Popular tools

Theme

CNAME Lookup

Follow any name's DNS CNAME chain hop by hop, asked at each zone's own nameservers: every alias with its TTL and who answered it, the platform behind the target and the final addresses. Dangling targets, loops and long chains are named, with the fix.

Sources: each zone's own nameservers, reached from a root server · Google Public DNS · Cloudflare 1.1.1.1 · Team Cymru

Looked up exactly as typed: www. and subdomains stay as they are, and an IDN is sent as punycode.

Try

What is a CNAME record?

A CNAME (canonical name) record makes one name an alias of another. Ask for the alias and DNS answers: look up this other name instead. The value is always a name, never an IP address (RFC 1034 §3.6.2).

Resolvers follow the alias for you and return the target's addresses in the same answer, so a browser never notices. That's why platforms ask for one: you point www at their name once, and they can move their servers without you touching your DNS.

Strictly, the canonical name is the target; calling the alias "a CNAME" is the common shorthand. A name with a CNAME can hold nothing else and only one CNAME (RFC 2181 §10.1), so the top of a zone, which must hold its SOA and NS records, can't hold one (RFC 1034 §4.2.1).

A CNAME record, part by partwww.microsoft.com · recorded Oct 23, 2026
www.microsoft.com.Alias (owner)3600TTLINClassCNAMETypewww.microsoft.com-c-3.edgekey.net.Canonical name (target)
The aliasThe name people type or link to. It holds this one record and nothing else.
TTL · 1 hrHow long a resolver may keep this record before asking again.
The targetWhere to look next: Akamai's edge name. Always a name, never an address.
  1. You look upwww.github.com
  2. CNAME · 1 hr
  3. The canonical namegithub.com
  4. A · 1 min
  5. The address · AS8075 Microsoft20.207.73.82
  • www.github.comCNAMEgithub.comthe same domain
  • www.rust-lang.orgCNAMErust-lang.github.ioGitHub Pages
  • www.cursor.comCNAMEcname.vercel-dns.comVercel
  • docs.github.comA185.199.108.154+3 moreno alias: its own addresses
Recorded at each zone's own nameserver. A resolver asking for www.github.com gets the alias and github.com's address in one answer.

How to check CNAME records with dig, nslookup and PowerShell

Type the name above and press Look up CNAME: the tool asks each zone's own nameserver hop by hop and draws the chain. On a computer, dig does it in one line: ask for type A and the answer lists every alias first, then the addresses.

Ask for type CNAME to see only the first alias. Windows has nslookup -type=cname, PowerShell Resolve-DnsName -Type CNAME, and host -t cname prints one sentence.

Two catches: a resolver shows how much of the TTL is left in its cache, not the TTL the zone sets, and dig +short drops the TTLs and the owner names, so a chain prints as a bare list.

dig www.example.com A +noall +answer

Every alias with its TTL, then the addresses. +short prints only the targets, without the TTLs.

dig, annotatedwww.nytimes.com via 8.8.8.8 · Oct 23, 2026
bash · dig
$ dig www.nytimes.com A +noall +answer
www.nytimes.com.                  12902IN  CNAME www.prd.map.nytimes.com.3
www.prd.map.nytimes.com.             482   IN  CNAME www.prd.map.nytimes.xovr.nyt.net.
www.prd.map.nytimes.xovr.nyt.net.    260   IN  CNAME nytimes.map.fastly.net.
nytimes.map.fastly.net.               28   IN  A     151.101.1.1644
nytimes.map.fastly.net.               28   IN  A     151.101.129.164
nytimes.map.fastly.net.               28   IN  A     151.101.193.164
nytimes.map.fastly.net.               28   IN  A     151.101.65.164

$ dig www.nytimes.com +short5
www.prd.map.nytimes.com.          # no TTL, no owner names
www.prd.map.nytimes.xovr.nyt.net.
nytimes.map.fastly.net.
151.101.1.164
151.101.129.164
151.101.193.164
151.101.65.164
  1. The name you asked. Each line's first column is the record's owner.
  2. Seconds left in Google's cache: 290 sec of the zone's 600 sec. The zone's own server shows the full TTL.
  3. CNAME → the next name. 3 aliases here, so 3 lines like this.
  4. The addresses belong to the last name in the chain: Fastly's, TTL 1 min at the zone.
  5. +short hides the TTL and the owner names: only the targets and addresses remain.

