What Is a CNAME Record? (DNS Aliases Explained)

TL;DR: A CNAME (Canonical Name) record is an alias — it points one hostname at another instead of at an IP. So www.yourdomain.com can CNAME to yourdomain.com, or a subdomain can point at a SaaS platform. They're handy but have a few rules, and a stale CNAME can be a security risk. Scan your domain free to review your setup.

What a CNAME does

Where an A record maps a name to an IP, a CNAME maps a name to another name. The resolver then looks up that target to get the final address. It's useful when the destination's IP might change — you point at a hostname and let the target manage the IP behind it.

Common uses

• www → root so both serve the same site.
• Pointing a subdomain at a SaaS (your shop, help-desk, status page) via the hostname they give you.
• Domain verification and DKIM — Microsoft 365, for example, uses CNAMEs for its DKIM selectors.

The rules and gotchas

• No CNAME at the root in most DNS — you can't CNAME yourdomain.com itself. Use an A record (or your provider's ALIAS/ANAME) there.
• A CNAME can't coexist with other records at the same name (no CNAME + MX on the exact same host).
• It adds a lookup — chains of CNAMEs can slow resolution.

The security risk: dangling CNAMEs

If a CNAME points at a third-party service you've stopped using, an attacker can sometimes claim that service and take over your subdomain — a subdomain takeover. The rule: delete the CNAME before you decommission whatever it points to, and audit your records when you retire tools.

FAQ

What's the difference between a CNAME and an A record?

An A record points to an IP address; a CNAME points to another hostname (which then resolves to an IP).

Can I use a CNAME for my naked/root domain?

Usually not — use an A record, or an ALIAS/ANAME if your DNS provider offers one.

Why does my provider want a CNAME for verification?

It proves you control the DNS for that name. It's common for DKIM, SaaS setup and ownership checks.

Not sure your CNAMEs are clean and safe? Scan your domain, then reply to your report — we're developers and we'll audit your records and close any dangling aliases.