CNAME record
A CNAME (canonical name) record makes one DNS name an alias of another: a resolver that asks for the alias is told the canonical name and continues its lookup there.
Also called: Canonical name record, DNS alias
How a CNAME is followed
Suppose app.customer.com has a CNAME to customers.yourproduct.com. A browser's resolver asks for the address of app.customer.com, and the customer's nameservers answer that the name is an alias for customers.yourproduct.com. The resolver then asks for that name's addresses, which your own DNS controls, and hands both answers back together. Each step is cached for its own TTL.
Nothing about HTTP changes. The browser still sends Host: app.customer.com, and it still expects a TLS certificate for app.customer.com. A CNAME moves traffic to your servers; it does not tell them which customer the traffic belongs to, and it does not issue a certificate. Both are your application's job.
The rules a CNAME must follow
- Nothing else may share its name. RFC 1034 section 3.6.2 says so and RFC 2181 section 10.1 restates it as absolute. A name with a CNAME cannot also have a TXT, MX or A record. DNSSEC signature records are the one exception.
- It cannot sit at a zone apex, because the apex always carries SOA and NS records. See apex domain.
- The target must be a hostname, never an IP address. To point a name at an address, use an A record.
- MX and NS records must not point at a CNAME (RFC 2181 section 10.3). Many providers accept the input anyway; some mail servers then fail in ways that are hard to trace.
- Chains work but cost lookups. An alias of an alias is legal, and each hop is another query and another cache entry that can be stale.
Why custom domains are built on CNAMEs
A CNAME hands control of the addresses to you. If the customer's record says "app.customer.com is customers.yourproduct.com", you can move to a new load balancer, add regions or change providers without asking a single customer to edit DNS again. An A record would pin your current IPs into every customer's zone.
The cost is the apex restriction and the "nothing else at this name" rule. If your verification flow also needs a TXT record, it must live at a different name, which is why ownership proofs sit at names like _dodomain-challenge.app.customer.com rather than at app.customer.com itself.
When a CNAME reads back as an A record
Look up a name you know has a CNAME and sometimes the authoritative nameservers answer with addresses instead. That is a proxy or flattening feature at the DNS host: with Cloudflare's proxy enabled, for example, a proxied name answers with Cloudflare's edge addresses, and a flattened CNAME answers with the target's current addresses. The record is saved correctly; the answer is rewritten. The DNS propagation checker shows what the authoritative nameservers actually return, which is the value verification will see.
Related
- DNS propagation checker
Read a CNAME straight from the authoritative nameservers and three public resolvers.
- ALIAS and CNAME flattening
What providers offer when the name you need an alias at is the apex.
- The connect flow (docs)
How DoDomain gets a customer's CNAME written and verified.
- Cloudflare for SaaS custom hostnames CNAME setup guide
The fallback origin, the CNAME target and the customer's CNAME, step by step.
- DoDomain with Cloudflare for SaaS
Where the CNAME ends and the certificate for the customer's hostname begins.
Frequently asked questions
What does CNAME stand for?
Canonical name. The record says that the name it sits at is an alias, and the value is the canonical name the resolver should look up instead.
What does a CNAME record look like? An example
In zone-file form: app.customer.com. 3600 IN CNAME customers.yourproduct.com. The name on the left is the alias, 3600 is the TTL in seconds, and the value on the right is the canonical name. In most DNS providers' editors the host field takes only the part before the domain, here app.
What is the difference between an A record and a CNAME record?
An A record maps a name to an IPv4 address. A CNAME maps a name to another name, and that name's own records supply the address. An A record can sit at the apex and share its name with MX or TXT records; a CNAME can do neither.
Can a CNAME record point to a root (apex) domain?
Yes, as its target: www.example.com with a CNAME to example.com is valid and common. What DNS forbids is a CNAME at the apex itself, because the apex always carries SOA and NS records. For an alias at the apex, providers offer ALIAS records or CNAME flattening.
Can a CNAME point to an IP address?
No. A CNAME's target must be a hostname. To point a name at an IPv4 address use an A record, and for IPv6 an AAAA record.
Can a CNAME and a TXT record exist at the same name?
No. A name that has a CNAME may not carry any other record type apart from DNSSEC signatures. Put the TXT record at a different name, such as an underscore-prefixed label below it.
Should a SaaS custom domain use a CNAME or an A record?
A CNAME wherever the customer can use a subdomain, because it lets you change your own addresses without asking customers to edit DNS. A records are the fallback for apex domains, and they turn your IP addresses into a promise to every connected customer.
Why does my CNAME show up as an A record when I look it up?
Your DNS host is rewriting the answer, usually because a proxy is enabled on the record or the host flattens CNAMEs. The record is stored as a CNAME, but queries receive the addresses it resolves to.
Start on the free plan
No card, no sales call: create an app, mint a session, and watch the first domain verify.