...

You shouldn't use a CNAME for a host that you want to receive mail. I suggest you try changing it to an A record instead.

To quote RFC1123 section 5.2.2:

The domain names that a Sender-SMTP sends in MAIL and RCPT commands MUST have been "canonicalized," i.e., they must be fully-qualified principal names or domain literals, not nicknames or domain abbreviations. A canonicalized name either identifies a host directly or is an MX name; it cannot be a CNAME.

Can someone explain why this restriction exists (or point to a good resource)?

One obvious point is DNS inefficiency. If the sending MTA gets back an answer to an MX query pointing to a CNAME it then has to query again to get the A record. If there is a CNAME chain (and there may well be) then there have to be multiple queries until the A record is reached. Check out the Bat book.

Mick