CNAME Lookup

A CNAME record (canonical name) tells a resolver that the queried name is an alias and that the real records live under a different name. It was defined in RFC 1035, and RFC 2181 section 10.1 tightened the rules. A resolver that finds a CNAME restarts the query at the target and returns both the CNAME and the records it found there.

www.example.com.   3600  IN  CNAME  example.com.
blog.example.com.  300   IN  CNAME  example-blog.ghost.io.
shop.example.com.  300   IN  CNAME  shops.myshopify.com.

Three rules follow. A name with a CNAME may hold no other records (RFC 1034 section 3.6.2), with DNSSEC signatures as the only exception. The zone apex cannot be a CNAME, because the apex must hold SOA and NS records. And a CNAME may point at another CNAME, forming a chain, although resolvers cap the depth and refuse loops.

A CNAME lookup returns the target name the alias points to, with its TTL, from each resolver. If the name has no CNAME the result is empty, which is normal for a domain apex or any host with its own A records. Our DNS lookup tool asks Google Public DNS (8.8.8.8), Cloudflare (1.1.1.1), Quad9 (9.9.9.9) and OpenDNS at the same time and marks whether they agree. To see the whole chain, switch the type to A or AAAA and query the same name. DNSX lists every CNAME the resolver followed plus the final address records.

Open Command Prompt or PowerShell. nslookup ships with every version of Windows, and Resolve-DnsName is the PowerShell cmdlet. Add a resolver address, as in the last two lines, to ask a public resolver instead of your network's.

nslookup -type=CNAME www.example.com
Resolve-DnsName -Type CNAME www.example.com
nslookup -type=CNAME www.example.com 8.8.8.8
Resolve-DnsName -Type CNAME www.example.com -Server 1.1.1.1

macOS ships dig, so no install is needed. Open Terminal and run one of these. The +short form prints only the record values, and the @ form sends the query to a specific resolver.

dig CNAME www.example.com
dig CNAME www.example.com +short
dig @1.1.1.1 CNAME www.example.com

dig and host come from the dnsutils package on Debian and Ubuntu and from bind-utils on Fedora and RHEL. The +noall +answer options print only the answer section, and +tcp forces the query over TCP when you suspect a truncated UDP answer.

dig CNAME www.example.com +noall +answer
host -t CNAME www.example.com

After you change a CNAME record, the authoritative nameservers answer with the new value immediately, and every recursive resolver that cached the old record keeps serving it until the cached TTL runs out. Our DNS lookup tool above shows whether Google, Cloudflare, Quad9 and OpenDNS agree yet, and the Authoritative option reads the value straight from the zone's own nameservers. The DNS propagation checker asks resolvers in more locations and lays the results out side by side.

Use an A record when you control the address. Use a CNAME when someone else does. A CDN, a hosting platform or a SaaS product will move its servers and change IPs, and a CNAME to their hostname follows every change with no work on your side. Nearly every custom domain setup works this way: www to a CloudFront or Fastly hostname, shop to shops.myshopify.com, docs to cname.vercel-dns.com or a GitHub Pages hostname.

The gap is the apex. example.com itself cannot be a CNAME, so providers offer ALIAS, ANAME or CNAME flattening, where their nameserver resolves the target itself and answers with plain A and AAAA records. The answer is then resolved from the provider's location rather than the user's, which can defeat a CDN's geographic routing, so where you can, keep the CNAME on www and redirect the apex to it.

A chain forms when the target of a CNAME is itself a CNAME. It is common with CDNs, where www points at a hostname you were given and that hostname points at a regional pool with the A records. A resolver follows each hop and returns the whole path in one answer.

www.example.com.                    300  IN  CNAME  www.example.com.cdn.cloudflare.net.
www.example.com.cdn.cloudflare.net. 300  IN  CNAME  cf-lb-pool-3.cloudflare.net.
cf-lb-pool-3.cloudflare.net.        60   IN  A      203.0.113.44
cf-lb-pool-3.cloudflare.net.        60   IN  A      203.0.113.45

Each hop costs the resolver an extra query the first time, so long chains add latency. BIND and Unbound stop after a fixed number of hops, and a chain that loops returns an error. Two or three hops is normal for a CDN.

The commonest cause is a record conflict. If the name already has an A, MX or TXT record, most providers refuse to add a CNAME, and a CNAME at the apex is the same problem. Move the other records or use the provider's ALIAS feature.

The second cause is a target that does not resolve. If the SaaS hostname you were given has not been activated yet, or you typed it wrong, the chain ends in NXDOMAIN, and an A lookup in the tool above shows where it stops. Finally, MX records must not point at a CNAME (RFC 2181 section 10.3), so a mail server named by an alias makes some senders refuse delivery. Our MX lookup flags that case.

Every lookup on DNSX is also a JSON endpoint on api.dnsx.dev that you can call from curl or a script with no API key. The response has one result per resolver with its records and TTLs.

curl https://api.dnsx.dev/dns/cname/www.github.com