CNAME lookup

What a CNAME record is

A CNAME (canonical name) record says that one hostname is an alias for another. If www.example.com has a CNAME to shops.example-platform.net, every question about www, such as its addresses, is answered by looking at the target instead. Resolvers follow the alias for you, and may pass through several in a row.

CNAMEs are the usual way to connect your domain to a service that changes its IP addresses, such as a website builder, a CDN, a hosted shop, a status page or an email-sending service. You publish the alias once, and the provider updates the addresses behind it.

How to follow an alias

1. Look up the subdomainEnter the full name, such as shop.example.com. A CNAME is set on one specific name, not on the whole domain.
2. Follow the chainIf a target comes back, look that name up too. Or run an A lookup on the original name, which shows the whole chain at once. A healthy chain ends at an A or AAAA record. One that ends in an error is broken.
3. Check that the target is still yours to useA CNAME that points at a cloud or SaaS resource you have deleted can be claimed by someone else. See the warning below.

The rules a CNAME must follow

• A CNAME cannot share a name with other records. If shop.example.com is a CNAME, it cannot also have MX, TXT or A records (RFC 1034, RFC 2181). The only exceptions are the DNSSEC records that sign it.
• No CNAME at the root of a domain. The root already holds SOA and NS records, so example.com cannot be a CNAME. Use A and AAAA records instead, or the ALIAS, ANAME or CNAME flattening feature your DNS host may offer. These return addresses and behave like a CNAME.
• MX and NS targets must not be CNAMEs. Mail servers and nameservers need real address records (RFC 2181 section 10.3).
• Keep chains short. Each hop is another query. Long chains slow things down, and some resolvers give up after a limit.
• Mind the trailing dot. In a zone file, a target without a dot at the end is treated as relative to the zone. That is how target.example.com.example.com mistakes happen.

Common problems

• “CNAME not allowed” in the DNS panel. Another record already exists at that name. Delete the conflicting record, or change the existing record instead.
• The root domain refuses a CNAME. Use your host's ALIAS or flattening feature, or an A record with the provider's fixed address.
• The provider says it can't find your CNAME. Your DNS host may add your domain automatically, so entering www.example.com becomes www.example.com.example.com. Enter just www.
• Verification CNAMEs. Services for email signing and certificate validation ask for names like selector._domainkey or _acme-challenge. They are fine as long as nothing else lives at that exact name.
• Proxied records. If your DNS host proxies a CNAME, as some CDNs do, a lookup returns the proxy's addresses and not the CNAME itself.
• NXDOMAIN at the end of the chain. The target does not exist. Check for a typo or a removed service.

How the lookup works and the standards

LookupOwl asks for type CNAME (code 5) at the exact hostname and shows the record, with its target and TTL, if there is one. A CNAME query returns only the first link. To follow a chain, look up each target in turn, or ask for the A or AAAA records of the original name, where the resolver returns every alias on the way along with the final addresses. A name with more than one CNAME is flagged as an error. The CNAME record is defined in RFC 1035, and its constraints are in RFC 1034 section 3.6.2 and RFC 2181 section 10.1. The rule for MX and NS targets is in RFC 2181 section 10.3.

dig +short CNAME www.example.com
dig www.example.com A +noall +answer   # shows the whole chain

Once you know where the alias ends, check the final addresses with an A record lookup.