Skip to content
Webmaster Tools
DNS & domainsDNS LookupCNAME record

CNAME record

A CNAME record makes one name an alias of another. How resolvers follow it, the rules it can't break (no apex, no other records), real setups and how to check one.

What it is

A CNAME record (canonical name) says that a name is an alias: "for anything about www.example.com, ask about example.github.io instead". The resolver follows the alias and returns the target's A and AAAA records along with the CNAME. It's defined in RFC 1034 and RFC 1035.

www.example.com.   3600  IN  CNAME  example.github.io.
shop.example.com.  300   IN  CNAME  shops.myshopify.com.

The point is that the target's owner can change its IP addresses without you touching your zone.

The fields

Field Example Meaning
Name www.example.com. The alias
TTL 3600 Seconds the CNAME itself may be cached
Class IN Internet
Type CNAME Canonical name record
Data example.github.io. The target hostname (never an IP address)

The trailing dot matters in zone files: without it, example.github.io is read as relative and becomes example.github.io.example.com.. Most DNS panels add it for you.

The rules a CNAME can't break

  • No other records at the same name. If www is a CNAME, it can't also have an A, MX or TXT record (RFC 1034 §3.6.2). DNSSEC records are the only exception.
  • Not at the zone apex. example.com itself always has SOA and NS records, so it can't be a CNAME. For the apex, use A/AAAA records, or your provider's ALIAS record or CNAME flattening.
  • MX and NS records must not point at a CNAME (RFC 2181 §10.3); point them at a name with its own A/AAAA records.

Common setups

  • GitHub Pages: www as a CNAME to <user>.github.io, the apex with A/AAAA records.
  • Vercel: subdomains as a CNAME to the target shown in the project's domain settings (historically cname.vercel-dns.com).
  • Cloudflare: CNAMEs can be proxied, and at the apex Cloudflare flattens a CNAME into A/AAAA answers automatically.
  • Verification and email services: many providers ask for a CNAME on a random-looking name, such as s1._domainkey pointing at their DKIM key, so they can rotate it.

How to check it

Use our DNS Lookup, or the DNS Propagation Checker to see whether resolvers have the new target. In a terminal:

dig www.example.com CNAME +short
dig www.example.com          # shows the CNAME and the A records it leads to
nslookup -type=CNAME www.example.com

Ask for the CNAME on the exact name that has it: a lookup for example.com won't show a CNAME that lives on www.example.com.

Common mistakes

  • Trying to put a CNAME on the bare domain. Most providers refuse; the ones that accept it break mail, since the MX and TXT records can't coexist with it.
  • Adding a TXT verification record on a name that is a CNAME. It conflicts; put the TXT on another name or on the target.
  • Dangling CNAMEs. A CNAME pointing at a deleted cloud resource (an unclaimed bucket or app name) can be taken over by whoever registers that name next. Delete the CNAME when you delete the service.
  • Long chains. Each hop is another lookup and another TTL; keep it to one.