CNAME flattening at the apex
Why some registrars break DKIM with CNAME flattening, and how Inboxlee handles it.
On this page · 2
- When it matters
- When you might still see it
A subset of DNS providers (Cloudflare, GoDaddy in some configurations) "flatten" CNAME records - they fetch the target and serve the resolved value directly, regardless of whether you set a TXT or a CNAME. Most of the time this is invisible. For DKIM it occasionally breaks.
When it matters
If your DKIM key is published as a CNAME pointing at the provider's public key, flattening can replace the CNAME with the resolved TXT value at unpredictable timing. During the rewrite, DKIM signatures may briefly fail.
Inboxlee avoids this by publishing DKIM as a direct TXT record, not a CNAME. There is no flattening risk because there is nothing to flatten.
When you might still see it
On a migrated domain that previously used a CNAME-style DKIM (some Workspace setup wizards do this), the migration scan flags it and rewrites to a direct TXT record. You will see a one-time DNS change during migration; this is expected.