Why can't I use a cname/alias in the permissions table? At work we have a usual setup with web server(apache) and database server(mysql). From time to time there is the need to migrate the web stuff to a new server. Lets say their a records are dull and shiny with cname www for dull, which we want to reassign to shiny, when shiny is set and done.

We - trying to be good admins - want to restrict database access as much as possible and only gave access to 'dbuser'@'dull'. But what we really want is to give access to 'dbuser'@'www', so that after reassigning the cname we don't need to alter the permissions.

I read that mysql does a reverse looup of the IP and then a lookup of the a record and will fail if anything in this process is fishy.

Why is there such a strict policy on this? Is there a reason why I can't use a cname in the permissions?

Bonus Question: What can I do to accomplish easy migration?

Edit: Split of bonus question
Plan A:  If dull and shiny don't change, leave both in effect?...

GRANT ... TO dbuser@dull ...;
GRANT ... TO dbuser@shiny ...;


But, beware, this could leave the "production" system accessible to "QA".  (Assuming that is really what you are doing.)

Plan B:  A simple script (after transferring):

UPDATE mysql.user SET host = 'shiny' WHERE host = 'dull';


But, again, beware -- If the script fails to be run successfully, QA could be hitting production.

Plan C:  Well, there is likely to be some other trick.