What Is a CNAME Record? Understanding DNS Aliases

What Is a CNAME Record?

A CNAME record (Canonical Name record) creates an alias from one domain name to another. Instead of pointing directly to an IP address like an A record, a CNAME points to another domain name, which then resolves to an IP.

Think of it like mail forwarding — when mail arrives at one address, it automatically gets redirected to another address.

The Basics

• CNAME stands for "Canonical Name"
• Creates an alias that points to another domain name (the "canonical" name)
• The target domain must have its own A or AAAA record
• Cannot be used at the root domain (zone apex)

Example

; www points to the main site hosted on Netlify
www.example.com.    3600    IN    CNAME    example-site.netlify.app.

; Blog subdomain points to Ghost hosting
blog.example.com.   3600    IN    CNAME    example.ghost.io.

; Shop subdomain points to Shopify
shop.example.com.   3600    IN    CNAME    shops.myshopify.com.

How CNAME Records Work

When a DNS resolver encounters a CNAME record, it performs an additional lookup:

1. User requests www.example.com
2. DNS resolver finds CNAME — www.example.com → example-site.netlify.app
3. Resolver follows the chain — Looks up A record for example-site.netlify.app
4. IP returned — Gets 75.2.60.5 from Netlify's DNS
5. Connection established — Browser connects to that IP

CNAME Record Structure

The Resolution Chain

www.example.com
    ↓ CNAME
example-site.netlify.app
    ↓ A record
75.2.60.5

This extra step adds a small amount of latency but provides significant flexibility.

CNAME Limitations

Cannot Be Used at Root Domain

The most important limitation: CNAME records cannot exist at the zone apex (root domain).

; This is INVALID - will cause DNS errors
example.com.    3600    IN    CNAME    other-site.com.

; This is VALID - subdomain is fine
www.example.com.    3600    IN    CNAME    other-site.com.

Why? The DNS specification (RFC 1034) states that if a CNAME exists for a name, no other record types can exist for that same name. Since root domains need SOA and NS records, a CNAME would conflict.

Workarounds:

• Use A/AAAA records at the root domain
• Some providers offer "ALIAS" or "ANAME" records that behave like CNAMEs at the root
• Cloudflare's "CNAME flattening" automatically resolves CNAMEs to IPs at the root

Cannot Coexist with Other Records

A CNAME record for a hostname means no other record types can exist for that same hostname:

; INVALID - MX and CNAME cannot coexist for same name
mail.example.com.    3600    IN    CNAME    mailserver.provider.com.
mail.example.com.    3600    IN    MX       10 mailserver.provider.com.

; VALID - use different hostnames
mail.example.com.       3600    IN    A       198.51.100.25
example.com.            3600    IN    MX      10 mail.example.com.

CNAME Chains Add Latency

Each CNAME hop requires an additional DNS lookup. While usually negligible, long chains can slow resolution:

; Avoid long chains like this
alias1.example.com.  →  alias2.example.com.  →  alias3.example.com.  →  final.target.com.

Common Use Cases

1. Third-Party Hosting Services

Point subdomains to SaaS platforms that manage their own infrastructure:

; Shopify store
shop.example.com.       3600    IN    CNAME    shops.myshopify.com.

; HubSpot landing pages
landing.example.com.    3600    IN    CNAME    example.hs-sites.com.

; Zendesk help center
help.example.com.       3600    IN    CNAME    example.zendesk.com.

2. CDN and Cloud Services

Let CDN providers manage IP addresses:

; Cloudflare CDN
cdn.example.com.        300     IN    CNAME    example.cdn.cloudflare.net.

; AWS CloudFront
assets.example.com.     300     IN    CNAME    d1234abcd.cloudfront.net.

; Azure CDN
static.example.com.     300     IN    CNAME    example.azureedge.net.

