CNAME conflicts with MX and TXT records: "CNAME and other data"

What it means

A CNAME record says "this name is an alias of another name". The DNS rules (RFC 1034, confirmed by RFC 2181) say that if a name has a CNAME, it cannot have any other record: no MX, no TXT, no A. A name is either an alias or a real name with its own records, never both.

You usually see this in one of two ways:

• Your DNS host refuses to save the record, with a message such as "CNAME conflicts with existing records", "A CNAME record already exists for this name" or "CNAME and other data".
• Your DNS host accepts it anyway (some do), and then resolvers return inconsistent answers: SPF, DMARC or MX seem to appear and disappear, and email fails at random.

Why it happens

• CNAME on the root domain. A website builder or hosting platform tells you to point yourdomain.com (the apex, @) with a CNAME. The apex always has SOA and NS records and usually MX and TXT (SPF, verification), so a CNAME there is invalid.
• A subdomain used for both web and mail. For example shop.yourdomain.com is a CNAME to your store platform, and an email tool asks you to add an MX or SPF TXT on the same name.
• DKIM added twice. A selector like selector1._domainkey has a CNAME from one provider and a TXT from another setup.
• Verification TXT on a CNAME name. A tool asks for a TXT on www while www is a CNAME.
• DMARC on a CNAME. _dmarc.yourdomain.com as a CNAME is allowed (it delegates DMARC), but then you cannot also add your own TXT there.

How to check

1. Open the domain scanner and look at MX, SPF and DMARC. Missing or odd values on a name that should have them are a hint.
2. Ask for a CNAME on the exact name:

   dig CNAME yourdomain.com +short
   dig CNAME shop.yourdomain.com +short
   shops.platform.example.

   If this returns a target, that name can have nothing else.
3. Ask for MX and TXT on the same name:

   dig MX shop.yourdomain.com
   dig TXT shop.yourdomain.com

   If the answer section starts with a CNAME, you are seeing the target's records, not yours.
4. Send a test email to the unique address on the Delivmail home page (/) to see the SPF and DMARC results for the real sending domain.

How to fix it

CNAME on the apex

Replace it with something allowed at the apex:

• A/AAAA records with the IPs your web platform gives for apex domains.
• An ALIAS, ANAME or "CNAME flattening" record if your DNS host offers one (Cloudflare flattens a CNAME at the apex automatically). These answer with A records, so MX and TXT can live alongside.
• Or point only www with a CNAME and redirect the apex to www.

Before (invalid):
yourdomain.com.   CNAME  sites.platform.example.
yourdomain.com.   MX 10  mail.yourdomain.com.

After:
yourdomain.com.   A      203.0.113.80
yourdomain.com.   MX 10  mail.yourdomain.com.
yourdomain.com.   TXT    "v=spf1 ip4:203.0.113.25 ~all"
www               CNAME  sites.platform.example.

Subdomain used for web and mail

Use different names: keep shop.yourdomain.com as a CNAME for the website and send email from another subdomain such as mail.yourdomain.com or news.yourdomain.com, with its own MX and TXT. See email authentication for subdomains.

DKIM selectors

Keep one record per selector. If a provider uses CNAMEs (see DKIM with CNAME records), delete any TXT on the same selector name, or use a different selector for the other system.

Verification TXT on a CNAME name

Ask the tool if it accepts verification on another name (many do) or on the apex.

Check that it is fixed

After the old records' TTL has expired, dig CNAME on the name should return nothing where MX or TXT must exist, and dig MX / dig TXT should return your records directly. Check again with the domain scanner, then send a new Delivmail test and confirm SPF and DMARC pass. Send an email to an address on the domain to confirm reception works.