As an experiment, I attempted to setup a CNAME for mail.mydomain.com pointing to mail.myisp.com, and using mail.mydomain.com instead of mail.myisp.com in setting up email clients connecting to that using TLS (aka SSL) for IMAP/POP/SMTP

One client (Thunderbird) accepted that without a warning. Another (Outlook) complained that the server has an incorrect certificate (and indeed it's certificate has no reference to mail.mydomain.com).

Is there some consensus as to which is right? What are the security ramifications?

Alternate formulation: when a client is setup with the name mail.mydomain.com for a TLS connection, and there's a CNAME for that resolving to mail.myisp.com, and mail.myisp.com ultimately leads to a server with a certificate for mail.myisp.com with no Subject Alternative Name referencing mail.mydomain.com, is it good practice to use the server without warning, as I think (not betting the house on that) Thunderbird did in my test?

  • Just to be clear: this has nothing to do with your domain's MX records, right? Also, I suspect your Thunderbird client might not be configured to use SSL/TLS, as it should give you the same error.
    – Adam Katz
    Sep 20, 2023 at 16:51
  • @Adam Katz: no, this has nothing to do with my domain's MX. This is strictly for access to email by email clients (and the idea, which I dropped since it does not work with Outlook, was to allow a seamless change of email provider without re-configuring email clients on D-day). My Thunderbird was configured to use SSL/TLS, hence my relative surprise that it seemed to work.
    – fgrieu
    Sep 20, 2023 at 17:08
  • 4
    The relevant part is what names are configured in the certificate vs. what names are used to access the site. If the name to access the site is not configured in the certificate then the validation will fail. It is unclear though if your mail client is configured to verify certificates in the first place - Thunderbird can be disabled to do this. Sep 20, 2023 at 18:03


You must log in to answer this question.

Browse other questions tagged .