We're using Google App Engine for a service of our app.

We've set up the service on a custom sub-domain (eg service.myapp.com), while doing so, Google prompted us to Update your DNS records to enable security

What's confusing me about this is:

  1. We've already set up the CNAME to point to the app on the subdomain
  2. The record's that google is suggesting would seem to modify our main domain (myapp.com) rather than the subdomain (service.myapp.com)

Here's what google suggested:

Type    Data                    Alias
AAAA    2001:4860:4802:32::15   
AAAA    2001:4860:4802:34::15   
AAAA    2001:4860:4802:36::15   
AAAA    2001:4860:4802:38::15   
CNAME   ghs.googlehosted.com    service

The last one seems to make sense, but all the rest I would think would break our app by pointing the main domain to google (where it is NOT hosted), no?


I did try adding the A and AAAA records for host, but it was disallowed because the CNAME is already set up (We're using Amazon Route 53):

RRSet of type A with DNS name communications.raisely.io. is not permitted because a conflicting RRSet of type CNAME with the same DNS name already exists in zone myapp.com.

The host is working with SSL and without the A or AAAA records (just the CNAME), so it seems like these aren't necessary.

  • When you verified/added your domain to Google have you verified "service.myapp.com" or "myapp.com"? – A.Queue May 29 '18 at 8:23
  • Just for the record: to me it looks like you verified "service.myapp.com", but I'm not sure. – A.Queue May 29 '18 at 8:30
  • Nope, it was myapp.com that i verified – ChrisJ May 29 '18 at 9:32
1 is a google owned IP. My guess is they are just trying to help people that know little about operations.

People might setup www.domain.com and forget about domain.com Since its bad practice (old school dns talk) to have a CNAME for your root entry that's why its a A record to an IP

I wouldn't worry about it.

The AAAA are for IPv6


When adding a custom domain you can set it to the subdomain (service.myapp.com) instead of the naked domain(myapp.com), which means that:

  • The verification would be done against the subdomain service.myapp.com.
  • A and AAAA will be placed under service.myapp.com too.
  • CNAME www.service.myapp.com will be added.

This way there shouldn't be any conflict with the current provider for myapp.com.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.