The same question in other tools

nslookup
$ nslookup -type=cname www.nytimes.com
Non-authoritative answer:
www.nytimes.com	canonical name = www.prd.map.nytimes.com.
PowerShell
PS> Resolve-DnsName www.nytimes.com -Type CNAME
# one row per record: the name, its type, its TTL and the target
host
$ host -t cname www.nytimes.com
www.nytimes.com is an alias for www.prd.map.nytimes.com.

nslookup as macOS prints it; Windows lays the same answer out a little differently.

Reading the result

The head says in one sentence where the name ends up and through how many aliases, with the platform's mark; the notes under it are the findings that matter. The count is of CNAME records: www.github.com → github.com is 1, not 2.

The Chain view lists each record as its own zone's server answered it, with the zone, the server, the AA flag and the TTL, then the readings: loop, length, missing targets, other data beside a CNAME. Copies shows Google's and Cloudflare's cached copy of each record beside the zone's. On the right, the navy column draws the chain: a loop as a ring, a missing target broken off.

CNAME lookup of www.nytimes.com: three aliases to Fastly, each record's TTL and zone, and the chain drawn to its addressesCNAME lookup of www.nytimes.com: three aliases to Fastly, each record's TTL and zone, and the chain drawn to its addressesThe verdictWhere the name ends up, through how many aliases, the platform and the network of the addresses.The cached copiesGoogle's and Cloudflare's copy of each record, the time each has left and when an edit to the first one shows.Each record, hop by hopThe target and TTL as the zone holds them, the server that answered, the AA flag and the time.The chainName, each alias with its zone and TTL, then the final addresses and their network.
A CNAME lookup of www.nytimes.com: the verdict, each alias as its zone's server answered it, the readings and the chain drawn on the right. Select a number to see what each part shows.

CNAME vs A record

An A record holds an address: docs.github.com → 185.199.108.154. A CNAME holds a name: www.github.com → github.com, and the address comes from that name's own A record.

Use an A record for your own server and for the root domain. Use a CNAME when a platform gives you a name to point at (Vercel, GitHub Pages, a CDN, a mail service's DKIM key): when they move, your record follows by itself.

The price is one more lookup per alias and the strict rules: nothing else at that name, and never at the zone's top.

Side by sidereal records, recorded Oct 23, 2026
CNAMEaliaswww.github.comAaddressdocs.github.com
Points toanother name: github.coman IPv4 address: 185.199.108.154
At the root (example.com)no: the top holds SOA and NSyes
Other records at the namenone: no MX, TXT or A beside itany: AAAA, MX, TXT…
Extra lookupsone per alias: 1 here, 3 for www.nytimes.comnone
When the host movesfollows the target by itselfyou edit the address yourself
Use it fora platform's name, CDNs, DKIM keysyour own server, the root domain
CNAME: two stepswww.github.comgithub.com20.207.73.82
A: one stepdocs.github.com185.199.108.154

CNAME at the root domain: CNAME vs ALIAS, ANAME and CNAME flattening

The root of a domain (github.com) is the top of its zone, and the top must hold the zone's SOA and NS records. A CNAME allows nothing beside it, so it can't go there: the two rules collide (RFC 1034 §4.2.1, RFC 2181 §10.1).

DNS hosts work around it in their own servers: they follow the target themselves and answer with its addresses. Cloudflare calls it CNAME flattening, Route 53 an alias record, DNSimple and NS1 ALIAS, DNS Made Easy ANAME. Resolvers only ever see A and AAAA, so no lookup can show the alias behind them.

There is no standard ANAME: the IETF draft expired in 2019. The standard route is the HTTPS record in AliasMode (RFC 9460), which only clients that ask for it use, so the root still needs its A records.

Why the root can't take a CNAMEgithub.com · its zone's top, Oct 23, 2026

github.com.zone top

  • SOAdns1.p08.nsone.net. hostmaster.nsone.net. …
  • NS8 servers: NS1 + Route 53
  • MX github-com.mail.protection.outlook.com.
  • A20.207.73.82
  • CNAMEanything.example.net.

A CNAME must stand alone, and these records must be here: so no CNAME at the root.

What DNS hosts offer insteadResolvers see

  • Cloudflare · CNAME flatteningon by default at the root, on every planA · AAAA
  • Amazon Route 53 · alias recordto AWS resources or a record in the same zoneA · AAAA
  • DNSimple · ALIASlooks the target up when askedA · AAAA
  • NS1 (IBM) · ALIASA · AAAA
  • DNS Made Easy · ANAMEA · AAAA
  • Azure DNS · alias record setA · AAAA
  • HTTPS record in AliasMode · RFC 9460the only standard: per service, for clients that ask for itHTTPS
Every vendor feature answers with plain addresses, which is why no lookup tool can show the alias behind them.

