CNAME
Canonical Name
A CNAME record creates an alias pointing to another hostname. Learn why CNAMEs cannot be used for MX or at the domain root, and when they appear in DKIM setups.
Published · Last verified · Maintained by TamingDNS
CNAME
Address & Routing
RFC 1035
Yes
CNAME <target-hostname>.
CNAME mail.example.com.
3600 s; note that resolvers chase the chain. The final A/AAAA TTL governs caching
💬 What This Record Does
A CNAME (Canonical Name) record creates an alias: it says "this hostname is really just another name for that hostname." When a resolver sees a CNAME, it follows the chain until it reaches an A or AAAA record. CNAMEs are commonly used to alias subdomains (www → example.com) or to delegate DKIM selector lookups to a provider's infrastructure without copying the full public key.
Common Uses
- DKIM selector delegation: some ESPs let you point selector._domainkey.example.com via CNAME to their key
- Aliasing subdomains to a CDN or hosting provider
- Domain ownership verification using a provider-generated CNAME
⚠️ Watch Out For
- You CANNOT use a CNAME at the domain root (example.com itself). RFC prohibits it and it would break MX and other records.
- MX records cannot point to a CNAME target, only to a hostname with a direct A/AAAA record.
- A CNAME cannot coexist with any other record type on the same name (except DNSSEC RRSIG).
🔧 Related Tools
📋 Complete Example Records
Whole records in zone-file form: name, TTL, class, type, then the data. Most DNS panels ask for the pieces separately. Look them up live with the DNS Lookup tool.
www.example.com. 3600 IN CNAME example.com.
The ordinary alias: a resolver follows the pointer, then reads the A or AAAA record at the target.
selector1._domainkey.example.com. 3600 IN CNAME selector1-example-com._domainkey.provider.example.net.
DKIM delegation, the CNAME you are most likely to meet in a mail setup. The provider holds the key and can rotate it without asking you for anything.
example.com. 3600 IN CNAME hosting.example.net.
This one breaks mail. A CNAME cannot sit at the apex, because it cannot coexist with the SOA, NS and MX records that have to live there.
mail.example.com. 3600 IN CNAME relay.example.net. example.com. 3600 IN MX 10 mail.example.com.
This pairing is wrong too. An MX record has to name a host with its own address record, so pointing one at an alias is not allowed.