# What is an apex domain? Zone apex vs subdomain, explained > An apex domain is the top of a DNS zone, like example.com. What must live there, why a CNAME cannot, and when to ask for a subdomain instead. - Canonical HTML page: https://dodomain.io/glossary/apex-domain - This Markdown twin: https://dodomain.io/glossary/apex-domain.md - Site index for agents: https://dodomain.io/llms.txt - Full documentation as Markdown: https://dodomain.io/docs/llms-full.txt Generated at build time from the same React source the HTML page renders, never a hand-maintained second copy. Every public page on this host has a twin at `.md`. --- [Glossary](https://dodomain.io/glossary) ## Apex domain An apex domain is the name at the top of a DNS zone, such as example.com with no label in front of it. It is also called the zone apex, root domain, naked domain or bare domain. Also called: Zone apex, Root domain, Naked domain, Bare domain ### The apex is where a zone starts DNS is divided into zones, and each zone is served by its own set of authoritative nameservers. The apex is the name the zone is named after. For the zone `example.com` the apex is `example.com` itself; `www.example.com`, `app.example.com` and `mail.example.com` are names inside that zone, one or more labels below the apex. Two records are mandatory at every apex. The **SOA** record states which server is primary for the zone and sets the timers, including how long a missing name may be cached. The **NS** records list the nameservers that answer for the zone. Nothing else is required, but most apexes also carry an `A` or `AAAA` record for the website, `MX` records for mail, and several `TXT` records for SPF and ownership proofs. The apex is not always the domain you bought. If `eu.example.com` has been delegated to its own nameservers, it is a zone of its own, and `eu.example.com` is an apex too. Which zone owns a name is a question for DNS, not for the spelling of the name. ### Apex domain vs subdomain A subdomain is any name below the apex. The practical difference is what records each can hold. A subdomain can be a `CNAME`, an alias that says "this name is really that other name", which is how most SaaS products ask customers to connect: point `app.customer.com` at `customers.yourproduct.com` and let your own DNS decide which addresses that resolves to. An apex cannot be a `CNAME`. The DNS rules forbid a CNAME from sharing its name with any other record, and the apex always has SOA and NS records, so there is never room for one. This is the single most expensive surprise in custom-domain work: a customer types `customer.com`, your setup instructions say "add a CNAME", and their DNS provider rejects it. The [ALIAS and CNAME flattening](https://dodomain.io/glossary/alias-and-cname-flattening) entry covers the provider features that work around it. ### Registrable domain vs zone apex People often use "root domain" to mean the registrable domain, the part you pay a registrar for. That boundary is set by the Public Suffix List, not by counting dots: `example.co.uk` is registrable because `co.uk` is a public suffix. The registrable domain is usually a zone apex, but a delegated subdomain can be an apex without being registrable, as above. For a product that connects customer domains the distinction matters in one place: before you tell a customer to add a record, find the zone that actually owns the name. The [DNS provider detector](https://dodomain.io/tools/provider-detector) reports both the domain you typed and the zone that serves it. When the two are equal, the customer gave you an apex. ### What a SaaS product should do with an apex - **Ask for a subdomain by default.** `app.customer.com` or `links.customer.com` takes one CNAME at every DNS provider. - **Serve the apex from stable IP addresses** if your infrastructure has them. `A` and `AAAA` records work at the apex everywhere, but those addresses become a promise to every connected customer. - **Point www at you and redirect the apex** at the customer's provider, where the provider offers forwarding. The [apex-domain guide](https://dodomain.io/docs/apex-domains) goes through each pattern and records, provider by provider, which DNS hosts offer an apex alias at all. ### Related - [Apex domains (docs)](https://dodomain.io/docs/apex-domains) The patterns that work at the apex, and a sourced table of which DNS providers offer an alias record. - [ALIAS and CNAME flattening](https://dodomain.io/glossary/alias-and-cname-flattening) The provider features that let an apex behave like a CNAME, and what they cost. - [DNS provider detector](https://dodomain.io/tools/provider-detector) Names the zone that owns a domain, so you can tell an apex from a subdomain before asking for records. - [Subdomain vs custom domain](https://dodomain.io/glossary/subdomain-vs-custom-domain) Which kind of address a SaaS product should give its customers. ### Frequently asked questions #### What is an apex domain? The name at the top of a DNS zone, such as example.com with nothing in front of it. It must carry the zone's SOA and NS records, and it usually also carries the website's A or AAAA records and the domain's MX and TXT records. #### Is an apex domain the same as a root domain? In everyday use, yes: root domain, naked domain, bare domain and apex domain all mean example.com without a subdomain. Strictly, the apex is the top of a zone, so a subdomain that has been delegated to its own nameservers is also an apex. #### Can I put a CNAME record at the apex? No. A CNAME may not share its name with any other record, and the apex always has SOA and NS records. Some DNS providers offer ALIAS, ANAME or CNAME flattening instead, which behave like a CNAME in their editor but answer queries with ordinary A and AAAA records. #### How do I tell whether a domain is an apex? Find the zone that owns it: look up its authoritative nameservers and see which zone they serve. If the zone name equals the domain, it is an apex. DoDomain's free DNS provider detector reports the owning zone for any domain. #### Should customers use an apex domain or a subdomain with my SaaS? A subdomain unless your product can be reached by fixed IP addresses. A subdomain takes one CNAME at every DNS provider; an apex needs A records, or a provider-specific alias feature the customer has to set up themselves. ### Start on the free plan No card, no sales call: create an app, mint a session, and watch the first domain verify. [Start with 50 free](https://app.dodomain.io/signin?mode=signup) [Read the quickstart](https://dodomain.io/docs)