CNAME chains, TTLs and how long a change takes

An alias may point at another alias: www.microsoft.com goes through two, www.nytimes.com through three. Each record in the chain has its own TTL and is cached on its own, so the copies run out at different times (RFC 1034 §5.3.3).

That's why the lowest TTL isn't the wait. Microsoft's final address lives 20 seconds, but an edit to the first record, the one in microsoft.com's own zone, waits for that record's copies: Google's had 37 minutes left when we checked, Cloudflare's almost the full hour, and any resolver may keep it up to that hour.

Keep chains short. RFC 9460 recommends no more than 8 aliases in a row; BIND and Unbound give up after 11, PowerDNS after 10, Knot after 13. Google and Cloudflare publish no limit.

Each record runs its own clockwww.microsoft.com · checked 07:22:26 UTC, Oct 23, 2026
  1. www.microsoft.comCNAME → www.microsoft.com-c-3.edgekey.netthe record its owner edits1 hrTTL at the zone
    • Google36:37 left · until 07:59:03
    • Cloudflare59:48 left · until 08:22:14

    An edit to this record shows at Google by 07:59:03 and at Cloudflare by 08:22:14 UTC, at any resolver within 1 hr.

  2. www.microsoft.com-c-3.edgekey.netCNAME → e13678.dscb.akamaiedge.net15 minTTL at the zone
    • Google6:58 left · until 07:29:24
    • Cloudflare14:48 left · until 07:37:14
  3. e13678.dscb.akamaiedge.netA 23.2.78.94lowest TTL20 secTTL at the zone
    • Google0:20 left · until 07:22:46
    • Cloudflare0:08 left · until 07:22:34

Published limits, and real chains

www.github.com1 aliaswww.microsoft.com2 aliaseswww.nytimes.com3 aliaseswww.apple.com3 aliases
  • 8 RFC 9460: more than 8 not recommended
  • 10 PowerDNS
  • 11 BIND, Unbound
  • 13 Knot
  • Google, Cloudflare: none published
Bars: what was left of each cached copy when we checked. An edit shows once the copy of the record you edited runs out; the lowest TTL only says how often that part is fetched again.

Dangling CNAMEs and subdomain takeover

A CNAME dangles when its target is gone: a cloud app deleted, a bucket emptied, a domain expired. If someone else can create a resource with that name, they serve your subdomain and can even get a valid certificate for it.

DNS shows it as an NXDOMAIN answer that still carries your CNAME: the target is missing, not your name (RFC 6604 §3). That only works on platforms that give each resource its own DNS name. Others answer for any name, so a deleted site there still resolves: there, check the site itself.

The fix is order: delete the DNS record before the resource, and verify your domain on platforms that offer it. A fixed target can still look missing for a while: resolvers keep the negative answer for the smaller of the target zone's SOA TTL and its minimum field (RFC 2308 §5).

When NXDOMAIN can tell youplatform behaviour, checked Oct 23, 2026

A missing target answers NXDOMAIN

A deleted resource's name stops resolving: our verdict is dangling.

  • *.azurewebsites.netApp Service
  • *.trafficmanager.netTraffic Manager
  • *.blob.core.windows.netBlob Storage
  • *.cloudapp.netCloud Services
  • *.elasticbeanstalk.comElastic Beanstalk
  • *.elb.amazonaws.comElastic Load Balancing
  • *.pages.devCloudflare Pages
  • *.edgekey.netedge hostname
  • *.map.fastly.netmap name

The platform answers any name

A deleted site still resolves: our verdict is points at the platform: check the site is still yours.

  • *.github.ioGitHub Pages
  • *.netlify.appNetlify
  • *.herokuapp.comHeroku
  • *.vercel.appVercel
  • *.myshopify.comShopify
  • *.pantheonsite.ioPantheon
  • *.go-vip.netWordPress VIP
  • *.webflow.ioWebflow
  • *.zendesk.comZendesk
  • *.s3.amazonaws.comAmazon S3
  • *.azurefd.netAzure Front Door
  • *.global.ssl.fastly.netTLS hostname
Made-up example · RFC 2606 names
$ dig shop.example.com A
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN
;; ANSWER SECTION:     # your record is there
shop.example.com.   3600  IN  CNAME  example-shop.example.net.
;; AUTHORITY SECTION:  # no such target; resolvers may keep the miss 5 min
example.net.         300  IN  SOA    ns1.example.net. …

Ownership checks that stop a takeover

  • GitHub PagesTXT _github-pages-challenge-<user>.<domain>
  • Azure App ServiceTXT asuid.<subdomain>
  • WebflowTXT _webflow one-time-verification=…
  • Cloudflare for SaaShostname validation, by TXT or HTTP
  • Netlifydomain lock, through Support
NXDOMAIN with your CNAME still in the answer means the target is missing, not your name.

