BRev CNAME record — canonical name (alias)
A CNAME says “this name is really that name”. The resolver receives it, discards the name it asked for, and starts again on the target — so a CNAME costs an extra round trip and inherits everything the target publishes: its A and AAAA records, its TXT records, its MX records, all of it.
That inheritance is why the rule exists: a name with a CNAME may hold no other records. The alias replaces the whole name, so a second record would contradict it, and RFC 1034 forbids the combination outright. The consequence is the most frequently hit constraint in DNS — an apex domain always carries NS and SOA records by definition, so example.com can never be a CNAME, while www.example.com can.
Providers work around it with ALIAS or ANAME records (Route 53 calls it an alias record), which look like a CNAME in the control panel and are resolved by the authoritative server into real A/AAAA records before answering. That is a server-side feature, not a DNS record type — you cannot write one in a zone file and expect an arbitrary provider to honour it, and it is the reason apex-domain guidance is so provider-specific.
What a CNAME record looks like
Type 5 · Canonical name (alias). Zone-file form below — owner name, TTL, then the record and its RDATA.
| Name | TTL | Record | What it means |
|---|---|---|---|
| www.example.com. | 3600 | CNAME example.com. | The canonical pattern: www aliased to the apex, which holds the real A record. |
| shop.example.com. | 3600 | CNAME myshop.myshopify.com. | Pointing a subdomain at a hosted platform — the usual legitimate CNAME. |
| cdn.example.com. | 300 | CNAME d111abcdef8.cloudfront.net. | A CDN endpoint. The provider can change addresses freely because you never wrote one down. |
| _acme-challenge.example.com. | 60 | CNAME validate.example-acme.net. | Delegating certificate validation, so renewal never touches your main zone. |
The mistakes that break production
Putting a CNAME on the apex
The apex must carry NS and SOA records, and a CNAME cannot coexist with anything. Some providers accept the entry and quietly serve something else, which is worse than a refusal because the breakage appears later and elsewhere. Use the provider’s ALIAS/ANAME, an A record, or redirect from a name that can be a CNAME.
Adding a TXT or MX record beside an existing CNAME
Same rule, less obvious. A CNAME’d subdomain cannot also hold an SPF TXT record or an MX record — the alias governs the entire name. Domain-verification TXT records on a CNAME’d host fail for exactly this reason; put them on a name that is not aliased.
Query a CNAME record now
The box below is seeded with www.example.com. Choose CNAME as the type and press Look up — the query goes from your browser straight to Cloudflare or Google over DNS-over-HTTPS, with no server of ours in the path.
DNS is the internet's address book: it turns a name like example.com into the addresses and service endpoints machines actually connect to. Every record has a type (what kind of fact it states) and a TTL (how long resolvers may cache it).
Record types
| Type | What it stores |
|---|---|
| A | IPv4 address |
| AAAA | IPv6 address |
| CNAME | Canonical name (alias) |
| MX | Mail exchanger (priority target) |
| TXT | Text — SPF, verifications, DKIM, arbitrary data |
| NS | Authoritative nameservers |
| SOA | Start of authority (serial, refresh, retry, expire, minimum) |
| SRV | Service locator (priority weight port target) |
| CAA | Which CAs may issue certificates |
| PTR | Reverse DNS (IP → name) |
| DNSKEY | DNSSEC public key |
| DS | Delegation signer (DNSSEC chain of trust) |
| HTTPS | HTTPS service binding (ALPN, ECH, hints) |
| SVCB | General service binding |
| TLSA | DANE — pin certificates in DNS |
| NAPTR | Name authority pointer (SIP/ENUM) |
TTL & “propagation”
DNS changes don't “push” anywhere — resolvers simply keep the old answer until its TTL runs out, then fetch the new one. So a change “propagates” in at most the old record's TTL. Planning a change? Lower the TTL (e.g. to 300s) a day in advance, make the change, then raise it back. The compare card above shows whether major public caches have picked your change up yet.
FAQ
Why can I not use a CNAME on my root domain?
Because the apex necessarily holds NS and SOA records, and a CNAME may not coexist with any other record on the same name. Providers offer ALIAS or ANAME records that behave similarly but are resolved server-side into A/AAAA answers.
What is the difference between a CNAME and an A record?
A CNAME points at another name and requires a further lookup; an A record holds an address and ends the chase. CNAMEs are useful when the target’s address may change and you would rather not track it.
Do CNAME chains slow things down?
Yes — each hop is another resolution step, and resolvers cap chain length to avoid loops. One level is normal; several stacked levels add latency to the very first request a visitor makes.