How to disable Sendmail expansion of CNAMEs for a particular domain but not globally

Would something like this work for you:

Thanks for updating your question, this makes the order of events much clearer. Unfortunately the behavior you're describing remains very puzzling from the perspective of a recursive DNS resolver. This is best illustrated through examples.

When the query isn't in cache, a recursive DNS server is going to send the following query to the authoritative nameserver:

Question: host1.example.com. IN A

The remote authoritative server will respond like so when an explicit A record is defined:

Answer: host1.example.com. IN A 2.2.2.2

Or like this if it's hitting the CNAME record:

Answer: host1.example.com. IN CNAME hostalias.example.net.

In both cases, the choice of whether the A record or CNAME record is served is determined by the authoritative server, not the recursive server. The recursive server is, as the name implies, recursing. The upstream client's request for host.example.com. IN A gets passed along unmodified unless additional queries are needed to arrive at the answer. (in this case, that would be an additional lookup for hostalias.example.net unless the authoritative nameserver can provide that answer within the same response)

Given this well understood behavior, the starting assumptions have to be treated as suspect. One of these facts is not 100% accurate:

• The order in which those records were defined.
• Verizon returning a response of 4.4.4.4. (i.e. response came from somewhere closer to your network, or even a host file)
• That all of your authoritative servers were returning the same response to that request.
• Operator error.
• Human memory.

I know that this is kind of a non-answer, but I don't think we can give you a better one without better documentation of what was going on during the event.