Free tool
Where does this CNAME end up?
The alias on a name, every link in the chain it crosses, and the address it ends at, or the finding that it ends nowhere. Enter a subdomain if you like: www.example.com is exactly the kind of name that carries an alias.
An alias outlives the service it pointed at
You wire a subdomain to an online tool, use it for a year, then close the account. The CNAME stays. It points at a name that no longer exists. The day somebody else claims that name at the same host, they serve whatever they like under your domain, with your name in the address bar and your certificate over the top.
A DNS panel only ever shows one link
Your host's panel shows the alias you created and nothing else. It will not tell you that the target is itself an alias, or that the third one resolves to no address at all. The tool unrolls the whole chain and follows it to the final address, and that is where dangling aliases and loops show up.
The exclusivity rule
An alias insists on living alone
A CNAME never says as well as. It says instead of, and everything about that name goes elsewhere. Which is why it cannot share the spot with a single other record. Try putting one in each of these two boxes.
example.com
The root of the domain
Records placed at this name
- SOABirth certificate of the zone
- NSns1.example.net
- MXmail.example.com
- A203.0.113.10
www.example.com
A subdomain, empty for now
Records placed at this name
- No record
The rule comes straight from the original DNS specification. If a CNAME is present at a name, no other data should be there (RFC 1034).
The recurring question
Can you put an alias on the root domain?
No.
And no host can change that. The root necessarily carries its nameservers and its origin record, and once a name carries an alias, everything else on that name gets ignored. The ban comes from the definition of DNS itself (RFC 1034), not from a limitation at your provider.
What you do instead
An address record
You declare the address directly on the root. It works everywhere — but you have to change it yourself the day the target moves.
Your provider's flattening
Under the names ALIAS, ANAME or CNAME flattening, the nameserver resolves the target and answers with an address. No standard defines them, so the behavior depends on the provider.
A web redirect
The visitor reaches the root, then the server sends them on to www. It happens after the connection, so it does not replace the alias. It moves the problem.
Reading the result
The table gives the chain in order, one link per row. The findings below are about the far end of it — what the name actually reaches, if it reaches anything.
- All clear — the alias lands somewhere
- One hop, and the target resolves to an address. This is what you want on a www, or on a subdomain wired to a service.
- All clear — no alias on this name
- The name carries none, and nothing is wrong with that. On a root domain it is the rule — an alias cannot sit alongside the records a root has to carry. So the tool looks at www in front of the name instead, which is where one usually turns up.
- Worth watching — a chain of several aliases
- The alias points at an alias, which points at another. Every link is one more lookup before the first connection, and one missing link is all it takes for the name to stop answering.
- Problem — dangling alias
- The chain ends at a name that resolves to no address. The subdomain leads nowhere, and if the target belongs to a host that hands its names out on request, someone else can claim it.
- Problem — the chain runs in circles
- One link points back at a name the chain already crossed. No resolver gets out of that, and the name answers nothing at all.
- Problem — the name does not exist
- No nameserver knows this name. The problem is not a missing alias — the name is not declared anywhere.
- Undetermined — no answer in time
- The resolver came back with nothing in time. That happens on a slow zone, and it tells you nothing about the name you asked for.
The mistakes we see most often
A CNAME was created on the root domain
What causes it: you want to wire example.com to a host that only hands you a name, so you try an alias at the root. Some providers refuse it outright. Others accept it and then ignore it, which takes the mail down with it, because an alias shuts out every other record on the same name.
What fixes it: use whatever mechanism your host offers for the root — every provider calls it something different — or fall back on an address record plus a redirect from the root to www.
The CNAME sits alongside an MX or a TXT on the same name
What causes it: the rule is old and it has no exceptions. The moment a name carries an alias, it carries nothing else. The MX and the TXT you entered beside it get ignored, and the panel often says nothing about it.
What fixes it: move the other records to a separate name, or replace the alias with an address record.
The service was shut down, the alias stayed
What causes it: the online tool shut down, or the account was cancelled. The subdomain keeps pointing at an empty target. That is a dangling alias, and it is the way in for a subdomain takeover.
What fixes it: delete the alias when you delete the account. A regular sweep of your subdomains saves you from finding twelve of these at once.
A full web address was entered as the value
What causes it: someone pastes https://app.example.net/ into the field. An alias wants a domain NAME — no protocol, no slash, no path. The provider either rejects the value or publishes a name that matches nothing.
What fixes it: enter the name and nothing else. Sending a visitor to a precise address takes a redirect, and that is configured on the web server, not in DNS.
The alias works, the certificate does not
What causes it: the alias does send the visitor to the right server, but that server has no certificate covering YOUR name, because nobody told it that it answers to that name. The browser throws a full-screen warning.
What fixes it: declare the custom name on the service's side and wait for it to issue the matching certificate. That is a separate step, and creating the alias does not trigger it.
