How to Set Up a CNAME Record (with Examples)

A CNAME (Canonical Name) record points one hostname at *another hostname* instead of at an IP address. It's how you make www.example.com follow example.com, how you point a subdomain at a SaaS platform, and how many services verify domain ownership. This guide shows real examples and the rules that catch people out.

What a CNAME does

An A record says "this name lives at this IP." A CNAME says "this name is an alias for that other name — go look *that* up." When a resolver hits a CNAME it restarts the lookup on the target and follows it to a final A/AAAA record. For where CNAME sits among record types, see DNS records explained.

A CNAME has:

• Name (Host): the alias, e.g. www
• Value (Target): the canonical hostname, e.g. example.com or myapp.herokudns.com
• TTL: cache duration

Example 1: Point www at the root domain

The classic use. Instead of a second A record for www, alias it:

• Type: CNAME, Name: www, Value: example.com, TTL: 3600

Now www.example.com always resolves to whatever example.com does. Change your server IP once (on the root A record) and www follows automatically. Pair this with a www-to-apex redirect so one canonical URL wins.

Example 2: Point a subdomain at a SaaS platform

Platforms like Netlify, Vercel, GitHub Pages, Shopify and Heroku give you a target hostname:

• Type: CNAME, Name: shop, Value: shops.myshopify.com
• Type: CNAME, Name: blog, Value: cname.vercel-dns.com

The platform resolves that name to its own rotating IPs, so you never hard-code an address. To send a subdomain to a port or app on your own VPS instead, see how to point a subdomain to a different app or port.

Example 3: Domain verification

Many services (email senders, Google, analytics) ask you to add a CNAME like:

• Type: CNAME, Name: abc123._domainkey, Value: abc123.dkim.provider.com

This is common for DKIM email signing — see how to verify your domain for email sending.

The rules that bite

• No CNAME on the apex. You cannot put a CNAME on the bare root (@ / example.com) — the DNS spec forbids it because the apex must carry SOA and NS records. Use an A record there, or your provider's ALIAS/CNAME-flattening feature.
• A CNAME can't coexist with other records on the same name. If blog has a CNAME, it can't also have an MX or TXT record.
• Always resolve to a name, never an IP. Putting an IP in a CNAME value is invalid — use an A record for that.
• Trailing dots matter in some panels: example.com. (with the dot) is fully qualified. Most modern panels handle this for you.

Verify

dig +short www.example.com CNAME
dig +short www.example.com

The first shows the CNAME target; the second follows the chain to the final IP. If it loops or returns nothing, check for a typo in the target or an accidental CNAME on the apex. More in diagnosing DNS problems with dig and nslookup.

The apex problem and CNAME flattening

The most-hit wall is wanting a CNAME on the root (example.com) — say to point it at a SaaS host that only gives you a hostname. Standard DNS forbids this. Three ways around it:

• CNAME flattening / ALIAS records: Cloudflare, Route 53 (ALIAS), and DNSimple (ALIAS) let you enter a CNAME-like value on the apex; behind the scenes they resolve it to an A record and serve that. On Cloudflare you just add a "CNAME" on @ and it flattens automatically.
• Use an A record with the target's published IP (fine if it's stable — risky if the provider rotates IPs).
• Redirect the apex to www and put the CNAME on www, so example.com 301s to www.example.com which is a CNAME. See how to redirect www to your apex domain.

Why a CNAME can break your email

A subtle but common outage: someone adds a CNAME to a host that also needs MX or TXT records. Because a CNAME can't coexist with any other record on the same name, the MX and SPF records are ignored and mail silently breaks. Never CNAME your root domain if it receives email, and never CNAME a subdomain that also carries mail records. Keep CNAMEs to hostnames that do nothing but alias.

Debugging a CNAME chain

When a CNAME "doesn't work," trace the chain to see where it stops:

dig www.example.com CNAME +short     # the immediate target
dig www.example.com +short           # the final resolved IP
dig www.example.com +trace           # every hop from the root

Watch for: a target that doesn't resolve (typo), a chain that's too long (keep it to one hop where possible), or an accidental self-reference that loops. A CNAME pointing at a name with no A record resolves to nothing — the browser just fails. The full toolkit is in diagnosing DNS problems with dig and nslookup.

FAQ

Can I use a CNAME for my root domain?

Not with a standard CNAME. Use an A record on the apex, or a provider feature called ALIAS or CNAME flattening (Cloudflare does this automatically).

What's the difference between a CNAME and a redirect?

A CNAME is a DNS alias — the URL in the browser stays the same and the name resolves to the target's IP. A redirect is an HTTP response that changes the URL the browser shows.

Can a CNAME point to another CNAME?

Yes, chains work, but each hop adds latency and there's a limit resolvers will follow. Keep chains short — ideally one hop to a real A record.

Why did adding a CNAME break my email?

Because a CNAME can't coexist with other records on the same host. If you CNAME the root or a host that also needs MX records, mail breaks. Only CNAME subdomains that don't carry other records.

Does a CNAME slow down my site?

Marginally, and rarely enough to matter. Each CNAME adds one extra resolution step — the resolver looks up the alias, gets the canonical name, then resolves *that* to an A record. For a single hop the added latency is a few milliseconds, cached for the record's TTL, so only the first visitor in that window pays it. Trouble appears with long chains (CNAME to CNAME to CNAME), which multiply lookups and can hit resolver limits. Keep chains to one hop where you can, and use an A record — or CNAME flattening/ALIAS on the apex — when you want the fastest possible resolution. In practice, the flexibility a CNAME gives (repoint the target once and every alias follows) usually outweighs the tiny lookup cost.

Building something that needs custom subdomains and full DNS control? Nxeon gives you a fast VPS with root access, and you can register and manage records through Nxeon domains.