What Is a CNAME Record?
TL;DR
A CNAME record is a DNS record that makes one name an alias for another, so a lookup follows the alias and returns whatever the target publishes. Email platforms use CNAMEs to keep control of records they need to change, including DKIM keys and tracking link hostnames.
Why do email providers ask for CNAMEs?
So they can change the value without asking you again. Microsoft 365 publishes DKIM this way: you add selector1._domainkey and selector2._domainkey as CNAMEs pointing into a Microsoft-hosted zone, and the key material stays on their side where it can be rotated.
The same reasoning covers tracking and click hostnames. A CNAME on a subdomain of yours delegates the answer to the platform, which is what lets tracked links carry your own domain instead of a shared one.
What rules does a CNAME have to follow?
A name holding a CNAME may hold no other records, because the alias has to resolve to exactly one place. That is the whole rule, and everything else follows from it.
The consequence people meet first is at the apex of a zone, the bare domain. An apex must carry SOA and NS records to exist at all, so it cannot also carry a CNAME. Providers work around this with flattening or an ALIAS type, which behaves like an apex alias while publishing an address.
How does a CNAME affect email authentication?
It is followed transparently, so a receiver fetching a DKIM key at selector1._domainkey.yourdomain.com ends up reading the TXT record in the target zone and never notices the indirection. The same holds for a DMARC or MTA-STS record reached through an alias.
The failure mode is publishing the wrong type. When a provider asks for a CNAME and a TXT record is created instead, the record exists, a checker may even find text there, and the provider still reports the setup as missing.
Frequently asked questions
Not a real one. The apex already carries SOA and NS records, and a CNAME cannot share a name with other records. Some DNS providers offer flattening or an ALIAS type that behaves the same way from outside while publishing an address.