How to add a CNAME record (GoDaddy, Cloudflare, Namecheap, Squarespace)

Every DNS panel asks for the same three things: the type (CNAME), the host and the target your platform gave you. In the host field type only the label, www or shop: the panel adds your domain itself.

Typing the full name gives www.example.com.example.com, the most common reason a new CNAME "doesn't work". The same happens in a zone file, where a name without its final dot is relative. On Cloudflare, a Proxied record hides the CNAME from lookups: set it to DNS only when a platform must verify it.

Then check it here. Hosts quote anything from a minute to 72 hours; the real wait for a changed record is the old record's TTL, and a brand-new name usually shows at once.

The same record in four panelshost field = the label only

GoDaddyTarget from Shopify

TypeCNAMENamewwwValueshops.myshopify.com

Name: “without the domain name, such as blog or shop”; never @.

CloudflareTarget from Webflow

TypeCNAMENamewwwTargetcdn.webflow.comProxy statusDNS only

Name: “use your subdomain”. DNS only keeps the CNAME visible to lookups; Proxied hides it.

NamecheapTarget from Google

TypeCNAMEHostwwwValueghs.googlehosted.com

Host: “mysubdomain and not like mysubdomain.domain.tld”.

SquarespaceTarget from Framer

TypeCNAMENamewwwDatasites.framer.app

Name: “It's not possible to add a CNAME with @ in the Name field.”

Host typed: www.example.comThe panel saves www.example.com.example.com: type www.

What hosts say vs the TTL

  • Route 53within 1 min, to its own servers
  • Namecheap30 min
  • GoDaddy1 hr, up to 48 hrdefault TTL 1 hr
  • Hostingerup to 24 hrdefault TTL 4 hr
  • Squarespace24 hr to 48 hrdefault TTL 4 hr
  • Gandiup to 72 hr

what the host saysits default TTL: how long resolvers may keep the old record

Each target shown is that platform's documented CNAME target. Bars on one scale of hours; a brand-new name usually shows at once.

Cloudflare error 1014: CNAME cross-user banned

Error 1014 appears when a name on Cloudflare points, by CNAME, at a name in another Cloudflare account. Cloudflare blocks it so one customer can't route traffic through another's settings.

It's allowed inside one zone, between zones of the same account, and through Cloudflare for SaaS, where the target's owner adds your name as a custom hostname. That's the fix when you point a domain at a SaaS that runs on Cloudflare. Other causes: an R2 custom domain whose zone is on hold, or a banned zone.

A lookup can only hint at it: when both zones use Cloudflare's nameservers, 1014 is possible if they're in different accounts. DNS shows zones, never accounts, and a proxied record hides the CNAME itself, so only a DNS-only one shows up here.

Two accounts, one CNAMEmade-up example · RFC 2606 names

Account A

shop.example.comCNAME → shops.example.net

1014cross-user banned

Account B

shops.example.netproxied · the SaaS provider's own zone

  • Same zonewww → example.com
  • Same accountone zone → its sister zone
  • Cloudflare for SaaSthe target's owner adds your hostname

Other causes: an R2 custom domain whose zone is on hold, or a banned zone.

What this tool can say: when both zones answer from *.ns.cloudflare.com, a 1014 is possible if the accounts differ. DNS shows zones, never accounts. A *.cdn.cloudflare.net target is Cloudflare's partial CNAME setup, not SaaS.

CNAME vs redirect

A CNAME is not a redirect. It only tells DNS where to find the address; the browser keeps the name you typed in the address bar, sends it to the server and expects a certificate for it.

That's why platforms make you add your domain on their side too: their server must recognise www.example.com and serve a certificate for it. A CNAME to a server that doesn't know your name shows its default page or a certificate error.

To send visitors from one URL to another, use an HTTP redirect (301 or 308) on a web server, or your DNS host's forwarding feature, which runs such a server for you. The Redirect Checker shows each hop of one.

