CNAME Lookup

Frequently Asked Questions

What is a CNAME record and how is it different from other DNS records?

A canonical name (CNAME) record is a DNS record type that designates a domain or subdomain as an alias for another domain. Unlike A or AAAA records, a CNAME points to a domain or subdomain, not an IP address. When a DNS query is made for a domain with a CNAME, the DNS server performs an additional lookup to resolve the canonical domain's IP address.

How does a CNAME record work?

When a client (like your web browser) wants to access a web address like www.example.com that has a CNAME record, the DNS resolver contacts the authoritative name server (NS) for example.com. Since the domain has a CNAME record, the authoritative NS responds with the CNAME (e.g., example1.com), rather than an IP address.

The DNS resolver performs another query, this time for example1.com. If this query resolves to an A or AAAA record, the resolver can provide the client with the IP address it needs to load the website.

When is a CNAME record used?

CNAME records are particularly useful when integrating your domain with a content delivery network (CDN) or other third-party services. You can use a CNAME that points to their service domain. This allows you to maintain control over your domain name while the CDN provider manages its server's DNS settings, even if their IP addresses change. This ensures continuous service without requiring you to update your DNS records constantly.

You may also need to use CNAME records when your domain has different country-code top-level domains (ccTLDs), such as example.us, example.es, and example.fr, so you can redirect these domains to the parent domain (example.com).

How can I use CNAME lookups in phishing detection or threat intelligence?

CNAME record lookups help identify dangling CNAMEs (i.e., decommissioned services with CNAMEs that remain active) that pave the way for subdomain takeovers and potentially lead to phishing and malware. Analyzing CNAME chains can reveal hidden malicious infrastructures, enabling threat investigators to map malicious networks.

What are the restrictions regarding using CNAME records?

CNAME records have some limitations. For one, a domain or subdomain can only have one CNAME record, and this must always point to another domain name, not an IP address. CNAME records cannot coexist with any other record type (like an A, MX, or NS record) for the same domain (DNSSEC records are an exception to this rule). Consequently, root domains cannot use CNAMEs as they require essential start of authority (SOA) and NS records. Additionally, MX and NS records must not point to a domain that has a CNAME record.

These restrictions are detailed in certain sections 10.1 and 10.3 of RFC 2181 and section 3.6 of RFC 1034.

How can I check the other DNS records of a domain?

You may use our DNS Lookup API, which returns CNAME and other DNS record types or our lookup tool. If you only want to look up the TXT record of a domain, you can use our free TXT Lookup tool.