GlossaryDNS
CNAME record
Definition
A CNAME record declares that one name is an alias for another: instead of carrying an address, it points at a second name that has to be looked up in turn. It is the usual way to attach a subdomain to a platform whose infrastructure may change.
The point of it, and the rule that bites
The point of an alias is to stop depending on an IP address. A sending platform, a CDN, a form tool: each one gives you a name, and as long as your alias points at it they can move machines without asking you and without breaking anything on your side.
Here is the rule that bites: a name carrying a CNAME cannot carry any other record. That is why you do not put a CNAME at the root of a domain, which already has to carry its name servers and its SOA. Hosts work around the limit with mechanisms of their own — those are not CNAMEs, whatever the interface calls them.
Two everyday aliases
The site's “www”, and a subdomain handed to an outside platform.
www.example.com. 3600 IN CNAME target.example.net.
shop.example.com. 3600 IN CNAME client-4711.example.org.The trailing dot is not decoration. Without it, some interfaces append the domain name and the alias starts pointing at “target.example.net.example.com”, which does not exist — producing something that looks exactly like an outage on the other side.
The usual mistake
Adding a CNAME to a name that already carries an MX or a TXT record. Depending on the host, the interface either refuses or accepts and makes behavior unpredictable: mail can stop arriving while no single line looks wrong.
How to avoid it: One name, one job. If the name has to carry anything besides an alias, give it an A or an AAAA, and keep CNAMEs for subdomains whose only purpose is to point elsewhere.
Source: The CNAME exclusivity rule comes from RFC 1034. RFC 2181 spells out where a CNAME is explicitly forbidden, notably as the target of an MX record.
Related terms
Where to go next
Knowing the words is half the job
The other half is knowing which of your domains is about to become a problem. DomainVigil watches expiry, DNS, certificates and reputation, and tells you before your client does.
Start for freeFive domains free, forever. No card required.