What an alias can and cannot do
Almost every difficulty comes down to three rows of this table, and to one rule behind all of them. A name that carries an alias carries nothing else.
| Case | Possible? | The reason |
|---|---|---|
| Aliasing a subdomain | Yes | What it was built for — www, blog, shop, all pointing at a service's name. |
| Aliasing the root domain | No | The root must carry its nameservers and its origin record. An alias cannot coexist with them. |
| Keeping an MX or a TXT alongside | No | The same rule. Once a name carries an alias, everything else on that name gets ignored. |
| Pointing at another alias | Yes | Nothing forbids it, but each link costs one more lookup, and one broken link is enough to break the chain. |
| Pointing at an IP address | No | An alias's value is a name. An address is declared with an address record. |
| Pointing at a name in another domain | Yes | The most common case of all — a subdomain on your side, a target at a host. |
| Containing a full web address | No | DNS knows nothing of protocols or paths. A redirect happens at the web server. |
| Being the target of an MX or a nameserver | No | Both of those fields require a name that carries its address directly. |
| Having its own lifetime | Yes | The alias and its target each have one, and those are two separate memories that expire independently. |
The ban on an alias sitting beside other records comes from the definition of DNS (RFC 1034). The ban on making it the target of an MX or a nameserver comes from RFC 2181.
Alias, address record, redirect: which does what
These four produce similar effects and none of them replaces another. Three live in DNS, the last one in the web server, and mixing up the two worlds is what stalls most go-lives.
| Mechanism | Where it lives | What it actually does |
|---|---|---|
| CNAME | In DNS, standard and universal | Sends the resolver to another name, which it must then resolve in turn. Forbidden at the root. |
| Address record | In DNS, standard | Gives the address directly. Works everywhere, root included, but the address is frozen — if the service changes its own, your name points at nothing. |
| ALIAS, ANAME, CNAME flattening | In DNS, specific to each host | The nameserver resolves the target itself and answers with an address. From the outside it looks like an address record, which is what makes it usable at the root. Cloudflare and several other providers offer it, under different names. |
| HTTP redirect | In the web server, after the connection | Sends the visitor to another address. It fires too late to stand in for an alias — the encrypted connection is set up first, so the starting name already needs a valid certificate. |
ALIAS, ANAME and CNAME flattening are proprietary implementations. No standard defines them, and their exact behavior depends on the provider. Only CNAME and the address record behave identically everywhere.
Common questions
What is a CNAME record?
It is an alias. It declares that one name is another name. A resolver that hits it drops the name it was asked about and starts over on the target. That is what lets you wire shop.example.com to a platform without ever knowing its address, or chasing it when it changes.
Can I put a CNAME on the root domain?
No. A domain's root has to carry its nameservers and its origin record, and an alias cannot sit beside any other record on the same name. Several hosts work around it with an in-house mechanism that resolves the target on their side and answers with an address, and each of them calls it something different.
CNAME or address record: which one should I use?
Use the alias when the target is a service whose address can change without notice, which covers almost every modern hosting platform. Use the address record when you control the server and its address, or when you are at the root of the domain, where an alias is forbidden.
Why is my CNAME not working?
Three causes cover almost every case. The name carries other records, which makes the alias invalid. The previous answer is still sitting in resolvers' memory, and you have to wait out its lifetime. Or nobody told the service you point at that it answers to that name, so it presents a certificate that does not cover it.
What is a dangling CNAME?
An alias whose target no longer exists. The subdomain leads nowhere, which is annoying enough on its own. The real risk comes next. At a host that hands names to whoever asks, somebody can claim the abandoned target and serve whatever they like under your domain, with your name in the address bar.
How long does a CNAME change take to show up?
As long as the lifetime declared on the previous record, which resolvers honour before they ask again. While it runs, some of your visitors keep reaching the old target. On a chain of aliases every link has its own, and the longest one sets the real delay.
Why does my subdomain show a certificate error when the CNAME is right?
Because the certificate is asked for on the name the visitor typed, not on the alias target. The browser announces that name at the start of the encrypted connection, and the server replies with whatever certificate it holds for it. If the service you point at has issued none in your name, the page is blocked before it exists. That is a box to tick at your host, not a DNS line to fix.
Can a CNAME point to another CNAME?
Yes. Nothing forbids it, and it is common — your name points at the one your host gave you, which points at one of their internal names. Every link costs one more resolution, and one broken link breaks the whole chain. What is forbidden is using an alias as the target of an MX or a nameserver.
The alias does not work: four questions, in this order
Work down them one at a time and stop at the first one you answer no to. That answer is the diagnosis, and there is no common fifth case.
Is the name you are aliasing a subdomain, rather than the bare domain?
YesCarry on.A subdomain can carry an alias. That is what it is for.
NoThat's it.The root of a domain has to carry its nameservers and its origin record, and an alias cannot sit alongside them. You need an address record, or the flattening some hosts offer under the name ALIAS or ANAME.
Does that name carry the alias and nothing else?
YesCarry on.A name carrying an alias must carry nothing else, and that is the case here.
NoThat's it.Once an alias exists on a name, everything else on that name gets ignored. An MX, a verification TXT or an address placed beside it will never be read. Remove them, or move the alias to another name.
Is the target a name, written with no protocol and no slash?
