What is a CNAME record?
A CNAME (canonical name) record makes one hostname an alias of another. When a resolver meets a CNAME it restarts the lookup at the target name, and the alias then answers with whatever records the target has. It is how custom domains point at CDNs, SaaS apps and load balancers without hard-coding their IP addresses.
What the CNAME check shows
- Each hop of the chain, from the name you entered to the final canonical name.
- The IPv4 and IPv6 addresses of the final name.
- A warning if the chain loops, is very long, ends at a name with no address, or starts at the bare domain.
www.example.com. CNAME example.cdn-provider.net.
example.cdn-provider.net. CNAME edge-12.cdn-provider.net.
edge-12.cdn-provider.net. A 192.0.2.44CNAME rules that cause problems
| Rule | What breaks |
|---|---|
| A name with a CNAME can have no other records | Adding MX or TXT next to a CNAME is invalid; resolvers behave unpredictably. |
| No CNAME at the zone apex (bare domain) | The apex must hold SOA and NS records, so a CNAME there conflicts with them. Use an A record or your DNS host's ALIAS / CNAME flattening. |
| MX and NS records must not point to a CNAME | Mail servers and resolvers may refuse to follow the alias. |
| Keep chains short | Each hop is another lookup; resolvers stop after about 8–16 hops. |
Dangling CNAMEs and subdomain takeover
A dangling CNAME points at a name that no longer exists — typically a cloud resource that was deleted, such as an S3 bucket, an Azure app, a Heroku app or a GitHub Pages site, while the DNS record stayed. If the cloud provider lets anyone claim that name, an attacker can create it and serve their own content on your subdomain, with a valid certificate. This is called subdomain takeover.
- Remove the CNAME the moment you delete the resource it points at.
- Review CNAMEs to cloud services every quarter; this tool flags targets without an address.
- Not every dangling CNAME is exploitable, but none of them serves a purpose — delete them.
Setting up a CNAME for a custom domain
Most SaaS apps ask for a CNAME from a subdomain to a name they give you:
shop.example.com. CNAME shops.myshopify.com.
help.example.com. CNAME example.zendesk.com.
www.example.com. CNAME cname.vercel-dns.com.After adding it, the service usually issues a certificate for your name, which only works once the CNAME resolves. Check it here, then watch it reach resolvers worldwide with the DNS propagation checker. Confirm the certificate with the SSL checker.
$ dig www.example.com CNAME +short
$ dig www.example.com +traceFor every record type at once, use the DNS lookup; to see where a zone is hosted, the NS lookup.
CNAME vs ALIAS, ANAME and redirects
A CNAME only changes where DNS looks; it does not change the URL in the browser or redirect anyone. If example.com should send visitors to www.example.com, you need an HTTP redirect on the web server or at your CDN, in addition to DNS. ALIAS and ANAME records are provider features that behave like a CNAME at the apex: the provider resolves the target and answers with its addresses, so other records such as MX can live next to it.
Certificates follow the name in the browser, not the CNAME target: a certificate for www.example.com must list that name even though the content comes from the CDN's hostname. Most CDNs issue it automatically once the CNAME resolves.