What the browser seesmade-up example · RFC 2606 names

CNAMEthe name stays

www.example.com

  • DNS: www.example.com → CNAME sites.example.net → its address
  • TLS: the certificate must name www.example.com
  • HTTP: Host: www.example.com; the server must know it

301the URL changes

www.example.net/

  • DNS: example.com → the A record of a web server
  • HTTP: 301 Location: https://www.example.net/
  • Browser: loads the new URL, which gets its own DNS lookup

CNAME lookup: frequently asked questions

What is a CNAME record?

A CNAME record makes a name an alias of another name, the canonical name. When a resolver asks for the alias, the answer says to look up the target instead, and the target's own A or AAAA records give the address. The value is always a name, never an IP address, and a name with a CNAME can hold no other record.

How do I check a CNAME record?

Type the name into the CNAME Lookup above: it asks each zone's own nameserver and shows every alias with its TTL, the platform behind it and the final addresses. On a computer, run dig www.example.com CNAME on macOS or Linux, nslookup -type=cname www.example.com on Windows, or Resolve-DnsName www.example.com -Type CNAME in PowerShell.

What's the difference between a CNAME and an A record?

An A record holds an IPv4 address; a CNAME holds another name and borrows that name's addresses. Use an A record at the root domain and for your own server. Use a CNAME when a platform such as Vercel, GitHub Pages or a CDN gives you a name to point at, so your record follows them when they move their servers.

Can I put a CNAME on my root domain?

No. The root is the top of the zone, which must hold the SOA and NS records, and a CNAME allows no other record beside it. DNS hosts offer workarounds that answer with plain addresses: Cloudflare's CNAME flattening, Route 53 alias records, ALIAS at DNSimple and NS1, ANAME at DNS Made Easy. The only standard is the HTTPS record in AliasMode.

Why can't I see my CNAME?

Four usual reasons: the record is proxied or flattened by Cloudflare, so resolvers only see Cloudflare's addresses; the host field got the full name, creating www.example.com.example.com; the name still has an A record, which a CNAME can't sit beside; or resolvers still hold the old answer until its TTL runs out. The lookup above shows the zone's DNS host, what the name holds and each copy's time left.

How long does a CNAME change take?

As long as the old record's TTL, counted from when each resolver last fetched it. Every record in a chain is cached on its own, so an edit to the CNAME you own waits for that record's copies, even if the final address has a TTL of seconds. A brand-new name usually shows at once, unless someone asked for it before it existed.

What is a dangling CNAME?

A CNAME whose target no longer exists: a deleted cloud app, an emptied bucket or an expired domain. If someone else can create a resource with that target name, they can serve your subdomain. Where each resource has its own DNS name, the lookup shows NXDOMAIN with your CNAME still in the answer; delete the record or point it somewhere live.

How many CNAMEs can be chained?

DNS sets no fixed maximum, but RFC 9460 recommends no more than 8 aliases in a row. Resolvers give up at their own limits: BIND and Unbound after 11, PowerDNS after 10, Knot after 13; Google and Cloudflare publish none. Real chains are short: the twelve well-known sites we recorded use none to three aliases.

Can a CNAME point to an IP address?

No. A CNAME's value must be a host name. Typed into a CNAME, an address such as 192.0.2.1 is read as a name made of four numeric labels, which doesn't exist, so the alias leads nowhere. To point a name at an address, use an A record for IPv4 or an AAAA record for IPv6 instead.

Is a CNAME the same as a redirect?

No. A CNAME only changes where DNS finds the address; the browser keeps the original name in the address bar and asks the server for it, so the target must accept your domain and have a certificate for it. To send visitors to another URL, use an HTTP 301 or 308 redirect on a web server, or your DNS host's forwarding.

What does Cloudflare error 1014 mean?

CNAME Cross-User Banned: a name on Cloudflare points, by CNAME, at a name in a different Cloudflare account. It works inside one zone, between zones of one account, or through Cloudflare for SaaS, where the target's owner adds your hostname. If you point at a SaaS that runs on Cloudflare, ask them to set your domain up as a custom hostname.

Why do DKIM selectors use CNAMEs?

Mail services publish the DKIM key in their own zone and ask you to point a selector at it, so they can rotate keys without your help. Microsoft 365 uses selector1 and selector2, SendGrid s1 and s2, Mailchimp k2 and k3. The CNAME ends at a TXT record, not an address: the Common subdomains mode checks them all.

Missing something?Suggest a feature or a new tool

Related DNS tools