What it's for
A CNAME (Canonical Name) record aliases one hostname to another. Instead of pointing directly at an IP address like an A record does, a CNAME points at another hostname, and the resolver follows that chain until it hits an A or AAAA record with an actual address.
This indirection is the whole point: it lets you point a name at infrastructure you don't control the IP of — a CDN, a SaaS platform, a load balancer — without needing to know or track its underlying IP addresses. If that infrastructure's IPs change, your CNAME keeps working with zero changes on your end, because you're only ever pointing at their hostname.
Format & syntax
www.example.com. 3600 IN CNAME example.com.
blog.example.com. 3600 IN CNAME hosted-blog.someplatform.com.
- Name — the alias hostname
- TTL — cache duration
- Class —
IN - Type —
CNAME - Value — the canonical (target) hostname, which itself gets resolved through the normal DNS process
The critical rule: a name with a CNAME record cannot have any other record type at the same name — no A, no MX, no TXT, nothing. DNS resolvers treat a CNAME as a total redirect for that name, and having conflicting records is invalid per RFC 1034.
How it's used in practice
wwwsubdomain aliasing —www.example.comCNAME'd toexample.com, so both resolve consistently without duplicating IP records.- Third-party service integration — pointing a subdomain at a SaaS platform (
docs.example.com→example.custom-docs-host.com) so the platform's own infrastructure serves the content under your domain, and their team can rotate IPs freely. - CDN fronting —
cdn.example.comCNAME'd to something liked123abc.cloudfront.net, letting the CDN provider manage the actual edge IPs. - Domain verification (indirectly) — many services ask you to add a specific CNAME (often with a random-looking subdomain) purely to prove you control the DNS zone, distinct from TXT-based verification but serving the same purpose.
Common mistakes & gotchas
- Trying to CNAME the zone apex — you cannot put a CNAME on the root domain (
example.comwith no subdomain) because the apex is required to hold other records (SOA, NS) that can't coexist with a CNAME. This is the single most common CNAME support question. The workaround is a provider-specific ALIAS/ANAME record, or flattened CNAME support, which several DNS providers (Cloudflare, Route 53) offer under different names. - Adding other records alongside a CNAME — e.g., trying to add an MX record on a name that already has a CNAME. This is invalid; a name with a CNAME can only have that CNAME. If you need mail routing, MX must live on the apex or a different name entirely.
- Chained CNAMEs — CNAME pointing to a CNAME pointing to a CNAME. It technically works (resolvers follow the chain), but it adds lookup latency and makes troubleshooting painful. Keep chains as short as possible, ideally just one hop.
- Forgetting the trailing dot in zone files — when hand-editing raw zone files, a CNAME target without a trailing dot gets the zone's origin appended to it, silently producing the wrong target. Most DNS provider dashboards handle this for you, but it's a classic bug in manually maintained BIND zones.
- Dangling CNAMEs (a real security issue) — if a CNAME points at a hostname/service you've since deprovisioned (an old S3 bucket, a decommissioned SaaS subdomain) but forgot to remove the DNS record for, an attacker can sometimes claim that resource on the target platform and effectively take over your subdomain. Clean up CNAMEs when you decommission the thing they point to.
Comparison & FAQ
| Type | Purpose | Key difference from CNAME |
|---|---|---|
| A / AAAA | Maps a hostname to an IP address directly | Points to an address, not another name |
| ALIAS / ANAME (provider-specific) | CNAME-like aliasing that's allowed at the zone apex | Not an official DNS record type — a vendor feature that flattens to A/AAAA |
| DNAME | Aliases an entire subtree of the DNS namespace | Redirects everything under a name, not just one specific name |
Why can't I add a CNAME to my root domain?
The zone apex must hold other required records (like SOA and NS), and a name with a CNAME can't have any other record type. Use your DNS provider's ALIAS, ANAME, or "CNAME flattening" feature instead — it behaves like a CNAME to you but publishes as an A/AAAA record under the hood.
Can I add a TXT record to a name that already has a CNAME?
No. Any name with a CNAME record can only have that one CNAME — no other record types are allowed on it, including TXT, MX, or A.
Does a CNAME slow down DNS resolution?
Marginally — each CNAME hop is an additional lookup the resolver has to perform before it reaches an actual address. A single hop is negligible; long chains (CNAME to CNAME to CNAME) add up and are worth flattening if you control the whole chain.
What's the difference between CNAME and a redirect?
A CNAME is purely a DNS-level alias — it resolves to an IP and the connection happens directly there, invisible to the end user or browser URL bar. An HTTP redirect (301/302) happens at the application layer after a connection is already made, and visibly changes the URL the browser shows.