3. www to Root Domain

A common pattern — redirect www to the main site:

; If using ALIAS/ANAME at root
example.com.        300     IN    ALIAS    example.netlify.app.
www.example.com.    3600    IN    CNAME    example.com.

4. Development and Staging Environments

Point test environments to development servers:

staging.example.com.    300     IN    CNAME    example-staging.herokuapp.com.
dev.example.com.        300     IN    CNAME    dev-example.vercel.app.

5. Email Service Verification

Email providers often require CNAME records for DKIM and domain verification:

; Microsoft 365 DKIM
selector1._domainkey.example.com.    3600    IN    CNAME    selector1-example-com._domainkey.example.onmicrosoft.com.
selector2._domainkey.example.com.    3600    IN    CNAME    selector2-example-com._domainkey.example.onmicrosoft.com.

; Google Workspace verification
em1234.example.com.    3600    IN    CNAME    u1234567.wl001.sendgrid.net.

Best Practices for MSPs

1. Document the Purpose

Always record why a CNAME exists:

• What service it points to
• Which client owns it
• When it was created
• Expected behavior if the target changes

2. Use Short TTLs for Dynamic Services

Services that might change their infrastructure benefit from lower TTLs:

3. Verify Target Availability

Before creating a CNAME, verify the target domain:

• Exists and resolves
• Has valid SSL certificates for HTTPS
• Is controlled by the expected party

# Verify target resolves
dig example-site.netlify.app A

# Check SSL certificate
curl -I https://example-site.netlify.app

4. Monitor CNAME Chains

Audit for unintended chains that add latency:

# Check full resolution chain
dig +trace www.example.com

5. Plan for Root Domain Access

Since CNAMEs can't be used at the root:

• Use A records with the provider's IPs
• Use ALIAS/ANAME if your DNS provider supports it
• Set up redirects from root to www (or vice versa)

Troubleshooting CNAME Records

CNAME Not Resolving

# Check if CNAME exists
dig www.example.com CNAME

# Follow the full chain
dig +trace www.example.com

Common causes:

• Target domain doesn't exist or has no A record
• CNAME at root domain (invalid)
• Conflicting records for the same hostname
• DNS propagation not complete

SSL Certificate Errors

When using CNAMEs with HTTPS, the SSL certificate must be valid for your domain:

• The target server needs a certificate covering your hostname
• Or your CDN/proxy must terminate SSL with your certificate
• Services like Cloudflare, Netlify, and Vercel handle this automatically

CNAME Conflicts

If you're getting unexpected results:

# Check for all record types
dig example.com ANY

Remove conflicting records before adding a CNAME.

Frequently Asked Questions

Can I use a CNAME for the root domain?

No, CNAME records cannot be used at the zone apex (root domain) per DNS specifications. Use A records, or if your provider supports it, ALIAS/ANAME records which provide similar functionality.

What's the difference between CNAME and A records?

A records point directly to an IP address. CNAMEs point to another domain name. CNAMEs are useful when you don't control the IP (like with cloud services), while A records are better when you need the root domain or when you control the server.

Can I have multiple CNAMEs for the same hostname?

No, you can only have one CNAME record per hostname. If you need to point to multiple targets, you'll need to use a different approach like a load balancer.

Does using CNAME affect website speed?

Slightly. Each CNAME adds one additional DNS lookup. In practice, the difference is usually negligible (a few milliseconds) and the flexibility often outweighs the minor latency.

Can I use CNAME with MX records?

Not for the same hostname. The MX record's mail server target can be a hostname that has a CNAME, but the MX record itself cannot coexist with a CNAME for the same name.

Get Started with Unified DNS

CNAME management across multiple clients and DNS providers can get complex quickly. Unified DNS lets you view, modify, audit, and backup all your DNS records from a single dashboard — with automated backups and Hudu documentation syncing built in.

Unified DNS is live — try it free for a month with code FREETRIAL2026 at billing setup. No commitment. Or request a demo for a walkthrough.