This question already has an answer here:

We have a ton of client sites pointing to ns1.hostingcompany.com. I'd like to create whitelabel nameservers so we can easily move sites/servers as needed.

For example, I'd like to try Cloudflare which gives me their own nameservers, but I don't want to have to update every domain only to decide a year from now to cancel and set them all back.

Can I (without problems) set up CNAME records for:


...and then update all of my domains, ultimately pointing that CNAME to whatever nameservers I want?

This would allow me to point those at Cloudflare's nameservers (for example) but then, if I changed services 6 months from now, I could point them to another nameserver, only changing two records at my whitelabel domain rather than two records at each site's domain.

marked as duplicate by ceejayoz, mdpc, Scott Pack, fuero, kasperd Feb 18 '15 at 13:44

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I was looking for an update as most of the answers I found were a few years old. Didn't know if anything changed, but apparently it hasn't. Thanks! – gr8m8 Feb 18 '15 at 2:10


The domain name used as the value of a NS resource record, or part of the value of a MX resource record must not be an alias. Not only is the specification clear on this point, but using an alias in either of these positions neither works as well as might be hoped, nor well fulfills the ambition that may have led to this approach. This domain name must have as its value one or more address records. Currently those will be A records, however in the future other record types giving addressing information may be acceptable. It can also have other RRs, but never a CNAME RR.


Yes, you can use CNAME records to alias the authoritative nameservers for a zone. There are no special restrictions on how an NS record is resolved, as long as it points to the SOA. Simply add the CNAME records to your whitelabel domain's zone file as you mentioned.

  • 2
    The RFCs say otherwise. – ceejayoz Feb 17 '15 at 23:28
  • Good point, I stand corrected. However, the original DNS RFCs were written to ensure zone records complied with the functional restrictions of now-ancient versions of BIND. In practice, it can and does work, but some caches will probably not follow them. – dartonw Feb 17 '15 at 23:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.