CNAME and the bare domain

Module 3: Records for your website · Reading time: 8 minutes

Learning objective: After this lesson you can create a CNAME record correctly and explain why it can't go on the bare domain name.

Key concepts: CNAME, alias, target name, the CNAME rule (no other records alongside it), apex (bare domain name), ALIAS/ANAME/CNAME flattening

A name that points to another name

An A record says: "this name lives at this address". A CNAME record (from canonical name) says something different: "this name is actually another name, ask over there". It makes the name an alias.

shop.example.com.   3600  IN  CNAME  shops.platform.example.

If a browser asks for the address of shop.example.com, the DNS answers: "that's shops.platform.example". The resolver then looks up the A or AAAA record of that name and returns that address. As a visitor you notice nothing: the address bar simply shows shop.example.com.

Why would you want this? Because the IP address then becomes someone else's problem. A webshop platform, newsletter service or cloud provider can move its servers and change the addresses without you having to change anything. That's why many services ask for a CNAME instead of an A record: "point www to shops.platform.example".

The trailing dot

In lesson 2.2 you saw that a name without a trailing dot is read as relative: the DNS appends your own domain name to it. With a CNAME, this very often goes wrong.

Many control panels now add the dot for you or warn you. Others don't. So after saving, check the list: if you see your own domain name after the value, the dot was missing.

The same rule applies to the mail server in an MX record and to NS records. You don't put a dot after an IP address in an A record.

The CNAME rule: nothing else alongside it

A CNAME has one hard rule from the DNS standard (RFC 1034, section 3.6.2, and RFC 2181): a name with a CNAME may not have any other records. That makes sense: the CNAME says "I am actually that other name". If there's also an A record or an MX record present, it's unclear which answer applies.

Two things follow from this that you'll run into in practice:

1. If there's already an A record for shop, remove it first. Otherwise a control panel will either refuse the CNAME record, or worse, accept it and the DNS starts behaving oddly.
2. A CNAME on the bare domain name is not possible.

Why not on the bare domain name?

The bare domain name, example.com without anything in front of it, is known in the trade as the apex or the top of the zone. That name always has records that must be there:

• the SOA record (the technical header of the zone),
• the NS records (which nameservers manage the zone),
• usually also MX records (mail) and TXT records (SPF, verification).

Because a CNAME doesn't tolerate any other records alongside it, and the apex always has SOA and NS, there can't be a CNAME on the apex. That's not a limitation of your control panel, but of the DNS itself.

If a service asks you to connect "your main domain", there are three solutions:

1. An A record (and possibly AAAA) with the service's IP address. Most webshop platforms provide a fixed address for this. This works everywhere.
2. An ALIAS, ANAME or "CNAME flattening" record. Some DNS providers offer their own record type that behaves like a CNAME, but which the nameserver itself converts into an A record before the answer goes out the door. This is not an official record type: it only works with providers that support it, and it's called something different everywhere.
3. Redirecting. Let the bare domain name point with an A record to your own web server, and have that redirect visitors to www.example.com, which does have a CNAME to the service. You can read how redirecting works in lesson 3.4.

Where else a CNAME isn't allowed

• An MX record may not point to a CNAME (RFC 2181, section 10.3). The mail server in an MX must be a name with its own A or AAAA record. Some mail servers manage anyway, but you can't rely on it.
• No CNAME on a name that you also have as a subdomain in your hosting control panel. A subdomain in the control panel automatically gets its own records pointing to your hosting. If you want the name to point to a different service instead, remove the subdomain and only create the CNAME record.
• Chains are possible, but keep them short. A CNAME may point to a name that is itself a CNAME again. Each step costs an extra lookup. Large platforms often do this (you'll then see two or three CNAMEs in a row), but don't create long chains yourself.

In practice: what it looks like in a control panel

As an example, we'll use the DNS screen of My WebOké. In other control panels (DirectAdmin, cPanel, Plesk, Cloudflare, most registrars) the buttons are called something different, but you fill in the same three things: type, name and target name.

1. Open the DNS screen of your domain and click Add Record.
2. Choose the type CNAME.
3. Under Name, enter only shop, without your domain name.
4. Under Points to, enter the target name with a dot at the end: shops.platform.example.
5. Save and check in the list that your own domain name doesn't appear after the value.

The control panel in the example warns you if the dot is missing. Not every control panel does.

Summary

• A CNAME turns a name into an alias for another name; the other party then manages the IP address.
• Put a dot at the end of the target name, otherwise the DNS appends your own domain to it.
• A name with a CNAME may not have any other records.
• That's why a CNAME can't go on the bare domain name: SOA and NS are always there. Use an A record, an ALIAS-like record from your DNS provider, or redirecting instead.
• An MX record may not point to a CNAME.

Quiz

Exercise

Exercise Z3.2: Following a CNAME. Which name does the CNAME record of en.wikipedia.org point to? Enter the target name.

Exercise O3.2: Setting it up yourself in your practice zone. In your practice zone, create a CNAME record with the name winkel that points to shops.shop-demo.dnspractice.eu. (with the dot). Make sure there's no other record for winkel. In the practice zone you use a fake service; for your real domain, enter the target name provided by the actual service. Then click Check.

Further reading

These articles describe the steps in WebOké's control panels; they work similarly in other control panels.

• DirectAdmin guide 5.4: CNAME records and the trailing dot
• Managing DNS records in My WebOké (with examples for CNAME, TXT, and external services)
• Creating a subdomain, and what to do if it doesn't work