YesCarry on.An alias points at a host name, and that is what has been published.
NoThat's it.DNS knows nothing about protocols, paths or ports. A full web address or an IP address typed into the value produces a record that gets accepted and does nothing. A redirect happens in the web server, after the connection.
Does the target itself lead to an address?
YesDNS is not the problem.The chain resolves. Whatever is blocking sits one layer above, in encryption or in the web server. The three layers are laid out below.
NoThat's it.The last link leads nowhere. The service it points at was closed, renamed, or never activated on the hosting side — an alias always outlives the service it named.
These four questions cover the overwhelming majority of cases because they follow the only rule that matters. An alias replaces the contents of a name. It never gets added to them.
Five things everyone says about CNAMEs, and what actually happens
None of these sentences is absurd. Every one of them was true in some context, and now travels without it.
- You often read
A CNAME is a redirect.
- In practiceNothing is redirected. The resolver gets another name and starts its search over. The visitor never changes address, the bar does not move, and nothing tells them anything happened at all. A redirect is an answer from the web server after the connection, and that one does change the address on screen.
- You often read
You cannot chain two CNAMEs.
- In practiceNothing forbids it, and shared hosts do it all day long. Every link costs one more resolution, and one broken link is enough to take down the whole chain. The thing that IS forbidden is using an alias as the target of an MX or a nameserver.
- You often read
My host offers a CNAME at the root, so it must be allowed.
- In practiceWhat it offers is not a CNAME. Its nameserver resolves the target itself and answers with an address. From the outside it is an ordinary address record, which is exactly what makes it usable at the root. No standard describes this behavior, and not every provider has it.
- You often read
The CNAME is correct, so the subdomain works.
- In practiceIt works as far as DNS is concerned. Then the browser asks for a certificate in the name you started from, not the target's. A correct alias pointing at a service that has issued no certificate for your name puts a security warning across the whole page.
- You often read
You have to put a dot at the end of the value.
- In practiceIt depends on the interface, and it is one of the few things you cannot guess. In a zone file, a name with no trailing dot gets the current domain tacked on. In most web interfaces the entry is absolute and the dot is added for you. The only check worth making is to reread the value that got published, not the one you typed.
Reading an alias chain, link by link
The tool shows you the links. It does not tell you who owns each one, and that is what decides which of them you are allowed to change. The answer is almost always: only the first.
shop.example.comYour alias. The only link you control, the one you created in your zone. It is also the only name the visitor types, so the only one that has to appear on the certificate.
shop.example.netThe name your host gave you. It identifies you on their side. Change it or skip past it and the host loses the link between your name and your account. The server still answers, it just no longer knows which site to serve.
lb-03.eu.example.netA link internal to the provider. Load balancing, region, infrastructure version. It changes without notice, which is exactly why you never point at it directly. An alias to that name breaks the day the provider renames it.
203.0.113.24The address, at last. The end of the chain. Copying it into an address record to shorten things is the classic mistake — it freezes a value the provider treats as disposable.
Address taken from the documentation range (RFC 5737), names from the example domains of RFC 2606. The standard sets no limit on chain length, but every resolver sets its own to avoid loops.
The alias resolves but the site will not load: the three layers, in order
DNS has done its job the moment an address comes out. What blocks you next belongs to two layers that appear in no DNS interface, and that no change to the alias will ever fix.
1/3The nameDNS
This layer is fine ifthe lookup at the top of this page ends on an address.
What breaks herealias pointing at a closed target, broken chain, alias placed at the root, value containing a full web address.
2/3Encryptionthe certificate
This layer is fine ifthe padlock appears with no warning on the name you created, not on the target's.
What breaks herethe service you point at has issued no certificate in your name. The browser announces the requested name at the very start of the connection, and the server answers with the certificate it holds for that name. If it has none, the page is blocked before it exists. This is almost always a box to tick at your host, never a DNS line to fix.
3/3The sitethe web server
This layer is fine ifthe expected page appears, rather than a hosting welcome page or an error.
What breaks herethe server took the connection but has no idea which site to serve. Your name was never declared in the account, or it was declared in a different one. With DNS and the certificate both correct, this is the most disorienting layer of all — everything looks right, and it is not your site on screen.
The name requested at the start of an encrypted connection is carried by the SNI extension defined in RFC 6066, § 3. It is what lets a single server host thousands of sites, and what explains why the certificate has to exist for your name rather than the target's.
The vocabulary
Six words to talk about aliases without slipping
The first three are DNS terms. The next three belong to no standard at all, which is the single most useful thing to know about them.
CNAME- The alias. It sends the resolver to another name, which it then has to resolve in turn.
target- The name the alias points to. It is a name, never an IP address and never a web address.
root- The bare domain, with nothing in front. It carries its nameservers and its origin record, so never an alias.
chain- An alias pointing to an alias. Nothing forbids it, but each link costs one more resolution.
ALIAS · ANAME- Proprietary implementations that imitate an alias at the root. No standard defines them.
flattening- The same mechanism under another name. The server resolves the target and publishes the address in its place.