Skip to content
DomainVigil
Sign up

Reference guide

What is a CNAME record?

A CNAME says that one name is really another name. It is the handiest record in DNS, and the one that breaks the most zones — because its restrictions appear nowhere in the interfaces.

8 min readUpdated September 12, 2026

In short

A CNAME record declares that a domain name is an alias for another name. A client that hits one asks its question again against the target and follows whatever answer comes back. A name carrying a CNAME can carry no other record, which rules it out at the root of a domain and as the target of an MX record.

What a CNAME is for

A CNAME solves a maintenance problem. When ten subdomains point at the same machine and its address changes, ten lines need fixing — or one, if the other nine are aliases of the first. That is the everyday use: one name carries the address, the others refer to it.

The second use is delegating to a provider. A host, a commerce platform, an analytics service asks you to create an alias pointing at a name of theirs. What you get out of it: they can change infrastructure whenever they like without ever asking you to touch your zone.

In exchange for that convenience, a CNAME imposes one brutal rule: a name that is an alias is an alias for everything. It can carry nothing else — no address, no mail server, no verification record. Almost every alias incident traces back to that one sentence.

An alias, term by term

The line is short. What matters is not its syntax but where it sits in the zone.

www.example.com. 3600 IN CNAME hosting.example.net. shop.example.com. 3600 IN CNAME shops.example.net.

  1. www.example.com.The name that becomes an alias

    From this line on, that name can carry nothing else. If an address or a verification record existed there, one of the two will be ignored — and not always the one you expect.

  2. CNAMEThe type

    It announces that the answer is not an address but a referral. The client has to ask a second question.

  3. hosting.example.net.The canonical name

    The target. It can belong to another domain, which is the usual case. The trailing dot marks a fully qualified name, one the resolver will not append the current domain to.

What a CNAME cannot do

Six limits, all coming out of the same rule. DNS interfaces catch almost none of them: they accept the entry and let the zone misbehave.

What is forbiddenWhyWhat to do instead
Coexist with another recordA name declared as an alias is one for every type of query, without exception.Put the alias on a name that carries nothing else, or give up the alias on that name.
Live at the root of the domainThe root always carries the zone's start of authority record and its nameservers. An alias cannot sit alongside them.An address record, or the proprietary alias your DNS host offers.
Be the target of an MX recordThe mail standard requires a name that resolves straight to an address.Point the MX at a name carrying an A record, not at the alias.
Be the target of an NS recordSame rule: a delegation must name something directly resolvable.Publish nameservers under their real names.
Redirect a web addressDNS only knows machine names. It knows nothing of paths, pages or the address bar.A permanent redirect on the web server: only that changes the address on display.
Guarantee that the target answers for your nameThe alias takes the visitor to the right machine. It does not teach that machine to recognize your name or to present a valid certificate for it.Declare your name on the destination hosting, on top of creating the alias.

Check your own domain, right now

Enter a domain name: the tool shows its aliases, the name each one points to, and the time to live announced.

No sign-up, no email required. You can paste a full address — we'll pull the domain out of it.

What the client actually does

The DNS server does not follow an alias; whoever asked the question does. That explains both how flexible the mechanism is and what its chains cost.

  1. 1

    The client asks for an address

    The browser wants to reach a name and puts the question to its resolver.

    www.example.com → A ?

  2. 2

    The answer is not an address

    The server answers that this name is an alias for another. It hands back the target name, not the address.

    www.example.com → CNAME hosting.example.net

  3. 3

    The client asks again

    This time against the canonical name. That is one more query, with its own latency and its own cache.

  4. 4

    It gets the address

    The chain stops at the first name carrying an address. If that is another alias, the client starts over.

    hosting.example.net → A 198.51.100.25

  5. 5

    Each link lives its own life

    The aliases and the final address each have their own time to live and their own cache. A changed address propagates at the speed of the last link, not the first.

Two or three links go unnoticed. Beyond that, each hop adds a query before the first byte of the page, and resolvers cap the depth they agree to follow anyway.

Four ways around the restriction at the root

The need is always the same: make example.com answer without www when the host only gives you a name. Here are the real options, and what they cost.

OptionWhat it doesWhat to know
Address written by handYou ask the host for the address and publish it as an A record at the root.Works everywhere. You will have to fix it by hand the day the host changes address, and nothing will warn you.
The DNS host's proprietary aliasThe host resolves the target itself and answers with its addresses, as if it were an A record.This is not a standardized record type: the setting does not move from one DNS host to another. Cloudflare and Route 53 each offer a variant.
Redirect from the root to wwwThe root carries a minimal address whose only job is to send visitors on to the www name.Still requires an address at the root, and adds a round trip on every first visit.
DNAMERedirects everything below a name to another name's subtree in one go.Does not apply to the name itself, only to what sits below it: so it does not solve the root case.

The alias mistakes you find everywhere

  • An alias at the root makes the mail disappear

    What causes it: The interface accepted the entry. The alias then takes precedence over everything the root carried, mail records included.

    What fixes it: Remove the alias from the root and replace it with an address or with the host's proprietary alias, then republish the mail records.

  • The subdomain's certificate will not issue

    What causes it: The alias does reach the right machine, but nobody declared that name on the destination hosting: the server does not know it is supposed to answer for it.

    What fixes it: Add the name on the destination host. The DNS alias and the name declaration are two separate steps, and both are needed.

  • The mail server points at an alias

    What causes it: An MX record points at a name that is itself an alias, which the mail standard forbids.

    What fixes it: Point the MX at the canonical name, the one carrying an address directly.

  • The alias chain grew without anyone noticing

    What causes it: Every provider adds its own link, and one alias names another, which names a third.

    What fixes it: Walk the chain to the end once a year and delete the links that stopped being useful. Every hop costs a query before anything appears.

The questions that come next

What is the difference between an alias and a redirect?

An alias works in DNS and stays invisible: the visitor keeps your name in the address bar. A redirect works in HTTP and changes the address on display. They serve different cases and do not replace each other.

Can several aliases be chained?

Yes, the standard allows it. In practice, keep it short: every link is another query before anything is displayed, and resolvers cap the depth they agree to follow.

Why does my interface refuse an alias on the domain?

Because it is applying the rule properly: the root already carries mandatory records, and an alias cannot sit alongside them. Interfaces that accept it without a word are doing you no favour.

Does an alias slow the site down?

Very little, and only on the first visit: one extra DNS query per link, on the order of a few tens of milliseconds. It only becomes noticeable on long chains.

An alias pointing nowhere is still a valid alias

The day the provider retires the target name, your zone does not change: it goes on naming something that no longer exists. DomainVigil follows the records on every domain you own and emails you when an answer stops coming back.

Start for free

Five domains free, forever. No card required.

The other reference guides