fix: allow CNAME + other records when Cloudflare proxy is enabled

pkg/normalize/validate.go

@@ -636,12 +636,16 @@ func checkAutoDNSSEC(dc *models.DomainConfig) (errs []error) {
 
 func checkCNAMEs(dc *models.DomainConfig) (errs []error) {
 	cnames := map[string]bool{}
+	proxiedCnames := map[string]bool{}
 	for _, r := range dc.Records {
 		if r.Type == "CNAME" {
 			if cnames[r.GetLabel()] {
 				errs = append(errs, fmt.Errorf("%s: cannot have multiple CNAMEs with same name: %s", r.FilePos, r.GetLabelFQDN()))
 			}
 			cnames[r.GetLabel()] = true
+			if p, ok := r.Metadata["cloudflare_proxy"]; ok && (p == "on" || p == "full") {
+				proxiedCnames[r.GetLabel()] = true
+			}
 		}
 	}
 	for _, r := range dc.Records {
@@ -650,6 +654,12 @@ func checkCNAMEs(dc *models.DomainConfig) (errs []error) {
 			if r.Type == "AKAMAICDN" {
 				continue
 			}
+			// Cloudflare proxied (flattened) CNAMEs are resolved internally
+			// and never served as actual CNAME records, so the RFC 1034 §3.6.2
+			// restriction does not apply.
+			if proxiedCnames[r.GetLabel()] {
+				continue
+			}
 			errs = append(errs, fmt.Errorf("%s: cannot have CNAME and %s record with same name: %s", r.FilePos, r.Type, r.GetLabelFQDN()))
 		}
 	}

pkg/normalize/validate_test.go

@@ -342,6 +342,40 @@ func TestCNAMEMutex(t *testing.T) {
 	}
 }
 
+func TestCNAMECloudflareProxied(t *testing.T) {
+	// A proxied (flattened) CNAME should be allowed alongside other record types.
+	recCNAME := &models.RecordConfig{
+		Type:     "CNAME",
+		Metadata: map[string]string{"cloudflare_proxy": "on"},
+	}
+	recCNAME.SetLabel("mail", "mail.example.com")
+	recCNAME.MustSetTarget("example.com.")
+	recMX := &models.RecordConfig{Type: "MX"}
+	recMX.SetLabel("mail", "mail.example.com")
+	recMX.MustSetTarget("smtp.example.com.")
+	dc := &models.DomainConfig{
+		Name:    "example.com",
+		Records: []*models.RecordConfig{recCNAME, recMX},
+	}
+	errs := checkCNAMEs(dc)
+	if len(errs) != 0 {
+		t.Errorf("Expected no errors for proxied CNAME + MX, got: %v", errs)
+	}
+
+	// A non-proxied CNAME should still fail.
+	recCNAME2 := &models.RecordConfig{Type: "CNAME"}
+	recCNAME2.SetLabel("mail", "mail.example.com")
+	recCNAME2.MustSetTarget("example.com.")
+	dc2 := &models.DomainConfig{
+		Name:    "example.com",
+		Records: []*models.RecordConfig{recCNAME2, recMX},
+	}
+	errs2 := checkCNAMEs(dc2)
+	if len(errs2) == 0 {
+		t.Error("Expected error for non-proxied CNAME + MX, got none")
+	}
+}
+
 func TestCAAValidation(t *testing.T) {
 	config := &models.DNSConfig{
 		Domains: []*models.DomainConfig{