 states that the target of an MX record must not be an alias. Many mail servers follow the CNAME anyway and delivery works, but some refuse, and the behaviour is not guaranteed. It is the kind of fault that produces intermittent delivery failures from a minority of senders, which makes it unusually hard to diagnose.

What it breaks

Some sending servers may fail to deliver mail to your domain, inconsistently and without an obvious cause.

What the receiving server does

RFC 5321 requires that the hostname in an MX record resolve to an address record, not to an alias. Implementations differ in how strictly they enforce this. Permissive senders chase the CNAME, find the address and deliver. Strict ones treat the configuration as invalid and reject or defer. Because large mail platforms sit on both sides of that line, the symptom is partial and intermittent inbound failure: the hardest kind to diagnose, because a test from your own account usually works.

Alias in the chain

The fix is to point the MX at a name that has A or AAAA records directly. Where the provider gives you a hostname, use theirs rather than creating a local alias for it.

MX10 mail.example.com.the target of the MX record

thenmail.example.com CNAME host.provider.net.an alias (this is what breaks it)

fix10 host.provider.net.point the MX at the provider's hostname directly

ormail.example.com A 203.0.113.10replace the alias with address records on the same name

How to fix it

Point the MX record at a hostname that has A or AAAA records directly.

Find the hostname the CNAME ultimately resolves to.
Change the MX record to name that hostname instead, or ask your provider for the correct direct target.

If you send with

Where the alias usually comes from: It is normally created for tidiness: a local name like mail.yourdomain.com that points at the provider's host, so the MX record reads nicely. The intention is reasonable and the result is a configuration outside the specification. Point the MX at the provider's hostname instead.
CDN and proxy providers: Some DNS providers implement apex aliasing with a CNAME-like record that flattens to address records at query time. Those are usually safe as MX targets because what resolves is an address, not an alias. Verify what actually returns rather than assuming from the record type in the panel.

Confirming the fix worked

Resolve each MX target and confirm it returns A or AAAA records directly, with no CNAME in the chain.
Where an alias exists, repoint the MX record at the provider's hostname.
Confirm no MX target is a name you have aliased elsewhere in the zone.
Send test mail from more than one provider, since this failure is partial by nature and one test can easily pass.

Common questions

Mail is arriving. Is this actually a problem?: Yes, and the fact that it is arriving is what makes it hard to take seriously. Permissive senders deliver, strict ones do not. You are losing some inbound mail without any signal that it happened.
Why do the standards prohibit it?: To avoid ambiguity and extra lookups during delivery, and because aliasing a mail exchanger creates chains that can loop or resolve inconsistently. The MX target is defined as a host with address records.
Can I point an MX at a name in another domain?: Yes. The target may be in any domain, which is exactly what happens when you point at a hosted mail provider. The requirement is about the record type it resolves to, not where it lives.
What about apex CNAME flattening at my DNS provider?: If the provider flattens the alias and returns address records in the answer, the MX target resolves to an address and is acceptable. The distinction is what the resolver receives, not what the panel calls the record.